{"topic":"vendor-oversight","title":"vendor oversight","url":"https://theexchange.tech/archive/vendor-oversight","description":"Dispatches on vendor oversight for AI agents in financial services.","questions":[],"count":3,"startHere":[],"articles":[{"title":"Examiners found remediation that was reported and never happened. An agent writes that report faster.","url":"https://theexchange.tech/articles/examiners-found-remediation-that-was-reported-and-never-happened-an-agent-writes-that-report-faster","json":"https://theexchange.tech/articles/examiners-found-remediation-that-was-reported-and-never-happened-an-agent-writes-that-report-faster.json","excerpt":"On 14 September the SEC's Division of Examinations published what its staff actually found inside advisers' annual compliance reviews. Three of the five finding categories describe the precise seams a deployed agent sits in: outside service providers used without an oversight procedure, testing performed but never retained as a record, and corrective actions reported as implemented while the underlying issue persisted. None of it mentions agents. All of it is about them, because every one of those findings is a case where producing the assurance was cheaper than producing the assurance's subject - and an agent widens that gap in the wrong direction.","publishDate":"2026-09-20","author":"Hugh Mercer","topics":["risk-humility","sec-examinations","supervision","vendor-oversight","books-and-records","governance"]},{"title":"Datalign's agents answer clients in your firm's voice. Your ADV has to say whose they are.","url":"https://theexchange.tech/articles/dataligns-agents-answer-clients-in-your-firms-voice-your-adv-has-to-say-whose-they-are","json":"https://theexchange.tech/articles/dataligns-agents-answer-clients-in-your-firms-voice-your-adv-has-to-say-whose-they-are.json","excerpt":"On 18 March Datalign opened Halo, letting advisory firms deploy branded, client-facing agents grounded in their own investment philosophy — most on a white-label basis the vendor cannot name. The architecture encodes real constraints: scoped retrieval, source attribution, a compliance layer in the response path. But the duties that bite here bind the adviser, not the platform, and three of them are still unwritten: what the client is told, what a confidence number means, and whether any given turn is marketing or advice.","publishDate":"2026-08-23","author":"Dean Whitfield","topics":["disclosure","form-adv","marketing-rule","fiduciary","client-facing-agents","vendor-oversight","wealth-management"]},{"title":"Playbook's plays rewrite themselves: state the change-control rule before you run one","url":"https://theexchange.tech/articles/playbooks-plays-rewrite-themselves-state-the-change-control-rule-before-you-run-one","json":"https://theexchange.tech/articles/playbooks-plays-rewrite-themselves-state-the-change-control-rule-before-you-run-one.json","excerpt":"Playbook launched on 13 August with roughly 40 firms and about $660B in client assets behind it, and one sentence in the release that matters more than the rest: the platform \"continuously evaluates past performance and automatically improves processes over time,\" deployed organization-wide. Every examination question an adviser faces assumes the process documented is the process that ran. Here is the rule to state before you deploy a workflow that edits itself.","publishDate":"2026-08-18","author":"Dean Whitfield","topics":["workflow-automation","change-control","auditability","vendor-oversight","ria-operations","sec-examinations"]}]}