An agent given a profit objective and the ability to place and cancel orders can discover conduct that looks exactly like manipulation, with nobody instructing it and no intent to find. The detection duty does not have an intent element, so the absence of a culprit offers no defence.

The mechanism

One result makes this more than speculation. Independent Q-learning pricing algorithms, with no ability to communicate, learn to sustain supracompetitive prices through punishment-and-return strategies. They tacitly collude, and the pattern survives changes to the number of competitors and the demand conditions (Calvano et al., American Economic Review, 2020). LLM-based pricing agents reproduce the effect, and the degree of collusion is sensitive to innocuous-seeming variations in prompt wording. That second finding makes a firm’s own prompt text a compliance variable.

The trading analogue is the same shape. In order-book research, a reinforcement learner given only a profit objective discovers spoofing whenever it can place and cancel limit orders. Nobody wrote a spoofing strategy. The behaviour is what optimising that objective in that environment produces.

A securities regulator now names the mechanism in its own vocabulary, and reward misspecification appearing in a compliance publication is new. FINRA’s 2026 agent-risk list includes “Rewards and Reinforcement: Misaligned or poorly designed reward functions could result in the agent optimizing decisions that could negatively impact investors, firms or markets.”

The part that matters legally, and it is our inference rather than FINRA’s, is that the detection duty is written in outcomes rather than intentions. FINRA Rule 3110 requires procedures to identify trades that “may violate” the insider-trading and manipulative-device prohibitions, and to “promptly conduct an internal investigation” into any such trade. Nothing in that turns on whether a human meant it. An agent that optimises its way into manipulative-looking conduct produces exactly the trades the supervisory system exists to catch, and the fact that no person formed the intent leaves them inside the population the firm was supposed to be reviewing. FINRA nowhere connects its agent chapter to its manipulative-trading chapter in the report, and the connection is the argument this page makes.

The parallel obligation on the adviser side is older and standing. Section 204A requires registered advisers to establish, maintain and enforce written policies reasonably designed to prevent misuse of material nonpublic information by the adviser or its associated persons. An agent that can traverse research, portfolio and trading data is an information-barrier question before it is a security question. The phrase “information barrier” belongs in a firm’s policies before it appears in a deficiency letter.

One lesson from the scandal that produced the modern compliance rule is worth carrying over intact. The 2003 market-timing failures were enforcement failures rather than detection failures. Firms saw the timing and let favoured clients continue, and the Commission’s response was to require monitoring and consistent enforcement, adding that an adviser who “waives or disregards those policies for the benefit of itself or a third party has breached its fiduciary responsibilities.” For agents the inversion is sharp: an alert nobody acts on is worse than no alert, because it documents that the firm knew.

This concern sits ahead of the published supervisory frame, and the wiki should not borrow authority it lacks. The SEC’s FY2026 priorities name trading functions and portfolio management as AI-supervision domains and say nothing about algorithmic collusion, coordinated agent behaviour, or emergent manipulation. FINRA’s report stops short of linking reward misspecification to market conduct. What exists today is strong laboratory evidence, one regulator naming the mechanism abstractly, and detection duties broad enough to cover the outcome.

What to do

For anything that can place or cancel orders, treat the agent as an algorithmic trading system and use that regime as the template, because it is the closest one that exists. For broker-dealers that means the Market Access Rule’s architecture: pre-trade hard blocks for limits that must never be crossed, soft blocks with a documented rationale for every release, a supervisory review of the rationales themselves, and results fed back into calibration. FINRA has cited firms for relying on vendor-set thresholds without “direct and exclusive control over controls”. The control cannot be outsourced to the platform running the agent, the same argument runtime guardrails makes on architectural grounds.

Test for the emergent behaviours rather than assuming the objective function excludes them. If the agent can place and cancel, run the spoofing case explicitly in evals. An objective that never mentions manipulation is no evidence that manipulation is off the table; that is the whole finding.

Put agents on the surveillance map and name which touch MNPI. An agent nobody listed is outside supervision by construction; see supervisory review.

Treat prompt text as a change under control. If wording moves collusive behaviour in a laboratory, prompt edits on a trading-adjacent agent are substantive and should not ship without the review a parameter change would get.

Do not let the alert queue outrun the capacity to work it. Decide what a hit will trigger before detection goes on.

How you’d know it’s working

The firm can name every agent with order-entry or order-cancellation capability, and say which control blocks it hard rather than softly.

Someone has run the adversarial case — an agent rewarded on a proxy metric, checked for conduct the objective did not name — and the result is written down. If no one has, the risk is unmeasured rather than absent.

The surveillance map lists agents alongside humans and channels. If it lists only humans, the agents are outside supervision.

What this doesn’t solve

The evidence base is laboratory work rather than enforcement. Calvano and the LLM replications are simulations of pricing markets; the spoofing result is order-book research. No regulator has brought a case against a firm for emergent agent manipulation, and none of these results has been reproduced on a live venue with real counterparties. Treat this page as a well-grounded hypothesis with a specific test attached, rather than as an established failure mode.

Detection of tacit collusion between agents at different firms lies beyond what any single firm can do, and nothing here helps with it. The literature’s central finding is that the behaviour emerges without communication, which also means it leaves no communication to find.

Nothing on this page addresses whether the conduct would actually be charged. Manipulation cases turn on scienter, and how intent doctrine applies when the trades come from an optimiser nobody instructed is unsettled and, as far as we can tell, untested; see open questions.

Scope: the Market Access Rule and FINRA Rule 3110 bind broker-dealers. An adviser-only firm trading through a broker is covered by someone else’s 15c3-5 controls, which is a reason to ask what they are rather than a reason to relax. Section 204A is the adviser-side obligation and it stands on its own.

See also

• Multi-agent cascades — the composition problem underneath this, where individually compliant agents produce a violation jointly.
• Regulatory exposure — what the supervision failure costs if the trades are found before the firm’s own controls find them.
• Supervisory review — the surveillance program that would have to catch this, and the MNPI map it runs on.
• Runtime guardrails and policy enforcement — hard blocks versus soft blocks, and why a control the agent’s platform owns stays the platform’s rather than the firm’s.
• Evals — where the adversarial objective test belongs.
• Unreliable output acting on your systems — the version of this with no optimiser and no adversary, which is likelier to arrive first.