AI in Trading 2026: Closing the Enforcement Gap

— AI Trading Newsletter

AI in Trading 2026: Closing the Enforcement Gap

Regulators are starting to deploy AI to surface what to investigate – when most firms have yet to even start proving what agents did.

AI is increasingly becoming embedded in trading workflows. The governance frameworks on how agents reason together, influence each other, and produce decisions do not yet exist – and new research illustrates why this matters. Here’s what I learnt this week on AI in Trading:

1. AI Surveillance and Congressional Subpoenas: The Enforcement Architecture Takes Shape

On 18 May, CFTC Chair Michael Selig told WIRED the agency is deploying AI tools to determine where to direct enforcement action: “You’ve got so much data. When we feed it into AI, we get really great information. It can help us understand things, like where we might want to investigate, or when we might need to send a subpoena to a trader. We’re going to find them, and we’re going to bring actions.” The CFTC is pursuing hundreds, if not thousands, of insider trading tips across prediction markets, using Chainalysis for blockchain tracing and Nasdaq Smarts for centralised markets, and applying extraterritorial jurisdiction to offshore platforms where enforceable. On 22 May, House Oversight Committee Chair James Comer opened a formal Congressional investigation into Kalshi and Polymarket, requesting documents on KYC standards, suspicious trade detection policies, and all internal communications related to wagers on the Iran war and the Venezuela strike – the latter following the arrest of US Army Master Sergeant Gannon Van Dyke for using classified information to generate over $400,000 in Polymarket profits, and a New York Times investigation identifying over 80 instances of potential insider trading, including wagers placed hours before undisclosed US and Israeli military operations against Iran.

Why this matters for AI in Trading: The CFTC and Congressional actions are prediction markets and crypto enforcement stories today. The question for secondary markets is how quickly the same architecture extends. AI-generated subpoena triggers represent a fundamental shift in how enforcement begins – from regulators reviewing what they can see to algorithms surfacing what they should look for. For trading firms, this changes the audit trail. A firm that cannot reconstruct agent decision logic and demonstrate clean separation between AI-generated signals and execution has a liability problem. Market Abuse Regulation was built around human intent and human evidence trails. The enforcement architecture being built now runs on pattern recognition at machine speed. The gap between what firms can prove about their own systems and what regulators can now surface about market behaviour is closing faster than most compliance teams have planned for.

2. Architecture Is Governance: The Multi-Agent Topology Problem

Yao et al. at AWS AI Labs and the University of Wisconsin-Madison tested whether improving a judge agent’s independence in multi-agent debate systems improves overall accuracy. According to the study – it does not. This matters as the judge inherits whatever the debating agents produced. Validating the output cannot fix what went wrong in the conversation that produced it. Accuracy is determined by how agents interact, but not by how their outputs are reviewed – which means audit layers that see only downstream outputs cannot reconstruct what went wrong upstream. “For any firm building multi-agent systems, this means that adding a review step after agents have reached a conclusion is not oversight of how that conclusion was reached. It is just documentation of the result.

Why this matters for AI in Trading: In execution, the strongest signal is the one produced before agents start influencing each other. By the time agents have shared their views and adjusted accordingly, the original read on market conditions – spread, depth, momentum – may already have been diluted. If delayed execution then produces poor outcomes, the system learns to distrust its own early signals, which makes the problem self-reinforcing. Three questions are emerging on questioning multi-agent systems: Does the challenge agent push back regardless of whether the evidence actually supports doing so? Do the agents checking the work see the same inputs as the agents doing the work, or only the final output? Is there a limit on how many rounds of discussion are allowed before a decision is made? The answers to these questions are likely to say more on the level of risk in a system – and none of them can be found by reviewing the final output.

3. Post-Trade Infrastructure Is Being Rebuilt – and AI Governance Has to Travel With It

DTCC confirmed it will begin limited production trades of tokenised securities through its Depository Trust Company unit in July 2026, with full commercial launch in October. The pilot – backed by SEC no-action relief, built on Digital Asset’s Canton Network, with over 50 firms including BlackRock and JPMorgan – covers Russell 1000 components, major index ETFs, and US Treasuries. DTC participants can elect blockchain-based record-keeping while the traditional ledger runs in parallel. DTCC oversees $114 trillion in assets; even a narrow pilot touches the core of daily institutional flow. In the same week, the EU T+1 Industry Committee published its second readiness survey with a deadline of 9 June, as European markets advance toward October 2027 go-live, with December 2026 set as the industry deadline for intraday allocation and confirmation automation.

Why this matters for AI in Trading: Both developments focus on the same issue – the removal of the operational slack that currently absorbs data errors. Under T+1, there is no overnight window to fix mismatched standing settlement instructions or inconsistent counterparty data – an AI agent moves faster through inconsistency rather than resolving it. Tokenised settlement compounds this: smart contracts execute automatically when conditions are met, so data quality failures that currently surface at end-of-day instead surface at execution, with no manual intervention possible. The cross-boundary auditability problem that agentic AI has already exposed in post-trade becomes harder to contain when the boundary between what was authorised and what executed is embedded in code. October 2026 and October 2027 are not distant deadlines. They are the dates by which data foundations, agent governance, and cross-firm auditability need to be operational – not aspirationally, but in production.

4. The Governance Vacuum: US Regulators Step Back Precisely Where Agentic AI Is Accelerating

While the SEC and CFTC are stepping up, the Federal Reserve, FDIC, and OCC have replaced the fifteen-year-old SR 11-7 model risk guidance with the new SR 26-2. Buried in the text is an important sentence: generative AI and agentic AI are explicitly excluded from scope, on the basis they are too novel and rapidly evolving. The framework that governed model risk for fifteen years has been superseded by one that ignores the exact category of technology being deployed most aggressively into KYC, AML, credit underwriting, and trading workflows. Agentic deployment in finance has surged from 7% to 44% since January 2025. SR 26-2 covers none of it. The EU continues to move in the opposite direction – as covered in previous editions, the European Commission published draft guidelines this week on high-risk AI classification under Article 6, providing concrete examples of what qualifies under Annex III and opening a stakeholder feedback window now. For trading firms, correctly classifying systems under these guidelines determines whether the full Article 14 human oversight obligations apply – and the window to shape those definitions before they become binding is open now.

Why this matters for AI in Trading: The Grok/Bankrbot permission chain incident, documented by SlowMist in May, shows what the SR 26-2 governance vacuum looks like in practice. An attacker sent Morse code to @grok on X; Grok decoded it and output transfer instructions tagging @bankrbot; @bankrbot treated Grok’s natural language reply as a valid executable command and transferred real on-chain assets. Grok held no private keys and executed nothing – it was exploited as an intermediary whose output was treated as authorisation. The failure was a trust model with no boundary between a conversational AI and a financial execution layer: natural language output mapped directly to asset transfer with no validation of source or intent. SR 26-2 no longer mandates that boundary exists. EU Article 14 requires it – but only for systems correctly classified as high-risk, which is precisely what the EC draft guidelines are still resolving. The asset class in the Grok case was crypto. The permission chain architecture is identical in traditional markets. A firm that cannot define, document, and enforce the boundary between its AI systems and its execution layer does not have a technology problem. It has a liability problem, with no regulatory framework currently requiring it to solve one.

5. Memory Fragmentation: The Institutional Coherence Problem at Scale

The structural problem that will define mature multi-agent trading deployments is unlikely to be individual agent failure but institutional semantic drift. As agents accumulate their own episodic memory, they develop inconsistent procedural and semantic understanding of how the firm operates: one agent encodes a risk parameter differently, another develops a different understanding of a counterparty’s settlement preferences. Six months later, three agents run the same process three different ways. The distinction that matters: episodic memory – what happened in this interaction – belongs in the agent. Procedural and semantic memory – how things are done and what things mean – must live in a shared, governed layer all agents draw from. Without a promotion policy governing what earns its way from episodic trace into shared institutional memory and what gets evicted when stale, the shared layer becomes a write-only log: every agent contributes, no one curates, contradictions compound.

Why this matters for AI in Trading: In trading, semantic drift has direct risk consequences. An execution agent with a different operational understanding of a counterparty’s preferences from the relationship agent creates the same failure Broadridge identified last week – faster movement through inconsistency rather than resolution of it. The governance requirement is not infrastructure but risk management: shared ontologies, governed context layers, and explicit policies determining what earns its way into shared institutional memory and what expires. The hardest AI problem in a mature multi-agent trading environment will not be reasoning capability. It will be maintaining a consistent organisational understanding of reality across agents, desks, and time. Firms building that shared layer now are building what governed agentic trading depends on.

Five themes, one conclusion. AI is increasingly becoming embedded in trading workflows and the evidence this week – on AI-powered enforcement closing in on market behaviour, topology-driven accuracy collapse in multi-agent systems, tokenised settlement removing the operational slack that absorbs data errors, a regulatory vacuum where model risk governance should be, and institutional memory fragmenting across agent deployments – still describes one central problem: the governance architecture is not keeping pace with the deployment architecture. That is the issue the industry will need to focus on first – before agents can create exactly the sort of chaos depicted in the worst-case scenario.

As always, feedback and comments very welcome.

Have a good week.

Rebecca
Rebecca Healey | AI in Trading 2026