A small compliance team at a growing firm can now run a deeper testing program, broader regulatory-change tracking, and more continuous surveillance than headcount would historically allow. Here’s what that looks like in production, all built in-house and wired directly to the firm’s data warehouse and systems of record.
Ongoing supervision, running daily and weekly
- Employee trade surveillance: every employee personal trade compared against firm trading activity, with front-running, piggybacking, and overlap flagged at severity ratings that feed the Code of Ethics testing program.
- AML screening: government watchlist notices parsed, name-matched against customer records, cross-referenced on secondary identifiers, and confirmed matches reported within the mandated window, every cycle, on time, with archived workpapers.
- Communications surveillance: daily automated review of in-app community channels against conduct and market-abuse standards, with triaged escalation.
- Regulatory-change tracking: weekly agentic scans of regulator publications, severity-rated and routed to a live risk-alert center, with same-day escalation for high-priority items.
- Reporting: daily compliance digests and a weekly leadership-facing compliance report compiled automatically from six data sources, including a data-source health table that flags its own blind spots.
The testing program is AI-native.
The adviser’s Rule 206(4)-7 program runs as a structured system: 28 testing areas across four pillars, each a standing workpaper covering objective, regulatory basis, methodology, sample, findings, remediation, and sign-off, all compiling into the annual review. Most areas are executed by purpose-built agents with documented human review.
Including a pillar that tests the AI itself.
The program supervises its own supervisor: a quarterly AI-governance test covering tool inventories, least-privilege data access, and PII exposure, with a zero-tolerance threshold for unapproved AI access to sensitive data, and a recurring review that samples AI-generated compliance outputs and benchmarks false-positive and false-negative rates. The operating rule: any AI output relied upon without documented human sign-off is an exception.
Build-versus-buy is a discipline, not a default.
We’ve evaluated the leading compliance-AI vendors seriously and passed, because keyword-driven review over-flags and under-thinks. The alternative isn’t “no tooling”; it’s tooling whose rule sets we wrote, whose failure modes we test, and whose outputs we can defend line by line.