Compliance, explainability, and model governance

Suitability means a recommendation must fit the specific client (risk tolerance, time horizon, financial situation). For broker-dealers, Regulation Best Interest (Reg BI) raises the bar: recommendations must be in the client's best interest, not just "suitable."

The AI trap: a model that optimizes for a house metric (fee revenue, fund flows) rather than client outcomes. If your allocation engine systematically steers clients toward higher-fee proprietary funds, you need a documented reason tied to client benefit, not firm economics.

3. Model Risk Management: SR 11-7

SR 11-7 is Federal Reserve and OCC guidance on model risk management, issued in 2011. Though written for banks, it has become the de facto standard across finance, and asset managers are increasingly held to it. Its core idea: a model is a simplification of reality, so it carries risk, and that risk must be managed across the model's whole life.

SR 11-7 rests on three pillars:

• Development and implementation: sound design, documented assumptions, quality data.
• Validation: independent review by people who did not build the model.
• Governance: policies, roles, and oversight from the top down.

Read the primary source; it is short and readable: SR 11-7 guidance.

Building the model file

Here is what regulators (and, increasingly, sophisticated institutional clients doing due diligence) expect to see.

A model inventory

Every model gets an entry in a central register. At minimum:

• What it does (portfolio allocation, trade signal, client risk scoring).
• Owner and developer.
• Inputs and data sources.
• Last validation date and next scheduled review.
• Materiality tier (a model that sizes trades matters more than one that formats reports).

If you cannot list your models, you cannot govern them. Many firms discover during an exam that shadow models built in spreadsheets never made the inventory.

Documented assumptions and limitations

Write down what the model assumes and where it breaks. Example: "This mean-variance optimizer assumes returns are normally distributed. It underestimates tail risk during liquidity crises." That single sentence shows an examiner you understand the model's blind spots.

Independent validation

The person who validates must not be the person who built it. Validation covers:

• Conceptual soundness: does the method fit the problem?
• Outcomes analysis: does it perform on out-of-sample data (data the model never trained on)?
• Benchmarking: how does it compare to a simpler alternative?

Explainability: the heart of the AI problem

Traditional models were transparent. A linear model tells you each factor's weight. Modern machine learning models (gradient boosting, neural networks) are black boxes: accurate but hard to interpret.

Regulators do not ban black boxes. They demand that you can explain any individual decision. If a client asks "why did the model cut my equity allocation?", "the algorithm decided" is not an acceptable answer.

Global vs local explainability

• Global explainability: which factors matter most across all decisions.
• Local explainability: why one specific client got one specific recommendation.

Suitability lives in the local view. You need to explain the decision for *this* client, on *this* date.

SHAP: a practical tool

SHAP (SHapley Additive exPlanations) breaks a single prediction into contributions from each input feature, grounded in cooperative game theory. It turns "the model said 40 percent bonds" into "age contributed +8 percent to bonds, stated risk tolerance contributed +15 percent, and short time horizon contributed +12 percent."

The output is auditable. Log it with the recommendation. Now when the examiner asks about client 4471, you retrieve the exact feature contributions that drove the advice. That log is your suitability evidence.

The audit trail

An audit trail is a time-stamped, tamper-evident record of what happened and why. For an AI advice engine, capture:

• Model version used for the decision (v3.2, not "the model").
• Input snapshot: the exact client data and market data fed in.
• Output: the recommendation.
• Explanation: the SHAP or equivalent breakdown.
• Human action: did an adviser review, override, or accept it?

The version point is critical. If you retrain monthly, you may have twelve different models in a year. When a client disputes advice from March, you must reproduce March's model, not December's. Store versioned model artifacts, not just the latest one.

Human in the loop

Regulators view fully automated advice with more caution than AI-assisted advice. Documenting where a human adviser reviews and can override the model both reduces risk and strengthens your Reg BIBITechnologies and processes that turn raw data into actionable insights via reporting, dashboards and analysis, so teams can decide based on facts rather than intuition.View full definition → position. Log the overrides too: they reveal where the model and human judgment diverge.

Bias and fair treatment

Suitability has a fairness dimension. If your client-risk-scoring model was trained on historical data that underserved certain groups, it may systematically recommend worse products to them. This is both a compliance risk and a reputational one.

Test for it. Compare recommendations across client segmentssegmentsDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition → holding financial profile constant. If two clients with identical finances and goals get materially different advice, you need to know why. Document the test, even if the result is clean. "We tested and found no disparity" is a strong line in an exam.

Putting the file together before you need it

The theme across all three regulatory lenses is the same: document before you are asked, not after. A reconstructed explanation looks defensive. A contemporaneous log looks like control.

A minimum viable governance package for one deployed model:

1. Inventory entry with materiality tier.

2. Development documentation: purpose, data, assumptions, limitations.

3. Independent validation report.

4. Per-decision explainability logs (SHAP or equivalent).

5. Versioned audit trail linking inputs, outputs, model version, and human review.

6. Bias and fair-treatment test results.

7. Substantiation for every marketing claim about the model.

This is not investment or legal advice; consult your compliance and legal teams on how these frameworks apply to your specific firm and jurisdiction.

Key Takeaways

• One AI model can face the SEC Marketing Rule, suitability/Reg BIBITechnologies and processes that turn raw data into actionable insights via reporting, dashboards and analysis, so teams can decide based on facts rather than intuition.View full definition →, and SR 11-7 simultaneously; build documentation that satisfies all three at once.
• Regulators do not ban black-box models, but they require you to explain any single decision; local explainability tools like SHAP turn opaque outputs into auditable, per-client evidence.
• Keep a versioned audit trail: model version, input snapshot, output, explanation, and any human override, so you can reproduce the exact advice given on any past date.
• Never let marketing outrun the model; every "AI-powered" or "outperforms" claim must be substantiated with records.
• The winning posture is contemporaneous documentation. A file you built before the exam letter arrives signals control; one reconstructed afterward signals risk.