Financial Industry Regulatory Authority (FINRA) has been consistent on one point for two years running: it isn't writing new rules for artificial intelligence. It's applying the rules already on the books, such as supervision, communications, recordkeeping, Regulation Best Interest (Reg BI), anti-money laundering (AML), to whatever tool a firm happens to be using, AI included. That's the good news. The bad news is that "no new rules" doesn't mean "no new exposure." It means the burden is on firms to map a fast-moving technology onto a rulebook that wasn't written with it in mind, and to do it before an examiner asks how.

The signal that this is no longer a back-burner issue has gotten louder with each FINRA publication. Regulatory Notice 24-09 reminded members that GenAI implicates essentially the entire rulebook. The 2025 Annual Regulatory Oversight Report added detail on governance and testing expectations. The 2026 Report went further still, adding a standalone GenAI section and, for the first time, explicit guidance on autonomous AI agents: systems that can act on a user's behalf without a human approving each step.

For compliance and legal teams, the practical problem is less "is AI a risk" and more "where exactly does our existing program have gaps." Many firms have “some” AI-related language in their written supervisory procedures (WSP) by now. Far fewer have an inventoried use case list, documented testing for hallucination and bias, supervisory sign-off mapped to Rule 3110, Rule 2210 review applied consistently to AI-drafted communications, vendor due diligence that actually asks how the vendor itself uses GenAI, and a recordkeeping process that captures AI prompts and outputs the same way it captures everything else.

That gap is exactly what we built our checklist to close.

**The AI Usage Controls Checklist for FINRA-Registered Broker-Dealers** organizes 13 control areas involving governance, supervision and WSPs, model risk testing, public communications, recordkeeping, cybersecurity and Regulation S-P (Reg S-P), vendor diligence, AML and fraud, senior investor protection, market integrity, outside business activities, training, and exam readiness into a single working document. Every control item is tied to the specific rule or FINRA guidance behind it, so the checklist doubles as a citation map when it's time to update WSP language or respond to an exam request. It also includes a quick-reference table of the underlying rules (3110, 2210, 4511, Regulation S-P, Regulation S-ID (Reg S-ID), 3310, and more) for anyone who wants the regulatory backbone at a glance.

If your firm hasn't formally inventoried its AI use cases, including the AI that may be quietly embedded in software you've been using for years, that's the place to start and Three Mile Advisors and Tarter Krinsky & Drogin can assist you in performing that analysis. To obtain a comprehensive AI compliance checklist that will help firms translate FINRA rules into concrete controls, please contact Stephen Zak (szak@threemileadvisors.com) or Robert Heim (rheim@tarterkrinsky.com). 

Stablecoins Just Got a Lot Cheaper to Hold: What the New 2% Haircut Means for Your Net Capital

For years, broker-dealers that wanted a proprietary position in a stablecoin faced a capital problem. Rule 15c3-1 has never explicitly addressed stablecoins, and in the absence of guidance, many firms did what cautious FinOps do with regulatory silence: they assumed the worst. A 100% haircut — treating the position as worthless for net capital purposes — was the conservative default at a number of firms, even though the underlying reserves backing those tokens looked a lot like the cash and short-term Treasuries sitting in a money market fund.

That math just changed.

Because broker-dealers must deduct applicable haircuts when calculating net capital, the percentage assigned to an asset directly affects how much regulatory capital the firm must maintain. On February 19, 2026, the SEC’s Division of Trading and Markets updated its crypto FAQ to address exactly this gap. The staff stated it will not object if a broker-dealer treats a proprietary position in a qualifying “payment stablecoin” as having a “ready market” under Rule 15c3-1 and applies a 2% haircut — calculated on the market value of the greater of the long or short position, not netted — when computing net capital. Put simply: a $100 proprietary stablecoin position now counts as $98 toward net capital, not $0.

A few details worth noting:

It’s staff guidance, not a rule change. This is FAQ-level relief from SEC staff, not formal rulemaking. Commissioner Hester Peirce, who has been vocal that a 100% haircut was “unnecessarily punitive,” said she’d like to see Rule 15c3-1 formally amended to address stablecoins directly — but for now, firms are relying on a “we will not object” position. That’s meaningfully softer ground than a codified rule, and worth flagging in any capital adequacy memo.

The definition of “payment stablecoin” is doing a lot of work. The FAQ ties the 2% treatment to a specific definition — currently keyed to attestation standards around reserve composition, and after the GENIUS Act’s effective date, to stablecoins meeting that Act’s definition and issued by a “permitted” or “foreign” payment stablecoin issuer. Not every token marketed as a “stablecoin” will qualify. Treating a non-qualifying token under this favorable haircut would be a net capital miscalculation — exactly the kind of finding FINRA exam staff look for.

The “greater of long or short” detail isn’t a technicality. The haircut applies to whichever side of the position is larger; firms can’t reduce their capital charge by netting offsetting exposures on paper.

This lands squarely in FINRA’s existing net capital scrutiny. FINRA doesn’t need a new rule to examine this — net capital miscalculations, haircut misapplication, and inadequate processes for classifying nonmarketable or non-qualifying assets are already recurring findings in FINRA’s oversight reports. A firm claiming the 2% rate on a stablecoin that doesn’t meet the FAQ’s definition is the kind of “incorrect haircut” issue examiners have flagged before — just with a new asset class attached.

For broker-dealers already active in crypto, or weighing whether a stablecoin proprietary position makes sense, this guidance meaningfully narrows the capital cost of doing so. But “narrowed” isn’t “eliminated,” and the relief is only as good as the firm’s process for confirming, position by position, that what it’s holding actually meets the FAQ’s definition of a qualifying payment stablecoin.

Robert Heim
Co-Chair, White Collar and Regulatory Enforcement Practice, Tarter Krinsky & Drogin
rheim@tarterkrinsky.com

Stephen Zak
President, Three Mile Advisors LLC
szak@threemileadvisors.com

*This newsletter is for informational purposes only and not legal advice.*