Most guides to AI compliance for financial advisors land on the same instruction. Route each AI-drafted client message through a human approval step. As practice, the advice is sound. Read as a statement of what FINRA's rules require of a member firm, it is wrong.
Ask which rule requires anyone to approve a message going to one client. For most client correspondence at a FINRA member, none does. A one-to-one message sits on the other side of a line drawn by audience size. The supervisory regime there was built around a trained person composing at human pace.
This applies to registered representatives at FINRA member broker-dealers, including dual registrants. Investment advisers regulated only by the SEC or a state work under different rules, which this article does not cover.
What FINRA Actually Requires of a One-to-One Client Message
FINRA Rule 2210 defines correspondence as "any written (including electronic) communication that is distributed or made available to 25 or fewer retail investors within any 30 calendar-day period." A retail communication is the same thing distributed to more than 25. That side of the rule is why approving a marketing template does not approve the message that sends. An appropriately qualified registered principal must approve each retail communication before the earlier of its use or filing. Correspondence goes to Rule 3110 instead: "All correspondence is subject to the supervision and review requirements of Rules 3110(b) and 3110.06 through .09."
So a message an AI assistant drafts and an advisor sends to one client is correspondence. FINRA's Regulatory Notice 24-09 states that its rules are technology neutral, and that Rule 2210's content standards apply whether a person or a technology tool generated the communication.
The message carries Rule 2210's content standards in full. It does not carry the principal pre-approval requirement.
Why the Category Line Moved Against You
Nothing in the rule changed. What changed is how many one-to-one messages a firm can now produce.
The threshold counts recipients, not authors and not drafts. A model can compose ten thousand messages, each going to a single client. Every one is correspondence.
FINRA does not require a registered principal to approve any of them before they are sent.
The same problem at the model level, rather than the message level, is set out in how supervisory guidance reaches the model and stops short of the answer.
What the Advisor's Read Actually Checks
What follows is a composite, assembled from described practice rather than any single firm.
A registered representative at a broker-dealer asks the drafting assistant for a note to one client about a fee change. The assistant produces it from the client record. The representative reads it, finds it accurate, and sends it.
The message implies the fee treatment holds through the next review cycle. Nobody at the firm approved that implication. The client acts on it and raises it six weeks later.
The existing controls deserve their due, because they are substantial. Rule 2210(d)(1)(A) binds every member communication, correspondence included. All of them "must be based on principles of fair dealing and good faith, must be fair and balanced ..." Rule 2210(d)(1)(B) prohibits any "false, exaggerated, unwarranted, promissory or misleading statement or claim."
The implied fee commitment in the composite is the kind of promissory claim that rule prohibits. The representative checked the facts. Nothing in the process told the representative to check for promises.
Rule 3110(b)(4) requires supervisory procedures "appropriate for the member's business, size, structure, and customers." It directs correspondence review at identifying and handling customer complaints, instructions, funds and securities, and communications on subject matters that require review under FINRA rules and federal securities laws. Reviews must "be conducted by a registered principal" and "be evidenced in writing." Supplementary Material .07 adds one more requirement: "Merely opening a communication is not sufficient review."
Supplementary Material .06 sets the arrangement that governs this message. "By employing risk-based principles, a member must decide the extent to which additional policies and procedures" are needed for correspondence outside the subject matters Rule 3110(b)(4) lists. Where procedures do not require all correspondence to be reviewed before use or distribution, they must instead provide for education and training of associated persons, documentation of that training, and surveillance and follow-up.
Two limits follow. Both are this article's reading, not FINRA's position.
First, training is aimed at the people who compose. Here a model composes, and the registered person has moved from author to reader. Second, the arrangement was sized for the volume of an advisor's working day. Assisted drafting removes that limit.
The strongest objection is that this is a distinction without a difference. Rule 3110 still requires a supervisory system reasonably designed to achieve compliance, and Supplementary Material .07 already rules out a review that is only a glance. Every serious firm has the advisor read before sending.
The objection is right about the obligation and wrong about what the review checks. The rule sets the firm a duty and leaves the method to the firm. The method it names is a subject-matter list: complaints, instructions, funds and securities, and whatever else FINRA rules require review of. A written firm standard for what a client message may say is a different object, and no rule requires one.
The advisor is reading for whether the message suits this client. Where the firm has not written that standard, there is nothing for that read to measure against. A control with nothing to measure against is a reader, not a release gate.
The self-service channel raises a different evidence question, taken up in what a banking chatbot transcript proves, and what it does not.
Where the Standard Has to Come From
The enterprise stack still lacks a consistent, independent control layer that verifies AI-generated language against the brand's own standard before release.
LuxeDetect™ is AI Brand Integrity Infrastructure: the independent, deterministic brand-integrity release gate across the enterprise AI stack. LuxeDetect™ independently evaluates every AI-generated output before it goes live, scoring alignment with brand tone, style, and standards against a benchmark the brand owns. It detects misalignment, flags inconsistencies, and intercepts brand-damaging content before it reaches the public. The benchmark is the LF1000 Brand Benchmark, the firm's own versioned definition of what an acceptable client message says, with the result and its rationale logged.
LuxeDetect™ does not generate or rewrite the content it evaluates. For a broker-dealer, the firm's written standard for client messages is its brand standard.
LuxeDetect™ does not discharge a supervisory obligation, and it does not substitute for a registered principal's review or for legal advice. It measures the message against the brand-owned standard and enforces the release-gate action on the result. The standard does not belong to the model, the platform or LuxeDetect™. It belongs to the brand.
Four Questions to Ask of Your AI-Drafted Client Correspondence
Take these to whoever owns communications supervision.
- Which FINRA category do these messages fall into, and have we confirmed it against the 25-investor threshold rather than assumed it?
- Do our written supervisory procedures require pre-use review of this category, or do they rely on training plus surveillance?
- If a person reviews the draft, what written standard are they reading it against?
- If an examiner asked what this message was measured against before it was sent, what would we produce?
Question three is the one a firm cannot answer unless it has written that standard down.
Frequently Asked Questions
Does FINRA Require Approval of AI-Generated Client Emails?
Not where the message is correspondence. Rule 2210 requires an appropriately qualified registered principal to approve each retail communication before the earlier of its use or filing. It routes correspondence to Rule 3110's supervisory provisions instead. How the message was drafted does not change its category, and FINRA's Regulatory Notice 24-09 confirms that its rules apply to communications generated by technology tools. This analysis is FINRA-specific.
What Is the Difference Between Correspondence and Retail Communications?
Audience size within a rolling window. Correspondence is distributed or made available to 25 or fewer retail investors in any 30 calendar-day period. A retail communication is distributed or made available to more than 25 in that period. Both carry Rule 2210's content standards. Only the retail communication carries the pre-approval requirement.
Who Has to Review AI-Drafted Client Messages?
No FINRA rule requires that every one be reviewed before it is sent. Supplementary Material .06 lets a firm decide, on risk-based principles, how far to review correspondence outside the listed subject matters, on condition of training, documented training, and surveillance and follow-up. Where review does occur, Rule 3110(b)(4) requires a registered principal and written evidence.
Does an Advisor Reviewing an AI Draft Count as Supervision?
It is supervision in whatever shape the firm's written procedures give it, and the rule text does say that merely opening a communication is not sufficient review. Whether it is also a check against a standard depends on whether the firm has written one. For correspondence, that standard is the firm's to write, and what the procedures must say is a question for the firm and its counsel.
What the Firm Has to Supply
The category question settles what FINRA's rules require. The written standard is the firm's to supply. Request early access to LuxeDetect™ to measure AI-drafted client correspondence against your firm's written standard.
For AI-drafted client correspondence, the control has to sit before release, not in surveillance after it.
Melat Tadesse leads content at Luxe Factor Intelligence Corp. (LFIC), where she helps define the standards that protect brand voice in the AI era.
Her work focuses on the failure modes of AI-generated content, how voice gets diluted at scale, and what it takes to turn brand identity into enforceable rules. She brings a sharp editorial lens shaped by years of studying high-standard brands and the systems behind what makes them unmistakable.
