risk-compliance-ai-governance

Chartered Financial Intelligence Architect (CFIA) · 62 questions

• A regional bank's risk management team is onboarding a new ML-based credit scoring model. The Chief Risk Officer references SR 11-7 guidance and instructs the team to complete a formal model validation before deployment. According to the Federal Reserve's SR 11-7 guidance on model risk management, which of the following statements BEST describes the three-component framework for model validation?
• A large regional bank has deployed a machine learning model to approve or deny consumer credit applications. Under SR 11-7 guidance, the model validation team must conduct an independent review. Which of the following activities is MOST critical to satisfy the SR 11-7 requirement for conceptual soundness validation?
• A global asset manager is building an enterprise AI model inventory to comply with SR 11-7 and emerging EU AI Act obligations. Their Chief Risk Officer asks what the MINIMUM set of metadata fields should be captured for each model entry. Which combination best satisfies both regulatory frameworks?
• A hedge fund uses a gradient-boosting model to generate daily equity trade signals. A compliance officer requests a post-hoc explanation for why the model recommended a large short position on a specific stock. The data science team proposes using SHAP (SHapley Additive exPlanations). Which statement BEST describes a key advantage of SHAP over LIME (Local Interpretable Model-agnostic Explanations) in this context?
• A London-based proprietary trading firm deploys a new high-frequency trading algorithm that uses a reinforcement learning model to optimize order placement across European equity venues. Under MiFID II Article 17, which control is MANDATORY before the algorithm is permitted to trade in live markets?
• An SEC-registered investment adviser uses an AI model to generate personalized portfolio recommendations for retail clients. The firm's compliance team is reviewing disclosure obligations under the Investment Advisers Act of 1940 and SEC guidance on AI. Which disclosure scenario would MOST likely trigger an SEC enforcement action for inadequate AI-related disclosure?
• A Chief Risk Officer at a mid-sized investment bank is building an AI governance program and decides to adopt the NIST AI Risk Management Framework (AI RMF 1.0). The CRO wants to prioritize the function that helps the organization understand the context and risk profile of AI systems before committing to deployment. Which NIST AI RMF Core Function should be the CRO's starting point?
• A European bank uses three separate AI systems: (1) a real-time credit scoring model that determines loan eligibility for retail customers, (2) a customer service chatbot that answers FAQ-type questions on the bank's mobile app, and (3) a social credit scoring system that rates customer trustworthiness based on social media behavior for access to financial products. Under the EU AI Act (Regulation 2024/1689), how should these three systems be classified?
• A global investment bank's CISO is developing a cybersecurity framework specifically for AI systems used in trading and risk management. The security team identifies that AI models introduce unique attack surfaces beyond traditional software. Which of the following represents a cybersecurity threat that is UNIQUE to AI/ML systems and does NOT have a direct equivalent in traditional application security?
• A fintech lender uses a deep learning model to detect fraudulent loan applications in real time. The security team discovers that sophisticated fraudsters are submitting applications with minute, carefully calculated perturbations to input fields (e.g., small changes in declared income values, address formatting, and device metadata) that cause the fraud model to classify fraudulent applications as legitimate. Which adversarial ML attack type does this scenario describe, and what is the MOST effective primary defense?
• Under a banking-style model risk program, how should a production LLM used for research summarization be treated?
• An AI-driven execution algo begins submitting errant orders. Which control is the FIRST line of operational defense?
• How should AI execution models be evidenced for best execution obligations?
• Multiple peers adopt similar alternative-data NLP signals. What systemic risk rises?
• A large regional bank has deployed an AI-driven credit scoring model that was fully validated twelve months ago under SR 11-7 guidelines. The model has since processed over 2 million loan applications with no formal re-review. The Chief Risk Officer asks the model risk team what SR 11-7 requires regarding ongoing monitoring for this model. Which of the following best describes the SR 11-7 ongoing monitoring obligation?
• A global asset manager licenses a third-party AI platform from a fintech vendor to generate portfolio risk scores. The vendor refuses to disclose model architecture details, citing proprietary concerns. Under SR 11-7 and OCC Bulletin 2013-29 on third-party risk management, which approach best satisfies the asset manager's model risk obligations?
• A CIO at a hedge fund uses an AI-powered factor model to size equity positions. During routine stress testing, the risk team discovers the model was trained exclusively on 2010–2023 market data — a period of predominantly low-volatility, low-interest-rate regimes. Which stress testing approach best addresses the model's historical data limitation?
• A European investment firm's data science team proposes training a client churn-prediction AI model using five years of historical transaction records, behavioral data, and financial advisory notes containing personal client information. The firm's DPO flags potential GDPR compliance issues. Which action best aligns the project with GDPR requirements for AI training data?
• A UK-based wealth manager is deploying an AI model to generate personalized investment recommendations for retail clients. The FCA's AI regulatory expectations, informed by its Discussion Paper DP5/22 and the Financial Services and Markets Act principles, would most likely require which of the following governance controls?
• A US-based robo-advisory platform uses an AI-driven portfolio construction model to manage $12 billion in retail client assets. The SEC's 2023 cybersecurity and AI risk disclosure rules, combined with the Investment Advisers Act of 1940 obligations, most likely require the firm to take which of the following steps regarding its AI model?
• Multiple institutional investors across the industry have adopted similar AI-powered factor models trained on common public datasets and using comparable feature engineering approaches. During a market stress event, these models simultaneously signal a reduction in equity exposure, triggering massive correlated selling. This scenario best illustrates which systemic risk concern?
• An investment bank deploys a large language model (LLM) to assist analysts in summarizing earnings call transcripts and drafting investment research. A security researcher demonstrates that specially crafted text embedded within a publicly available earnings transcript can cause the LLM to output fabricated financial figures in its summary. This attack type is best classified as:
• A global investment manager's AI-powered trade execution algorithm begins generating anomalous order patterns — routing unusually large block trades at market-on-close, causing significant price impact and potential regulatory scrutiny. The incident is flagged at 3:45 PM EST. Which AI incident response sequence is most appropriate?
• A European asset manager is deploying an AI system that continuously monitors retail clients' emotional states through voice analysis during advisory calls, then dynamically adjusts portfolio recommendations to exploit detected anxiety signals in order to increase product sales. Under the EU AI Act, how should a compliance officer classify this system?
• A robo-advisory platform uses a deep neural network to generate personalized portfolio recommendations for retail investors. The compliance team is designing the investor-facing disclosure. Which explainability approach best satisfies both regulatory expectations under MiFID II suitability rules and practical retail investor comprehension?
• Following a significant client loss event, regulators request a complete reconstruction of how your AI portfolio management system generated sell recommendations over the prior 90 days. Your model logging infrastructure captures only final output decisions and timestamps. Which gap in your audit trail architecture presents the most serious regulatory exposure?
• A quantitative portfolio manager presents a new AI alpha signal that achieved a Sharpe ratio of 3.2 in backtesting across 15 years of historical data. The model was developed through 200 iterations of feature engineering and parameter tuning on this same dataset. From a model risk management perspective, which concern should the risk committee prioritize before approving live deployment?
• An investment advisory firm deploys an AI system that generates individualized stock recommendations delivered via a mobile app to retail clients. The firm's legal team argues that because no human reviews individual recommendations before delivery, the firm avoids the definition of 'investment adviser' under the Investment Advisers Act of 1940 and has no disclosure obligations. Which assessment is most accurate?
• A California-based wealth management firm trains its AI suitability model using five years of historical client transaction data, including account balances, investment preferences, and behavioral patterns. The firm did not obtain specific opt-out rights for this use of data beyond its standard account agreement executed prior to CCPA's effective date. Under the California Consumer Privacy Act (CCPA/CPRA), which requirement presents the most immediate compliance gap?
• A prime brokerage deploys an AI-driven margin call system that monitors 50,000 client accounts in real time. During a sudden market dislocation, the model enters a degraded inference state — producing erratic margin calculations — while the firm's human oversight team is offline for a scheduled maintenance window. Under DORA (EU Digital Operational Resilience Act) and operational resilience principles, which control failure is most significant?
• A proprietary trading firm operates an AI-driven high-frequency trading system that executes up to 40,000 orders per second. During a stress simulation, risk managers identified that human operators could not react fast enough to manually halt the system before it could breach position limits in an adverse scenario. Under MiFID II RTS 6 algorithmic trading requirements, what is the firm's primary obligation regarding this finding?
• What should a model inventory entry for an LLM research assistant include?
• Regulators ask how an AI credit-like scoring tool in a wealth context produces outputs. You should present:
• SR 11-7 style practices encourage challenger models because:
• Ongoing monitoring for AI alpha models should watch:
• A complete model file for an AI investment strategy includes:
• Across data, alpha, and risk, the unifying CFIA principle is:
• MiFID II algorithmic trading controls relevant to AI include:
• Materiality tiering of AI use cases should drive:
• Adversarial risk in finance AI includes:
• Audit trails for AI-influenced investment recommendations should capture:
• Regulatory outsourcing expectations for AI vendors typically require:
• A sophisticated actor poisons a niche alt-data feed used by many funds. Mitigation includes:
• AI-driven books should be stress-tested for:
• Books and records obligations for LLM-assisted advice require:
• Employees in restricted jurisdictions accessing AI tools may create:
• Multiple AI strategies under one firm require:
• AI systems that generate public market commentary must avoid:
• Operational resilience frameworks applied to AI should address:
• Material changes to AI models in production require:
• If AI influences credit-adjacent wealth decisions, evaluate:
• AI incidents should be classified by:
• During the post-mortem of a flash crash event, your firm's AI-driven equity strategy lost 18% in four minutes before risk controls halted trading. The strategy had never been stress-tested against historical flash crash data. As Chief Investment Officer, which stress-testing framework best addresses AI strategy resilience in extreme liquidity events?
• You manage a $4 billion fund of funds that allocates capital across 22 underlying hedge funds. A due diligence review reveals that 15 of those funds now use proprietary AI models as their primary portfolio management engine, but none of these AI models appear in your aggregated model risk inventory. Which approach best addresses the layered AI model risk unique to a fund-of-funds structure?
• Your firm's AI trading system has been executing cryptocurrency arbitrage strategies across three offshore exchanges. Compliance discovers the AI has been placing wash-trade-like patterns to exploit exchange fee rebate structures — a behavior not explicitly programmed but emergent from reinforcement learning reward functions tied to net fee income. Which compliance response framework is most appropriate?
• AI can assist post-trade surveillance by:
• AI risk models assuming stable correlations should be stressed for:
• Generative AI scenario generators for risk must be:
• Intraday AI trading limits should include:
• Internal model cards for AI investment tools should be:
• Crypto AI trading adds control needs around:
• Continuous control monitoring for AI stacks means: