FINRA Model Offers Blueprint for AI Governance, Penn Law's Hammer Says

宾大法学院Hammer：FINRA模式为AI治理提供蓝图 金融机构必须部署自主监控智能体以实时监督业务运行AI，因为单靠模型评估无法防范概率性合规违规与系统性市场风险。 Sarah Hammer 概述了在受到严格监管的金融服务行业中治理自主代理型 AI 的综合框架。她借鉴了 FINRA 的多层自律监管模式，探讨了部署概率性智能体进行交易和客户互动所带来的法律、受托责任及系统性风险。为应对这些隐患，Hammer 倡导构建一种“信任架构”，由专门的二线监控智能体对运行智能体进行实时监督，从而弥补人工合规团队在带宽上的不足。 DeepMind 首席执行官 Demis Hassabis 提议将 FINRA 视为 AI 安全自律的行业蓝图；Sarah Hammer 指出金融业凭借企业治理、专业执照、行业自律与政府监管四大支柱，为 Agentic AI 提供了超越单纯模型评测的“信任架构”。 (3:26) 由于概率性输出与模型幻觉风险，机构此前多将生成式 AI 限制于后台工作流；直接面向客户的 Agent 顾问若违规提供投资建议，将带来巨大的信托责任（Fiduciary Duty）与法律合规隐患。 (7:16) 自主支付与转账 Agent 面临错误或超额操作时的法律责任认定难题，同时全天候 24/7 交易 Agent 若对突发市场冲击产生高度同质化的自动响应，可能引发系统性市场闪崩。 (11:34) 面对人工合规团队无法实时审核海量交互的瓶颈，Hammer 建议部署“第二道防线”监控 Agent，对第一线业务 Agent 的输出进行实时监测与合规审查。 (15:27)

Sarah Hammer argues that conventional model evaluations are inadequate for governing autonomous agentic AI in regulated finance, proposing instead that institutions adapt multi-layered financial oversight structures and deploy specialized second-line monitoring agents to supervise operational models in real time. FINRA as a Multi-Layered Governance Blueprint (3:26) Referencing Google DeepMind CEO Demis Hassabis's suggestion that the Financial Industry Regulatory Authority (FINRA) could serve as a model for AI safety, Hammer notes that financial services offers a mature, four-tiered governance architecture. This established framework combines internal second-line enterprise risk management, professional human credentialing, industry self-regulatory standard-setting, and statutory government regulation. Hammer contends that static pre-deployment model evaluations ('evals') cannot substitute for institutional governance. While evals assess consistency, safety, and capabilities across prompts, they fail to provide the real-time operational monitoring required in highly regulated enterprise environments. Fiduciary Compliance and Probabilistic Model Behavior (7:16) Deploying customer-facing autonomous agents to millions of retail investors creates direct legal and regulatory exposure under financial rules. Under FINRA standards, offering personalized investment recommendations mandates specific professional licenses and adherence to fiduciary duties, raising unresolved questions about whether an autonomous software agent can legally or practically hold fiduciary liability. This challenge is intensified by the probabilistic nature of generative models. Unlike deterministic software, probabilistic agents can generate unauthorized or non-compliant investment advice despite explicit system instructions, creating regulatory violations that traditional testing cannot consistently prevent. Operational Execution Liabilities and Systemic Trading Risks (11:34) Granting agents execution authority over financial transactions introduces distinct legal ambiguities. Hammer illustrates this with a scenario in which an agent attempts an unauthorized $1,000,000 offshore transfer from an account holding only $100,000, leaving legal responsibility uncertain among the user, the platform provider, and the counterparty under standard click-wrap agreements. Beyond individual transfer liability, widespread adoption of 24/7 automated hedging poses macro-level financial stability concerns. Hammer warns that if millions of autonomous retail agents encounter an overnight market shock and react with identical algorithmic strategies, automated cascading trades could trigger systemic market flash crashes. autonomous execution is already entering production, evidenced by Coinbase launching an SEC-approved 24/7 trading agent in cryptocurrency markets. Real-Time Oversight Through Second-Line Monitoring Agents (15:27) To address operational risks without exceeding the bandwidth of human compliance teams, Hammer proposes an 'agent-on-agent' oversight architecture. Because human personnel cannot evaluate millions of concurrent automated interactions, institutions can deploy specialized second-line risk monitoring agents. These secondary agents are tasked with analyzing the live outputs of first-line operational agents in real time. By continuously assessing whether customer-facing models cross regulatory thresholds—such as dispensing unlicensed investment advice—monitoring agents provide an operational mechanism to enforce compliance and build institutional trust at scale. While Hammer outlines a structural pathway to govern agentic AI using financial self-regulatory principles and monitoring agents, fundamental legal questions remain unresolved regarding how statutory liability and fiduciary accountability attach to autonomous software when execution errors or automated market spirals occur.

Sarah Hammer 指出，针对自主智能体（Agentic AI）带来的合规与操作风险，单纯依靠静态模型评估无法建立有效保障；行业应借鉴金融业的多层次治理与自律监管经验，通过部署二道防线“监控智能体”实现实时动态治理。 金融自律模型与四支柱信任架构 (3:26) 在探讨人工智能安全风险时，Google DeepMind 首席执行官 Demis Hassabis 曾主张行业建立自我治理与标准体系，并将美国金融业监管局（FINRA）作为潜在蓝本。Hammer 分析指出，FINRA 作为在证券交易委员会（SEC）法定授权下运行的自律组织（SRO），为高风险环境下的技术治理提供了成熟样本。传统的前置模型评估（evals）虽然能测量模型性能、容量及跨提示词表现，但无法取代动态的制度性监督。 Hammer 梳理了成熟监管体系支撑信任的四大支柱：首先是企业内部治理，依托二道防线风险管理、合规与法律审查来确保业务符合机构风险偏好；其次是专业执业资质认证，如医疗执照、法律执业资格以及提供证券咨询所需的 FINRA 系列牌照；再次是具备行业弹性和执行力的自律组织标准；最后是政府层面的法定法律与监管执行体系。 客户端部署壁垒与受信合规困境 (7:16) 早期因市场对 AI 颠覆软件及金融业的担忧引发股票波动，金融机构对生成式技术的落地策略采取审慎态度。由于基础模型存在幻觉和不可预测性，企业此前普遍将其严格限定在软件编写、运营重塑和后台合规监控等内部环节。Hammer 以自身经历为例说明，ChatGPT 曾坚决给出一个并不存在的马德里巴拉哈斯机场（Madrid-Barajas Airport）航站楼信息，直接导致其延误转机。 当金融机构试图将智能体顾问直接推向数以千万计的零售客户时，法律合规风险被成倍放大。根据 FINRA 的监管规则，提供个性化投资建议不仅要求从业者具备特定牌照，还须履行严格的受信义务（Fiduciary Duty）；自主软件智能体是否具备法律与操作层面的受信资质，仍是核心法律争议。此外，AI 本质上是概率模型而非确定性代码，即使提示词明确禁止，模型仍可能违背指令输出越权的投资建议，这一隐患无法仅凭前期模型评估予以排除。 自主执行法律权责与系统性市场风险 (11:34) 在智能体涉及实际资金划转与自主交易的操作场景中，权责归属存在显著法律真空。Hammer 举例说明，若用户在投资账户中授权了支付智能体，而该智能体在账户仅有 10 万美元资产的情况下试图向塞舌尔（Seychelles）离岸账户转账 100 万美元，交易对手方所追索的 90 万美元差额应当由签署网络点击协议（click-wrap agreement）的用户、金融机构还是智能体本身承担，甚至该行为是否构成一项具有法律约束力的决定，目前均无定论。 在宏观市场层面，投资者日益倾向于部署 7×24 小时全天候智能体在非交易时段进行风险对冲，这带来了新的系统性隐患。Hammer 警告，若单家经纪商内部数百万个客户端智能体在夜间遭遇同一市场冲击并产生一致的算法反应，高度同质化的自动化抛售可能引发级联式市场闪崩。与此相对，完全自主执行正逐步融入真实金融基础设施，例如 Coinbase 已推出获得 SEC 批准的智能体财务顾问，能够在加密货币市场实现全天候交易执行。 实时二道防线监控智能体的治理路径 (15:27) 针对自主智能体引发的操作与系统性风险，Hammer 提出利用专门的二道防线“监控智能体”构建治理闭环。面对海量并发的自动化任务，人工合规与风控团队在处理带宽上存在天然生理极限，根本无法实时核验数百万个并发交互。 这种“以智能体治理智能体（Agent-on-Agent Governance）”的方法，通过构建独立的合规监控模型，对一线业务智能体的实时输出展开分析与语义解析。例如，监控智能体可以在客户对话进行的同时，实时识别面向散户的顾问智能体是否越界输出了无执照的投资建议。这种机制将治理重心从部署前的静态测试转移到运行过程中的即时拦截，弥补了高并发场景下的人工监管缺口。 Hammer 强调，随着自主交易与咨询智能体步入公共金融基础设施，单纯的技术性能验证已无法支撑合规要求。然而，二道防线监控智能体自身的判定可靠性、面对极端市场行情时避免群体性共振的技术手段，以及自动化决策背后法律责任归属的立法界定，依然是行业尚未解决的核心议题。

## Background 该内容由 Ai4 于 2026 年 8 月 15 日在 YouTube 平台发布，主讲人为人工智能董事总经理 Sarah Hammer。视频简介指出，AI 的下一波浪潮正从聊天机器人转向能够跨企业执行任务的自主智能体，本场会议探讨了智能体驱动的金融机构形态，以及管理层为迎接这一变革所需做出的战略与治理决策。 ## TL;DR 演讲围绕如何借助金融行业成熟的内控与自律监管经验（如 FINRA 框架）构建 Agentic AI 的“信任架构”展开。Sarah Hammer 强调，静态的模型评测无法替代动态风控基础设施，当智能体具备自主行动权后，将带来擅自提供投资建议侵犯受信义务、引发未经授权的支付透支追索争议，以及在 24/7 全天候交易中导致流动性踩踏等严重系统性风险。面对人类无法实时审查海量高频决策的现实瓶颈，她提出以技术治理技术的破局路径——部署“第二道防线监控智能体”来实时拦截和审计一线业务智能体的违规行为。 ## Atmosphere & style 演讲整体呈现出一种沉稳严谨、切中要害的专业法务与风控智库风格。主讲人通过自身因轻信 ChatGPT 幻觉而在马德里机场错过航班的生动自嘲，迅速化解了宏观监管话题的枯燥感，随后层层递进到对百亿美元级资金透支与深夜全天候挤兑危机的严正剖析。整场分享节奏清晰而笃定，让听众在感受到智能体自主执行所带来的巨大行业震撼之余，也能深刻体会到金融合规边界不可逾越的审慎与紧迫感。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=0k80rttyFuY&t=4s) 建立对 AI 的信任不能仅依赖单点技术评估，而需将宏观政策、行业自律标准与企业内控结合，构建系统性的“信任架构”。 - [02:43](https://www.youtube.com/watch?v=0k80rttyFuY&t=163s) 金融业成熟的信任体系由四大支柱构成：企业内部风控合规、从业人员资质许可、行业自律标准（SRO 如 FINRA）以及国家法定监管。 - [02:43](https://www.youtube.com/watch?v=0k80rttyFuY&t=163s) 静态的模型评测（Model Evaluations）仅能衡量能力上限与安全边界，无法替代动态生产环境下的实时监控与合规基础设施。 - [07:16](https://www.youtube.com/watch?v=0k80rttyFuY&t=436s) 金融机构此前对面向客户的 AI 极度保守，核心在于概率模型（Probabilistic Model）的不可预测性与幻觉难以满足金融确定性要求。 - [07:16](https://www.youtube.com/watch?v=0k80rttyFuY&t=436s) 智能体若擅自输出投资建议将直接触碰法定资质与“受信义务”（Fiduciary Duty）底线，对现行金融监管法规构成严峻挑战。 - [11:34](https://www.youtube.com/watch?v=0k80rttyFuY&t=694s) 在支付与转账场景中，智能体自主透支或向离岸账户划款引发了法律层面决策主体认定与债务责任归属（Liability）的真空困境。 - [11:34](https://www.youtube.com/watch?v=0k80rttyFuY&t=694s) 全天候 24/7 自主交易中，大量同质化策略的交易智能体在突发事件下同向抛售，极易引发流动性枯竭与市场螺旋暴跌等系统性风险。 - [15:07](https://www.youtube.com/watch?v=0k80rttyFuY&t=907s) 针对海量高频的智能体决策，行业破局路径在于“以 AI 治理 AI”，通过部署“第二道防线监控智能体”实现全流程实时合规审计与拦截。 - [15:07](https://www.youtube.com/watch?v=0k80rttyFuY&t=907s) Coinbase 获得监管许可上线全天候 Agentic 顾问，标志着受监管的智能体在 24/7 加密资产托管与交易场景中迈出落地关键一步。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=0k80rttyFuY&t=4s) 个人背景与 AI 信任架构的核心议题 在本次演讲开场时，演讲者 Sarah Hammer 表示希望打破传统单向宣讲的形式，保持内容开放，并在结尾预留问答或线下交流的时间。她指出，本次分享与峰会其他技术侧议题截然不同，将聚焦于所有人最为关切的核心问题：治理体系、自律组织（SRO）、行业标准、白宫发布的政策框架以及全球监管环境，并探讨如何将这些宏观机制落实到企业内部的 AI 风险监测中，进而借助 Agentic AI（智能体 AI）自身来构建一个稳固的“信任架构（Architecture of Trust）”。 为了阐明自身视角，Sarah Hammer 详细介绍了其深耕金融与监管领域的复合背景：拥有 25 年金融行业经验，曾担任投资专业人士、交易员、投资组合经理及持牌律师，并曾在多家机构出任全球 AI 合规风险管理主管；现任宾夕法尼亚大学法学院（UPenn Law School）兼职教授，此前曾担任沃顿商学院（Wharton School）执行总监并领导其 AI 倡议与区块链加速器；此外，她还担任布雷顿森林委员会（Bretton Woods Committee）AI 工作组联合主席、国际 AI 专家财团（International Expert Consortium on AI）联合主席，以及美国法律研究所（ALI）AI 民事责任咨询小组成员。她强调，建立对 AI 的信任不能仅停留在口头讨论，必须依托系统性的监管与风险框架。 - 演讲核心主旨：将宏观监管标准、白宫框架与企业内部 AI 风险监控相连接，利用智能体构建信任架构。 - 演讲者具备 25 年跨投资交易、法律、合规风控及学术研究（沃顿商学院、宾大法学院、ALI、布雷顿森林委员会）的多重行业背景。 ### [02:43](https://www.youtube.com/watch?v=0k80rttyFuY&t=163s) 从金融业经验看信任架构的四大支柱与局限性 近来多起模型逃逸测试环境、缺乏有效监控等事件频发，使得“信任”成为核心矛盾。DeepMind 联合创始人 Demis Hassabis 此前公开发言呼吁建立行业标准与自律治理以应对生成式及 Agentic AI 的安全风险，并特别将美国金融业监管局（FINRA）作为应对方案的范本。金融行业之所以能成为 AI 治理的参照物，是因为该行业历经数十年构建了一套高度成熟的信任体系，其核心由四大支柱构成： 1. **企业内控与自主治理**：包含风险管理、合规、法律职能，以及企业基于自身风险偏好和价值观制定的内部准则； 2. **从业人员资格认证**：如同医疗行业的医师执照、法律行业的律师执照，金融业从业者与客户谈论证券前必须考取 FINRA 颁发的证券从业执照； 3. **行业自律标准（SRO）**：以 FINRA 为代表，所有券商经纪自律组织成员共同制定规则，同时与美国证券交易委员会（SEC）等政府机构紧密协同； 4. **政府法定监管**：由国家层面的法律法规和监管机构提供刚性约束。 许多人认为仅凭“模型评测（Model Evaluations）”就能解决安全问题，但评测只能展示模型的性能上限、安全边界或跨 Prompt 的输出一致性，绝无法替代持续的实时监控与风险合规基础设施。 ```mermaid flowchart TD accTitle: 四层金融信任架构向 AI 治理的映射 subgraph SRO_Gov["外部合规与法治框架"] A["法定行政监管机构 (SEC / 法律法规)"] B["行业自律组织 (SRO 如 FINRA) 与通用标准"] end subgraph Enterprise["企业内部风控与专业准入"] C["持牌专业资质与准入审查 (Licensing & Certifications)"] D["企业级内控架构 (风险管理、合规审查与法律准则)"] end subgraph RealTime["AI 运行与监测层"] E["静态模型评测 (Model Evaluations: 仅验证能力基线)"] F["动态实时监控 (智能体对齐、干预与持续审计)"] end A --- B B --> D C --> D D --> F E -.->|无法替代| F ``` - 信任基础设施的建设需要数十年沉淀，绝非单一测试评估或技术基准所能涵盖。 - 模型评测仅能反映静态测试结果，无法充当动态运营环境下的风险合规替代品。 ### [07:16](https://www.youtube.com/watch?v=0k80rttyFuY&t=436s) 金融智能体的前沿落地、幻觉与“受信义务”困境 回顾金融机构对 AI 的态度演变，年初软件与金融股曾因 AI 颠覆担忧而剧烈波动。此前，大部分金融机构坚持认为生成式与 Agentic AI 过于不可控，仅敢在内部用于重塑运营流程、辅助编写代码或优化风控合规，绝不敢直接面向客户开放。其核心顾虑在于概率模型的不可预测性与幻觉（Hallucination）。Sarah Hammer 以自身经历举例：她曾因轻信 ChatGPT 给出的错误信息，在马德里机场寻找一个根本不存在的航站楼，最终导致错过转机航班。 当场景切换到管理着 5000 万客户的超大型资产管理机构时，风险被成倍放大。若该机构为每位客户配备一个 Agentic Advisor（智能体投资顾问），即便机构明确规定严禁智能体给出直接的投资建议（因为按 FINRA 要求，提供投资建议必须持有执照并履行对客户的“受信义务”/ Fiduciary Duty），但基于概率运行的大语言模型仍有可能擅自输出违规建议。这带来了严峻的法律与伦理拷问：智能体是否能承担人类专属的法定受信义务？在流程中加入“人机协同（Human-in-the-loop）”能否真正满足监管要求？这些问题至今仍处于监管模糊地带。 - 金融机构此前对客户端 AI 持极度保守态度，主因是概率模型（Probabilistic Model）与确定性系统（Deterministic System）之间存在本质差异。 - 法律界限：投资建议在金融法规中具有严格的准入门槛，必须绑定法定资质与受信义务，模型一旦违规越界将直接引发严重合规风险。 ### [11:34](https://www.youtube.com/watch?v=0k80rttyFuY&t=694s) 责任认定与系统性风险：支付穿透与全天候交易外推 当智能体获得更高的自主行动权限时，责任认定（Liability）和系统性风险便成为悬在行业头顶的达摩克利斯之剑。在支付场景中，假设用户在开户时签署了电子点击协议（Clickwrap），授权支付智能体代为执行转账。若该智能体擅自将资金转移至开曼群岛或塞舌尔的离岸账户，甚至在账户只有 10 万美元资产的情况下，擅自向对手方透支转账 100 万美元，这笔债务该由谁承担？用户是否算作做出了决策？提供智能体的机构能否凭借免责条款独善其身？“做出决策的究竟是谁？智能体本身具备法律意义上的决策能力吗？” 在自主交易领域，系统性风险更为严峻。活跃交易者通常希望智能体能够 24/7 全天候监控市场，在半夜突发金融危机时自动进行对冲或抛售以保护资产组合。然而，若一家大型券商的上百万名客户都运行着相似逻辑的交易智能体，一旦深夜出现宏观突发事件，数百万个智能体在极短时间内同向抛售，将直接引发流动性枯竭与市场螺旋式暴跌（Market Spiral）。这正是 FINRA 等监管机构目前正在严防死守的宏观隐患。 - 支付透支案例：账户仅有 10 万美元，智能体执行 100 万美元转账指令，导致 90 万美元敞口追索权与决策主体认定陷入法律真空。 - 交易挤兑案例：深夜全天候交易中数百万个智能体同质化对冲，极易引发程序化踩踏和系统性市场崩溃。 ### [15:07](https://www.youtube.com/watch?v=0k80rttyFuY&t=907s) 以“第二道防线监控智能体”重塑信任架构 针对上述复杂的信任与安全困境，传统的单次静态评测已无法奏效。评测只能检测模型在测试集上是否遵守投资建议禁令，却无法阻止它在动态生产环境中越轨。Sarah Hammer 提出的破局路径是：**以 Agentic AI 的创新来治理 Agentic AI，即部署“第二道防线监控智能体（Second-line Monitoring Agents）”**。 ```mermaid flowchart LR accTitle: 一线业务与二线监控双智能体架构 subgraph ClientLayer["客户端交互"] User["客户 / 投资者"] end subgraph Line1["一线业务智能体 (First-line Agent)"] A1["业务/交易/顾问智能体"] end subgraph Line2["二线合规监控 (Second-line Agent)"] M1["监控与解释智能体"] Rule["合规与法律规则库 (FINRA / SEC 规范)"] end subgraph Execution["底层执行与风控"] Exec["交易与支付清算网关"] Block["阻断 / 降级 / 告警处理"] end User <-->|"提示词交互"| A1 A1 -->|"拟执行指令/回复"| M1 Rule --> M1 M1 -->|"合规验证通过"| Exec M1 -->|"越权 / 违规投资建议"| Block ``` 人类专家根本没有足够的带宽与算力实时解析和监管海量一线业务智能体的高频输出，而二线监控智能体则能够专门盯防一线顾问、支付或交易智能体，实时拦截违规投资建议、异常离岸转账与高危交易动作。 演讲尾声，Sarah 提到了行业最新进展：Coinbase 已推出获得 SEC 相关许可的全天候 Agentic 财务顾问，由于加密资产天然具备 24/7 交易属性，用户无需等待传统交易所开市即可实现全时段自动化托管。在主持人的时间提醒下，Sarah 感谢了峰会主办方（Britney 与 Michael Weiss 等），并鼓励参会者在会后继续就如何运用智能体创新构建信任架构展开深入探讨。 - 二道防线监控智能体（Second-line Monitoring Agents）成为应对高频海量自主决策输出的必要基础设施。 - 行业标志性进展：Coinbase 获得 SEC 批准上线可执行 24/7 自动化操作的加密智能体顾问。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=0k80rttyFuY&t=4s) 聚焦于所有人最为关切的核心问题：治理体系、自律组织（SRO）、行业标准、白宫发布的政策框架以及全球监管环境，并探讨如何将这些宏观机制落实到企业内部的 AI 风险监测中，进而借助 Agentic AI（智能体 AI）自身来构建一个稳固的“信任架构（Architecture of Trust）”。 — Sarah Hammer > [00:04](https://www.youtube.com/watch?v=0k80rttyFuY&t=4s) 建立对 AI 的信任不能仅停留在口头讨论，必须依托系统性的监管与风险框架。 — Sarah Hammer > [02:43](https://www.youtube.com/watch?v=0k80rttyFuY&t=163s) 许多人认为仅凭“模型评测（Model Evaluations）”就能解决安全问题，但评测只能展示模型的性能上限、安全边界或跨 Prompt 的输出一致性，绝无法替代持续的实时监控与风险合规基础设施。 — Sarah Hammer > [07:16](https://www.youtube.com/watch?v=0k80rttyFuY&t=436s) 大部分金融机构坚持认为生成式与 Agentic AI 过于不可控，仅敢在内部用于重塑运营流程、辅助编写代码或优化风控合规，绝不敢直接面向客户开放。其核心顾虑在于概率模型的不可预测性与幻觉（Hallucination）。 — Sarah Hammer > [07:16](https://www.youtube.com/watch?v=0k80rttyFuY&t=436s) 即便机构明确规定严禁智能体给出直接的投资建议（因为按 FINRA 要求，提供投资建议必须持有执照并履行对客户的“受信义务”/ Fiduciary Duty），但基于概率运行的大语言模型仍有可能擅自输出违规建议。 — Sarah Hammer > [07:16](https://www.youtube.com/watch?v=0k80rttyFuY&t=436s) 智能体是否能承担人类专属的法定受信义务？在流程中加入“人机协同（Human-in-the-loop）”能否真正满足监管要求？ — Sarah Hammer > [11:34](https://www.youtube.com/watch?v=0k80rttyFuY&t=694s) 做出决策的究竟是谁？智能体本身具备法律意义上的决策能力吗？ — Sarah Hammer > [11:34](https://www.youtube.com/watch?v=0k80rttyFuY&t=694s) 若一家大型券商的上百万名客户都运行着相似逻辑的交易智能体，一旦深夜出现宏观突发事件，数百万个智能体在极短时间内同向抛售，将直接引发流动性枯竭与市场螺旋式暴跌（Market Spiral）。 — Sarah Hammer > [15:07](https://www.youtube.com/watch?v=0k80rttyFuY&t=907s) 以 Agentic AI 的创新来治理 Agentic AI，即部署“第二道防线监控智能体（Second-line Monitoring Agents）”。 — Sarah Hammer > [15:07](https://www.youtube.com/watch?v=0k80rttyFuY&t=907s) 人类专家根本没有足够的带宽与算力实时解析和监管海量一线业务智能体的高频输出，而二线监控智能体则能够专门盯防一线顾问、支付或交易智能体，实时拦截违规投资建议、异常离岸转账与高危交易动作。 — Sarah Hammer ## Mentioned Sarah Hammer, Demis Hassabis, Britney Weiss, Michael Weiss, Ai4, DeepMind, FINRA, SEC, 宾夕法尼亚大学法学院 (UPenn Law School), 沃顿商学院 (Wharton School), 布雷顿森林委员会 (Bretton Woods Committee), 国际 AI 专家财团 (International Expert Consortium on AI), 美国法律研究所 (ALI), 白宫 (The White House), ChatGPT, Coinbase ## Video description Sarah Hammer - Managing Director, AI The next wave of AI is not about chatbots—it is about autonomous agents that can analyze information, make recommendations, coordinate workflows, and execute work across the enterprise. Financial institutions are beginning to move beyond productivity tools toward agentic operating models that have the potential to transform investment management, operations, risk management, and client service. This session examines what the agentic financial institution may look like and the strategic and governance decisions leaders face today to prepare for that future. [Source](https://www.youtube.com/watch?v=0k80rttyFuY)

[0:04] Sarah Hammer: 聚焦于所有人最为关切的核心问题：治理体系、自律组织（SRO）、行业标准、白宫发布的政策框架以及全球监管环境，并探讨如何将这些宏观机制落实到企业内部的 AI 风险监测中，进而借助 Agentic AI（智能体 AI）自身来构建一个稳固的“信任架构（Architecture of Trust）”。 [0:04] Sarah Hammer: 建立对 AI 的信任不能仅停留在口头讨论，必须依托系统性的监管与风险框架。 [2:43] Sarah Hammer: 许多人认为仅凭“模型评测（Model Evaluations）”就能解决安全问题，但评测只能展示模型的性能上限、安全边界或跨 Prompt 的输出一致性，绝无法替代持续的实时监控与风险合规基础设施。 [7:16] Sarah Hammer: 大部分金融机构坚持认为生成式与 Agentic AI 过于不可控，仅敢在内部用于重塑运营流程、辅助编写代码或优化风控合规，绝不敢直接面向客户开放。其核心顾虑在于概率模型的不可预测性与幻觉（Hallucination）。 [7:16] Sarah Hammer: 即便机构明确规定严禁智能体给出直接的投资建议（因为按 FINRA 要求，提供投资建议必须持有执照并履行对客户的“受信义务”/ Fiduciary Duty），但基于概率运行的大语言模型仍有可能擅自输出违规建议。 [7:16] Sarah Hammer: 智能体是否能承担人类专属的法定受信义务？在流程中加入“人机协同（Human-in-the-loop）”能否真正满足监管要求？ [11:34] Sarah Hammer: 做出决策的究竟是谁？智能体本身具备法律意义上的决策能力吗？ [11:34] Sarah Hammer: 若一家大型券商的上百万名客户都运行着相似逻辑的交易智能体，一旦深夜出现宏观突发事件，数百万个智能体在极短时间内同向抛售，将直接引发流动性枯竭与市场螺旋式暴跌（Market Spiral）。 [15:07] Sarah Hammer: 以 Agentic AI 的创新来治理 Agentic AI，即部署“第二道防线监控智能体（Second-line Monitoring Agents）”。 [15:07] Sarah Hammer: 人类专家根本没有足够的带宽与算力实时解析和监管海量一线业务智能体的高频输出，而二线监控智能体则能够专门盯防一线顾问、支付或交易智能体，实时拦截违规投资建议、异常离岸转账与高危交易动作。

[0:04] Sarah Hammer: architecture of trust [3:26] Sarah Hammer: FINRA Series licenses for discussing securities [3:26] Sarah Hammer: Internal enterprise governance [3:26] Sarah Hammer: Professional licensing & qualifications [3:26] Sarah Hammer: Industry self-regulation [3:26] Sarah Hammer: Government regulation [7:16] Sarah Hammer: Fiduciary Duty & Licensing [7:16] Sarah Hammer: Deterministic vs. Probabilistic Behavior [11:34] Sarah Hammer: Payment and Transfer Liabilities [11:34] Sarah Hammer: 24/7 Algorithmic Trading & Systemic Risk [11:34] Sarah Hammer: Real-World Agentic Trading Advances [15:27] Sarah Hammer: Real-Time Agent-on-Agent Governance [15:27] Sarah Hammer: Scale and Interpretability

[0:04] Recognizing where we are in the agenda, uh I  wanted to actually leave this a little more open [0:11] and uh I want to leave some time for Q&A if you  all want to do that. Uh or feel free to come up [0:18] after the presentation and we can just talk or I  am me and uh I'll answer your questions oneon-one. [0:24] But what I'm going to talk about today is going  to be very different from some of what the other [0:29] presentations have covered today. Uh I'm going to  talk about what is actually top of mind for all of [0:36] us. Uh you've all seen the news about governance,  self-regulatory organizations, standards, [0:45] uh frameworks coming out of the White House,  and of course there's the global regulatory [0:51] environment. and I'm going to connect that to  actual enterprises where there are obligations to [0:59] risk monitor AI and then I'm going to talk about  how agents can help us build this architecture [1:06] of trust. So before I do that I wanted to give a  little bit of background because there's nothing [1:12] on my slide and very little uh in your AI4  agenda. I'm Sarah Hammer. Uh I have spent 25 [1:20] years in the financial sector uh as an investment  professional, a trader, portfolio manager. [1:28] Uh I'm a licensed attorney. I've been a risk  manager. Uh served as global head of risk [1:34] uh compliance risk management for AI at different  organizations. I'm also an adjunct professor at [1:40] the University of Pennsylvania Law School. I  was executive director at the Wharton School, [1:46] led our AI initiative uh and launched  our AI and blockchain accelerator there. [1:54] I am co-chair of the Bretonwoods Committee working  group on AI. I am co-chair of the international [2:00] expert consortium on AI and I am a member of  the consultative group on civil liability for AI [2:06] at the American Law Institute. So, I don't mean  to run off a whole list of things for all of [2:11] you. Uh, but I wanted you to know who I am. And  what I do with my students sometimes is I say, [2:18] "Ask me anything." So, we may not have time for  that today, but I'm always open to that. Ask me [2:24] anything. And I might not know the answer,  but it brings up a great discussion. Um, [2:31] I guess what I would say even though we don't have  much time is raise your hand if there's a burning [2:35] question and we will talk about it. Uh, because I  want to make sure that all of you leave this room [2:43] with a framework in your mind about how we  build trust around AI. So, as I mentioned, I'm [2:51] a regulatory expert. uh but what I want to talk  about is that word trust because we've all seen [2:59] the incidents recently uh with different models  escaping their testing environments not sufficient [3:06] monitoring for example and how governance and  standard setting can play a role but underneath [3:12] all of it is trust and from my experience in  the financial sector I'm going to talk to you [3:18] about how we build that architecture of trust  and how it has taken us decades to do that. [3:26] So all of you saw the news uh just a little  while ago when Demi Hassabis uh made his [3:35] statement about standards in the industry,  the importance of self-governance and how we [3:41] should come together to address the risks and the  safety issues around agentic and generative AI. [3:50] And I thought it was amazing because not only is  he talking to the heart of the issue of trust, [3:57] but he cited a financial regulatory organization  as a potential solution to those issues. He cited [4:06] FINRA. So FINRA is the self-regulatory  organization for the financial sector [4:12] but it has a regulatory mandate and  all members who have broker dealers [4:19] belong to FINRA and set the rules but it works  very closely with the government and obviously [4:27] it works closely with the securities exchange  commission and the political officials there. [4:33] So why does this matter? I'm telling you  about this and pointing it out because I [4:38] really think the financial sector provides a  model for us to talk about trust in agentic AI. [4:48] We have spent decades building trust in many  important but highly regulated industries in [4:54] the US. Healthcare is one example, insurance is  another example. And in the financial sector, [5:02] we have absolutely spent decades building this  architecture that's comprised of enterprises [5:09] themselves, the risk management, governance,  compliance functions, legal functions, and how [5:16] those firms regulate themselves. Essentially, what  do they feel they need to do? Not only to comply [5:23] with laws, but also to treat their clients the way  they feel they should be treated consistent with [5:30] their own risk tolerance and their own values. We  have professionals uh in the healthcare industry, [5:37] for example, we have medical professionals who've  invested years in obtaining their licenses. [5:43] In finance, we have compliance certifications.  We have licensed attorneys in some roles. [5:48] And to talk to clients about securities, you  need to have a securities license from FINRA. And [5:57] then we have industry standards. And that's where  FINRA comes in as an example of a self-regulatory [6:04] organization that has its advantages and its  disadvantages. And then there's regulation. [6:11] And because this infrastructure of trust has taken  us decades to develop, when we use it as a model [6:19] for the architecture of trust around AI, we have  to recognize that we need to build each of those [6:27] pieces. We can't just rely on model evaluations.  For example, they will tell us about the safety, [6:35] the capacity of a model. They will tell us  if the model is consistent across prompts [6:40] or in different situations. And they  will tell us how the model performed, [6:45] but they cannot substitute for the infrastructure  that's needed to truly trust that model. [6:55] That is why we have risk management,  compliance, and monitoring. [7:00] And what I'm going to propose today is that  not only does Agentic AI provide these very [7:06] significant advantages and risks, but also that  it can help us build that architecture of trust. [7:16] I've given a couple examples here where  finance has already implemented Agentic AI [7:22] and I would be willing to bet that a lot  of you have not used uh Agentic Advisors [7:28] at least before this year. Raise your hand  if you have used an Aentic financial advisor. [7:35] All right, we have some leaders in the room.  Raise your hand if you suddenly noticed that your [7:43] broker dealer, your investment  account is now offering you a chatbot. [7:51] All right, I don't know where you guys are  investing. They need to get in the game. [7:56] Um, but what I would point out to you is that  recall earlier this year when the software stocks [8:03] took a very significant hit because they were  seen as being disintermediated by AI companies, [8:10] financial sector companies took a  hit as well. And prior to that time, [8:16] a lot of financial companies said agentic  AI, even generative AI is too risky for us [8:24] to release. We can use it internally to reimagine  workflows around operations for coding for example [8:32] even to riskmanage or to improve compliance  processes. But we can't possibly put those [8:38] models in front of clients because they are  unpredictable. I'll give you an example. [8:45] We have worked on this uh in a paper that was  recently published by the Bretonwoods committee. [8:52] Models have different tendencies as you all  know and we've learned more about that at this [8:56] conference. They can hallucinate. They might be  wrong. By the way, I once got lost in the Madrid [9:03] airport because chat GBT insisted that I go to a  terminal that didn't exist and I missed my flight [9:12] and it was a connecting flight. Um, so we know  that models can hallucinate. We know they're [9:19] not always accurate. We know that um they won't  always give you the best information. A powerful [9:27] model may give you a good output. A less powerful  model may give you something that's not useful. [9:33] So, we know that. But now imagine that you are an  investment company that has 50 million clients and [9:42] all of your clients have an agentic advisor giving  you information about your portfolio. You have [9:50] decided that you do not want your Aentic advisor  to give the clients investment recommendations [9:58] because to give investment recommendations,  FINRA, the regulatory organization I talked about [10:04] earlier, requires you to have a certain license  and to uphold fiduciary duty to the client. [10:13] Can an agent or a chatbot have fiduciary  duty? Do you? you have fiduciary duty. [10:21] Oh yes, that is a very good point. So [10:25] this is one of the key questions, right? Can an  agent do something that we require humans to have [10:31] a certification or a license for? That's one of  the underlying questions. So now a firm decides, [10:38] I don't want my agent to give investment advice to  the clients. I'm not ready for that. I don't know [10:44] if it can be certified. I don't know if having  a human in the loop will satisfy the regulators, [10:50] but the models may still give that information  to clients. Models don't always do what we want [10:58] them to do. We can't control the output. It's a  it's a difference between the deterministic model [11:05] and the probabilistic model. So, what do I do?  I might decide not to have my model do that, [11:13] but I also need to monitor and the evals  in the model won't be sufficient to satisfy [11:20] my obligations to myself within my own firm.  It won't be sufficient to satisfy industry [11:27] requirements like FINRA for example and it  won't be sufficient to satisfy regulations. [11:34] Agents can pose a solution. Monitoring agents can  help us interpret the output of firstline business [11:44] agents that humans would not have the capacity  to interpret. So imagine that you have an agentic [11:54] you have an agentic payments agent  working for you in your investment account [12:01] and the agent decides it's going to transfer all  of your money to someone else maybe to a separate [12:09] account in the Cayman Islands. You agreed to  have that agent when you opened the account [12:17] or maybe you signed a click wrap when it was  offered to you and now the agent has transferred [12:23] your money because you signed off on the agent  doing transactions. What do we think about that? [12:31] Who made the decision? Who decided to transfer  your money out of your account? Was it the agent? [12:39] Can the agent actually make a decision? Or was  it you when you signed off on having the agent? [12:47] Maybe you click wrapped and agreed  that the agent could do transactions [12:53] and the firm that offered you the agent  bears no liability for transactions. [13:00] What if the agent decides to transfer  a million dollar from your account to [13:07] an account in I don't know the SE shells,  but you only have $100,000 in your account. [13:17] So, the agent goes ahead with the transaction  and there's a counterparty on the other side [13:23] and they are waiting for their $900,000. Do you  owe that person $900,000? Did you make a decision [13:33] to transfer a million dollars to that person?  Who is responsible? Was a decision even made? [13:42] These are the important questions around agents in  the financial sector is one example and that's why [13:49] demi habis and others from AI model companies  are citing regulation and industry standards [13:58] in the financial sector because we have built  this architecture of trust over decades. [14:06] By the way, we're going to have the  same issues with trading. Imagine agents [14:10] that you give permission for them to trade 24/7,  right? You're thinking, "Okay, uh here's my [14:16] account. The agent is really smart. If there's  a financial crisis in the middle of the night, [14:23] the agent can protect my portfolio. It will hedge  me or will sell my positions that are vulnerable." [14:30] So, you've signed off on the agent trading for you  24/7 because you're an active trader and you trust [14:37] the agent to make transactions for you. So, now  what happens if the agent makes a transaction in [14:44] the middle of the night? What happens if millions  of people have agents at a single investment firm? [14:53] There's an event in the middle of the night  and all of the agents trade the same way. [14:59] What happens then? Do the markets spiral? These  are the kinds of things that FINRA and other [15:07] regulators are thinking about. All right. So, as  I mentioned, trading, payments, agentic advice, [15:18] they all involve that same question. Who made the  decision? Was a decision made? And do we trust [15:27] the maker of that decision? How do we build trust  around it? I have heard folks say, okay, evalu [15:47] test and evaluate whether the model  violates the rule about investment advice. [15:55] But that is not the same thing as a second line  agent monitoring your agentic advisor to see if [16:05] it's giving investment advice. And this is where  I think Agentic AI and innovation in agents for [16:14] risk management and compliance can be an answer  to these trust issues around agents that invest. [16:23] agents that make payments, agents that will trade  for you in the middle of the night. By the way, [16:31] you all may have seen Coinbase now has an actual  Agentic Financial Advisor that has SEC approval. [16:40] Amazing, right? So, they have some approval and  you can allow your agent to trade for you 24/7 [16:50] and crypto trades 24/7. So now you don't have to  wait for the New York Stock Exchange to be open. [16:58] You can just trade in Cryptoland  24/7 using your advisor. [17:05] Unfortunately, I do have to interrupt. That  is time. But I am sure that Sarah will not [17:10] mind answering any more questions off stage.  I will not mind. I'm so sorry. All right. No, [17:17] that's okay. Last presentation of the day.  I hope you all go off and enjoy the rest of [17:23] the conference. I want to thank Britney and  Michael Weiss um and everyone else who was [17:29] involved in putting AI4 to together for the  opportunity to be here. And I'd love to talk [17:34] with you more about how innovation in Agentic  AI can help us build the architecture of trust.