Framework · Broker-dealer
Supervision and recordkeeping evidence for generative AI under FINRA 24-09.
FINRA Regulatory Notice 24-09 makes the point plainly: the rules you already follow on supervision, recordkeeping, and communications apply to generative AI. Meilynx is how you extend those controls to AI without standing up a parallel stack.
Existing rules, applied to AI.
Regulatory Notice 24-09 reminds member firms that FINRA's existing rules apply to generative AI as they apply to any other technology. FINRA Regulatory Notice 24-09, explained covers the Notice in full and what FINRA has said since.
Each rule, to a control.
The specific Meilynx control for each rule 24-09 points to, and the record it produces.
FINRA 24-09 → Meilynx controls
| Requirement | How Meilynx maps | Examination artifact |
|---|---|---|
Supervise the use of generative AI FINRA Rule 3110 | Policy-as-code enforces what AI may and may not do, inline; governance findings and a review surface give supervisors a reviewable record of AI activity. | Supervisory policy + findings log |
Make and preserve books and records FINRA Rule 4511 · SEA 17a-4 | Each AI response the proxy delivers, and each request it blocks, is written to a WORM audit store with a 6-year retention floor and sealed in a tamper-evident hash chain. | WORM audit trail · 6-yr retention |
Supervise communications with the public FINRA Rule 2210 · Rule 3110 | AI-generated communications are routed to a supervisory review queue with two-party approval. Each response the proxy delivers is preserved in the WORM record with its policy decision attached, and review decisions keep an append-only history. | Supervisory review decisions · WORM archive |
Protect material non-public information Information barriers | MNPI detection flags or blocks material non-public information before it reaches a model or leaves in a response, attributable to the team involved. | MNPI findings, by team |
Manage model and vendor risk Reg Notice 24-09 | An auto-populated model inventory and a per-customer isolated data plane address the model- and third-party-risk themes the notice raises. | Model inventory + isolation record |
Supervise the use of generative AI
FINRA Rule 3110
Maps to · Policy-as-code enforces what AI may and may not do, inline; governance findings and a review surface give supervisors a reviewable record of AI activity.
Examination artifact · Supervisory policy + findings log
Make and preserve books and records
FINRA Rule 4511 · SEA 17a-4
Maps to · Each AI response the proxy delivers, and each request it blocks, is written to a WORM audit store with a 6-year retention floor and sealed in a tamper-evident hash chain.
Examination artifact · WORM audit trail · 6-yr retention
Supervise communications with the public
FINRA Rule 2210 · Rule 3110
Maps to · AI-generated communications are routed to a supervisory review queue with two-party approval. Each response the proxy delivers is preserved in the WORM record with its policy decision attached, and review decisions keep an append-only history.
Examination artifact · Supervisory review decisions · WORM archive
Protect material non-public information
Information barriers
Maps to · MNPI detection flags or blocks material non-public information before it reaches a model or leaves in a response, attributable to the team involved.
Examination artifact · MNPI findings, by team
Manage model and vendor risk
Reg Notice 24-09
Maps to · An auto-populated model inventory and a per-customer isolated data plane address the model- and third-party-risk themes the notice raises.
Examination artifact · Model inventory + isolation record
Books and records, ready.
The audit trail renders into a package aligned to the FINRA reflex: a supervisable record of AI activity, communications findings, and a WORM-backed history retained to the regulatory floor.
In the package
- Supervisory policy snapshot and review findings.
- Supervisory review decisions and approval history (Rule 2210 / 3110).
- Model inventory drawn from live traffic.
- WORM audit trail, 6-year retention, SHA-256 integrity hash.
24-09 and AI.
How does Meilynx support the recordkeeping requirement?
Each AI response the proxy delivers, and each request it blocks, is written to a write-once, read-many audit store with a 6-year retention floor, aligned to the FINRA Rule 4511 and SEA 17a-4 expectations. The record is sealed in a tamper-evident hash chain so an examiner can verify it.
Can supervisors actually review what the AI did?
Yes. Because enforcement happens inline, each AI response the proxy delivers and each request it blocks lands in the audit trail with the policy decision attached. Supervisors review a record of AI activity that already exists; nothing has to be reconstructed after the fact.
Build the evidence.
See exactly what an examiner receives
Request a sample examination package: model inventory, control coverage, a governance policy snapshot, and a SHA-256 integrity hash.