Biggest compliance headache today? AI use, survey says

For the first time, artificial intelligence use is far and away the most common concern for compliance officers in the wealth management industry.

That was among the findings of the 2025 Investment Management Compliance Testing Survey, released Tuesday by the Investment Adviser Association, ACA Group and Yuter Compliance Consulting. The survey, now in its 20th year, gathered 577 responses in May from investment advisory firms of all sizes.

Compliance officers, asked what issues they were concerned about, said: AI usage, 57%; anti-money laundering (AML) readiness, 41%; cybersecurity controls, 38%; SEC marketing rule compliance, 36%; electronic communication surveillance and off-channel communications, 23%; private funds, 16%; digital assets, 13%; vendor due diligence, 11%.

Concerns about AI compliance knocked last year's top worry, off-channel communications, much further down the list. With the proliferation of AI tools in nearly every facet of the industry, that isn't likely to change in coming years.

AI worries on the rise

While only 5% of firms use AI to support client interactions, 40% of firms have formally adopted AI tools for internal use cases, and another 25% are actively exploring AI adoption, according to the survey. Increased compliance testing around AI and predictive analytics was reported by 46% of respondents — up from 32% last year, but 44% of firms that have adopted AI tools have no formal testing or validation of the outputs from their AI tools.

Among the specific compliance concerns involving AI are accuracy, data privacy and recordkeeping, said Scott Weinberg, CEO and founder of managed cybersecurity and enterprise cloud provider Neovera, in Reston, Virginia.

READ MORE: When AI shortcuts backfire on advisors

For example, if the model hallucinates and gives made-up responses, a firm could give incorrect advice or violate suitability standards. Users of AI need to understand the sources referenced, if any, in the AI response, he said.

"There needs to be governance over the use of private client data with an AI tool, especially if the model is cloud-hosted. This raises red flags with data governance teams," he said. "If AI-generated insights influence recommendations, how do you retain that information for audits?"

Weinberg said his firm mitigates these risks by "sandboxing" the use of AI. He said that means limiting where and how data is ingested into models and reviewing all outputs for compliance.

"We help ensure nothing replaces human oversight and treat AI as an assistant, not an advisor," he said. "We also ensure logs of prompts and outputs are maintained for audit trails."

Anti-money laundering policies

In August 2024, the U.S. Treasury Department's Financial Crimes Enforcement Network, or FinCEN, brought federally registered investment advisors and certain small firms under the same AML requirements as banks and broker-dealers. The deadline was originally set at Jan. 1, 2026, but on Monday was moved back by another two years to 2028.

Either way, firms must begin considering updating their AML policies if they haven't already.

READ MORE: Advisors more comfortable using AI at home than work

While 83% of firms have some form of policies and procedures around AML, independent testing of these policies remains limited, with the majority of firms, 56%, testing these policies less frequently than annually, according to the survey.

"We think this will be a challenge for smaller RIA firms, who do not typically have the resources in-house to satisfy the impending requirements coming in January," said Weinberg.

One of the most significant compliance challenges is the ability to remain current with constantly evolving regulations across multiple jurisdictions, he said. 

"We work with many clients in the banking and asset management industries, and we can see firsthand the efforts required to adapt to ever-changing expectations from the SEC, FINRA, state regulators and international regulators as well," he said.

Compliance essential to strategic decision-making

Often, there is often a conflict between advisors and those responsible for compliance, said Weinberg.

"Compliance can be viewed as slowing the advisors' need to be able to respond quickly and creatively to their clients' needs," he said.

However, compliance can no longer operate in the background, but instead needs to be embedded into strategic decision-making, said Ravi de Silva, founder of de Risk Partners and former global head of compliance testing for financial crimes at Citigroup. He advises fintechs, RIAs and smaller institutions — particularly those under $5 billion in AUM — on AML, AI governance and regulatory readiness. He also serves on the board of the Coalition Against Financial Crimes.

"As tools like AI accelerate operations and regulatory expectations evolve, firms that proactively align compliance with growth will have a clear competitive edge," he said. "The most forward-thinking advisors are using this moment to modernize their frameworks, not just to avoid penalties, but to enable faster licensing, stronger partnerships and long-term resilience. Compliance isn't just about managing risk anymore, it's a business advantage if approached correctly."