Back to Risk Catalogue

IOSCO Supervisory Toolkit for AI Use in Capital Markets

IOSCO's supervisory toolkit (FR/02/2026) providing structured assessment tables for AI governance, third-party risk, disclosure, and recordkeeping in capital markets.

Table 2: AI Governance & Oversight

Risks

RI-22Regulatory Compliance and Oversight

Table 2: Model Risk Management

Risks

RI-19Data Quality and Drift RI-04Hallucination and Inaccurate Outputs RI-05Foundation Model Versioning RI-06Non-Deterministic Behaviour

Table 2: Investment Advice & Suitability

Risks

RI-14Inadequate System Alignment RI-16Bias and Discrimination RI-18Model Overreach / Expanded Use

Table 2: Market Risks

Risks

RI-06Non-Deterministic Behaviour

Table 2: System Reliability & Business Continuity Planning

Risks

RI-07Availability of Foundational Model

Mitigations

MI-08Quality of Service (QoS) and DDoS Prevention for AI Systems MI-09AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring

Table 2: Cybersecurity & Data Privacy/Protection

Risks

RI-10Prompt Injection RI-01Information Leaked To Hosted Model RI-26MCP Server Supply Chain Compromise RI-27Agent State Persistence Poisoning RI-29Agent-Mediated Credential Discovery and Harvesting RI-02Information Leaked to Vector Store RI-08Tampering With the Foundational Model RI-09Data Poisoning

Mitigations

MI-12Role-Based Access Control for AI Data MI-14Encryption of AI Data at Rest MI-16Preserving Source Data Access Controls in AI Systems MI-17AI Firewall Implementation and Management MI-01AI Data Leakage Prevention and Detection MI-22Multi-Agent Isolation and Segmentation MI-23Agentic System Credential Protection Framework MI-03User/App/Model Firewalling/Filtering

Table 2: Outsourcing & Third-Party Dependencies

Risks

RI-07Availability of Foundational Model

Table 2: Disclosure & Transparency

Risks

RI-17Lack of Explainability RI-20Reputational Risk

Table 2: Recordkeeping & Audit Trail

Mitigations

MI-13Providing Citations and Source Traceability for AI-Generated Information MI-21Agent Decision Audit and Explainability MI-04AI System Observability

Table 3.1: Oversight from Board or Governing Body

Risks

RI-22Regulatory Compliance and Oversight

Table 3.2: Senior Management Responsibilities

Risks

RI-22Regulatory Compliance and Oversight

Table 3.3: AI Risk Management Systems, Policies and Procedures

Risks

RI-22Regulatory Compliance and Oversight

Table 3.4: Data Governance

Risks

RI-19Data Quality and Drift RI-01Information Leaked To Hosted Model RI-23Intellectual Property (IP) and Copyright RI-02Information Leaked to Vector Store RI-09Data Poisoning

Mitigations

MI-12Role-Based Access Control for AI Data MI-16Preserving Source Data Access Controls in AI Systems MI-02Data Filtering From External Knowledge Bases MI-06Data Quality & Classification/Sensitivity

Table 3.5: Risk Management of Advanced AI Systems

Risks

RI-10Prompt Injection RI-14Inadequate System Alignment RI-18Model Overreach / Expanded Use RI-24Agent Action Authorization Bypass RI-25Tool Chain Manipulation and Injection RI-26MCP Server Supply Chain Compromise RI-27Agent State Persistence Poisoning RI-28Multi-Agent Trust Boundary Violations RI-29Agent-Mediated Credential Discovery and Harvesting RI-06Non-Deterministic Behaviour

Mitigations

MI-18Agent Authority Least Privilege Framework MI-19Tool Chain Validation and Sanitization MI-22Multi-Agent Isolation and Segmentation MI-23Agentic System Credential Protection Framework

Table 3.6: AI Model Validation, Testing and Monitoring

Risks

RI-14Inadequate System Alignment RI-16Bias and Discrimination RI-19Data Quality and Drift RI-04Hallucination and Inaccurate Outputs RI-05Foundation Model Versioning RI-06Non-Deterministic Behaviour

Mitigations

MI-10AI Model Version Pinning MI-11Human Feedback Loop for AI Systems MI-15Using Large Language Models for Automated Evaluation (LLM-as-a-Judge) MI-05System Acceptance Testing MI-06Data Quality & Classification/Sensitivity

Table 3.7: Controls and Human Oversight of AI Systems

Risks

RI-17Lack of Explainability RI-18Model Overreach / Expanded Use RI-24Agent Action Authorization Bypass RI-25Tool Chain Manipulation and Injection RI-28Multi-Agent Trust Boundary Violations

Mitigations

MI-11Human Feedback Loop for AI Systems MI-12Role-Based Access Control for AI Data MI-18Agent Authority Least Privilege Framework MI-21Agent Decision Audit and Explainability MI-03User/App/Model Firewalling/Filtering

Table 4.1: Assessment of Risk-Proportionate Controls

Mitigations

MI-05System Acceptance Testing MI-07Legal and Contractual Frameworks for AI Systems

Table 4.2: Transparency Measures

Risks

RI-17Lack of Explainability

Table 4.3: Fairness Due Diligence Assessment

Risks

RI-16Bias and Discrimination

Table 4.4: Supply Chain Risk Assessment

Risks

RI-23Intellectual Property (IP) and Copyright RI-26MCP Server Supply Chain Compromise RI-08Tampering With the Foundational Model RI-09Data Poisoning

Mitigations

MI-19Tool Chain Validation and Sanitization MI-20MCP Server Security Governance MI-06Data Quality & Classification/Sensitivity

Table 4.5: Concentration Risk

Risks

RI-07Availability of Foundational Model

Table 4.6: Contingency Planning

Risks

RI-07Availability of Foundational Model

Mitigations

MI-08Quality of Service (QoS) and DDoS Prevention for AI Systems

Table 4.7: Legal Framework and Accountability

Risks

RI-22Regulatory Compliance and Oversight

Mitigations

MI-07Legal and Contractual Frameworks for AI Systems

Table 4.9: Use of Complex AI Products

Risks

RI-18Model Overreach / Expanded Use

Table 5.1: Disclosure of AI Use in Products and Services to End-Users

Risks

RI-17Lack of Explainability

Mitigations

MI-13Providing Citations and Source Traceability for AI-Generated Information

Table 5.2: AI Governance and Strategy Disclosures

Risks

RI-22Regulatory Compliance and Oversight

Table 5.4: Identifying Misleading Claims

Risks

RI-20Reputational Risk

Table 6.1: Documentation of AI Lifecycle Oversight

Mitigations

MI-21Agent Decision Audit and Explainability MI-04AI System Observability

Table 6.3: Documentation of AI-Generated Outcomes

Mitigations

MI-11Human Feedback Loop for AI Systems MI-13Providing Citations and Source Traceability for AI-Generated Information MI-21Agent Decision Audit and Explainability MI-04AI System Observability

Table 6.4: Documentation of Explainability of AI Outputs

Risks

RI-17Lack of Explainability

Mitigations

MI-13Providing Citations and Source Traceability for AI-Generated Information MI-21Agent Decision Audit and Explainability

Table 6.5: Records on Incidents Relating to AI Products or Services

Risks

RI-27Agent State Persistence Poisoning RI-28Multi-Agent Trust Boundary Violations RI-29Agent-Mediated Credential Discovery and Harvesting

Mitigations

MI-21Agent Decision Audit and Explainability MI-04AI System Observability MI-09AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring

Table 6.6: Reporting

Risks

RI-22Regulatory Compliance and Oversight

Table 7: AI Adoption Indicators

Mitigations

MI-04AI System Observability

Table 7: Nature and Use Cases of AI Systems

Mitigations

MI-04AI System Observability

Table 7: Third-Party Dependencies and Concentrations

Mitigations

MI-07Legal and Contractual Frameworks for AI Systems

Table 7: AI System Performance Indicators

Mitigations

MI-04AI System Observability MI-08Quality of Service (QoS) and DDoS Prevention for AI Systems MI-09AI System Alerting and Denial of Wallet (DoW) / Spend Monitoring