Generative, agentic AI outpaces static model-risk rules in markets; a modular four-layer governance architecture can restore observability and control while allowing innovation, illustrated by a simulated multi-agent spoofing scenario.

Main Finding

Generative and agentic AI deployed in finance behave as complex adaptive systems whose emergent, continually-learning, and interacting dynamics break the assumptions of traditional Model Risk Management (MRM). To manage these risks while preserving innovation, the authors propose a layered, agent-based regulatory architecture composed of modular “regulatory blocks” (self-regulation at the model level, firm-level governance, regulator-hosted sector monitors, and independent audit blocks) plus a set of design strategies to make oversight adaptive, decentralized, and interoperable.

Key Points

• Motivation

  • Generative/agentic AI (large language models, multi-agent trading systems, etc.) are being adopted rapidly in finance and violate standard MRM assumptions (static models, one-time validation, simple observability).
  • The paper frames these AI systems as Complex Adaptive Systems (CAS) and uses Multi-Agent Systems (MAS) design to both analyze risks and propose governance.

• Core risks identified

  • Systemic propagation: interlinked AI models can amplify and propagate risks across firms and markets.
  • Data risks and sensitive-data leakage from fine-tuning.
  • Increased hallucinations, opacity, and limits of explainability.
  • Hidden discrimination, persistent toxicity, and ethics failures.
  • Attack surfaces: prompt injections, backdoors, AI-takeover attacks, deceptive alignment.
  • Agentic-specific harms: reward hacking, specification gaming, collusion and market manipulation (e.g., emergent spoofing).

• Proposed governance architecture (four complementary layers)

• Self-regulation blocks (hosted by firms): tight, low-latency modules sitting beside each model to enforce behavioral, ethical, and performance constraints in near real time.
• Firm-level model governance blocks: aggregate telemetry and enforce policy across models and jurisdictions.
• Regulator-hosted agents: ingest anonymized, cross-firm telemetry to detect sector-wide, collusive, or destabilizing patterns.

• Independent audit blocks: third-party assurance and inspection to sustain trust and guard against correlated failures.

• Design strategies (paper enumerates eight; excerpts detail key strategies)

  • Layered functional specialization to assign clear roles for oversight.
  • Standardization of reusable regulatory components (libraries of blocks for data, AI, and financial rules).
  • Modular design to enable updates, jurisdictional customization, and rapid change management.
  • Adaptive local control to vary autonomy (temporal, block-level, human-in-the-loop) according to risk.
  • Decentralization to avoid single points of failure and mitigate takeover risks.
  • Diversity of components (autonomy levels, vendors, architectures) to increase robustness.
  • The full set includes two additional strategies not fully excerpted here but the emphasis is on mechanisms that let regulatory blocks evolve as fast as the models.

• Illustrative evaluation

  • A case study (emergent spoofing in multi-agent trading) shows how layered controls can quarantine harmful behaviors in real time while preserving innovation; the architecture is designed to remain compatible with existing MRM rules (e.g., SR 11-7) while closing observability/control gaps.

Data & Methods

• Nature of the work
  • Conceptual / theoretical systems design paper rather than an empirical study. It synthesizes literature across AI, CAS, MAS, and financial regulation.
• Methods and artifacts used
  • Analytic framing: maps properties of generative and agentic AI to CAS theory to identify governance failures of traditional MRM.
  • MAS-inspired design: proposes modular agentic regulatory blocks with specified functional roles and interaction patterns.
  • Design strategies: derives practical engineering and governance principles (standardization, modularity, decentralization, adaptive autonomy, etc.).
  • Illustration: applies the framework to a case study of emergent spoofing in multi-agent trading (demonstrative quarantine/control mechanisms; details and empirical validation appear limited in the provided excerpt).
• Limitations
  • No large-scale empirical validation or quantitative calibration of systemic risk reductions is presented in the excerpt. The proposal is intended as an implementable architecture but requires prototyping, simulation, and regulatory-firm pilots to test effectiveness and operational costs.

Implications for AI Economics

• Systemic risk and externalities
  • Agentic and interacting AI agents create new channels for externalities and correlated failures across firms and markets (faster contagion than traditional models). Governance must internalize these externalities via cross-firm telemetry, sector monitoring, and shared protocols.
• Market structure and competition
  • Compliance and infrastructure costs for modular regulatory blocks could raise entry barriers and favor incumbents or large vendors (risk of consolidation around a small set of foundation models and governance providers). Conversely, standardized block libraries and interoperable interfaces could lower barriers if made widely available.
• Incentives and moral hazard
  • Firms may under-invest in safety absent credible external monitoring/audit. Regulator-hosted and independent audit blocks create monitoring capacity that can mitigate moral hazard but require careful incentive alignment (penalties, certification value, liability regimes).
• Innovation vs. stability trade-offs (Innovation Trilemma)
  • The proposed layered, modular approach aims to relax the Innovation Trilemma by allowing local innovation while giving regulators systemic oversight. Empirical economic work is needed to quantify welfare trade-offs between tighter controls (reducing tail risks) and slower product rollout or higher costs.
• Information sharing and privacy
  • Effective sector monitoring requires sharing of telemetry/indicators across firms. Designing privacy-preserving aggregation, anonymization, and legal safe harbors is economically important to unlock the public-good aspect of systemic monitoring.
• Policy design and coordination costs
  • Different regulatory regimes (principles-, risk-, rule-, or result-based) complicate cross-border adoption. Standardized regulatory blocks could reduce frictions if internationally coordinated; lack of coordination may encourage regulatory arbitrage.
• Research and policy priorities for economists
  • Quantify systemic amplification: models of how interacting agentic AIs propagate shocks and how layered governance reduces tail probabilities.
  • Cost-benefit analysis: estimate deployment, compliance, and monitoring costs vs. avoided losses from manipulation/contagion.
  • Market-design interventions: evaluate how block standardization, certification, and subsidized audits affect competition, innovation diffusion, and welfare.
  • Incentive mechanisms: design liability, certification, and reward structures to encourage adoption of self-regulation blocks and telemetry sharing.
  • Simulation and stress-testing: build MAS-based market simulators to test governance designs under adversarial and emergent behaviour.

Suggested next steps (research & policy) - Prototype and pilot implementations (firm-regulator-auditor trilateral pilots) to collect empirical performance and cost data. - Develop standards for telemetry, anonymization, and block interfaces to enable cross-firm sector monitoring without undue privacy or proprietary leakage. - Economic modeling of adoption dynamics, entry barriers, and welfare impacts under alternative governance subsidy/mandate regimes.

Summary takeaway: The paper reframes AI-in-finance risks as CAS problems and proposes a modular, multi-agent regulatory architecture intended to be adaptive and compatible with existing rules; economists should prioritize modeling systemic propagation, incentive alignment, and the market-structure consequences of governance adoption.