Regulatory boundary.

Regulators do not care that you use AI. They care what you do for whom, for money, and at what scale. Four escalating tiers determine which rulebook lands on you. The rest of this page is what each rulebook actually says.

Section IFour tiers that decide everything

1. Personal use. Your money, your keys, your risk. No third-party users, no marketing.
2. Friends and family. Informal sharing, no fee, no public holding-out.
3. Paid signal service. Subscription newsletter, Discord or Telegram alerts, “copy trading” hooks, or any monetised guidance to strangers.
4. Managing client money as an authorised firm. You take discretion, custody, or hold out as a regulated adviser or portfolio manager.

The line between tiers 1-2 and tiers 3-4 is where most builders trip. What follows is the perimeter in each jurisdiction.

Section IIUnited Kingdom (FCA)

Personal use — outside the perimeter

FSMA 2000 s.19 (the “general prohibition”) only bites where a specified activity is carried on by way of business in relation to a specified investment. Managing your own money is not a specified activity — RAO 2001 Article 37 requires managing assets “belonging to another person.” Trading a personal account with an AI or algorithmic system is outside the FCA perimeter.

Friends and family — usually outside, but not because it is unpaid

PERG 2.3 lists the “by-way-of-business” factors: continuity, commerciality, scale, holding out. Altruistic help falls outside — but the FCA is explicit that “free of charge” does not automatically mean not a business (revenue share, kickbacks or affiliate fees still bite). Once you take a friend’s money on discretion, you are into RAO Article 37 and need Part 4A authorisation.

Paid signal service — two overlapping regimes

RAO Article 53 (investment advice). PERG 8.28 is on the nose: “software services that involve the generation of specific buy, sell or hold signals relating to particular investments are liable, as a general rule, to be advice for the purposes of Article 53(1).”

FSMA s.21 financial promotion. Any “invitation or inducement to engage in investment activity” communicated in the course of business needs FCA authorisation, an FCA-approved firm’s sign-off, or a Financial Promotion Order 2005 exemption. Since 7 February 2024 (PS23/13), the s.21 approver route is itself a gated permission.

The FCA v 24HR Trading Academy litigation is the on-point precedent: selling signals and pointing customers to broker platforms was held to be unauthorised “arranging” under RAO Article 25(2). Disclaimers (“not investment advice”) do not save objectively advisory conduct.

PS22/10 High-Risk Investments and PS23/6 Cryptoasset promotions stack on top: mandatory risk warnings, 24-hour cooling-off, appropriateness assessments, positive frictions. Consumer Duty (PRIN 2A / PS22/9) applies to any regulated retail service — target-market fit, price and value, consumer understanding, consumer support.

Managing client money — Part 4A permission

FCA authorisation under FSMA s.55A, threshold conditions (COND 2), Senior Managers and Certification Regime map (SMF3/16/17 minimum), MIFIDPRU 4 capital (Class 2 non-SNI portfolio manager permanent minimum £75k / £150k / £750k depending on activities, plus K-factor own funds), FEES 3 Annex 1R application fee approximately £28k-£113k.

Algorithmic trading itself is governed by MAR 7A — resilient systems, kill functionality, pre-trade controls, annual self-assessment, immediate notification to the FCA and full RTS 6 compliance. Note: MAR 7A is not your problem unless you are already an authorised MiFID firm on a UK venue.

Section IIIUnited States (SEC, FINRA, CFTC)

Personal use — outside the perimeter

Investment Advisers Act 1940 §202(a)(11) requires “engag[ing] in the business of advising others” for compensation. Advising yourself is not regulated.

Friends and family — no federal safe harbour

The old IAA §203(b)(3) “14-client de minimis” was repealed by Dodd-Frank §403 effective 21 July 2011. State private-adviser exemptions fill the gap (New York: fewer than 6 NY-resident clients per 12 months; California and Texas have their own thresholds). The Family Office Rule (17 CFR 275.202(a)(11)(G)-1) excludes a single-family office serving only “family clients” and wholly family-owned, with no holding out.

Paid signal service — the Lowe publisher’s exclusion is narrow and getting narrower

IAA §202(a)(11)(D) excludes bona fide publishers. Lowe v. SEC, 472 U.S. 181 (1985) reads it broadly on First Amendment grounds when the publication is bona fide and disinterested, of general and regular circulation on a fixed cadence, and impersonal — no one-to-one relationship. Real-time Discord or Telegram alert rooms typically fail all three limbs. Recent enforcement narrows it: SEC v. Constantinescu / Atlas Trading Discord (December 2022) and SEC v. Left / Citron (July 2024, operator traded against calls).

Managing client money — RIA registration

Advisers Act §203A / Rule 203A-1: below $100M AUM state-registered; at or above $110M SEC-registered. Form ADV Parts 1/2/3 (Form CRS since 30 June 2020). Custody Rule 17 CFR 275.206(4)-2 requires a qualified custodian, direct client statements and an annual surprise PCAOB examination.

Broker-dealers with market access face SEC Rule 15c3-5: pre-trade financial controls, kill switches, credit and capital thresholds, annual CEO certification. 15c3-5 binds broker-dealers, not retail — but any market-access broker-dealer your algorithm touches will push obligations back to you via its controls.

Algorithm-specific supervision

FINRA Rule 3110 (Supervision), Rule 3120 (Supervisory Control) and Regulatory Notice 15-09 set the five practice areas for algorithmic strategies. Regulatory Notice 16-21 (effective 30 January 2017) requires Securities Trader (Series 57) registration under FINRA Rule 1220(b)(4) for persons “primarily responsible for the design, development or significant modification” of algorithmic strategies.

CFTC algorithmic status

Regulation Automated Trading (Reg AT) was formally withdrawn on 15 July 2020. The successor is the CFTC Electronic Trading Risk Principles (86 Federal Register 2048, 11 January 2021), which bind DCMs, not firms directly. FCM duties still flow through 17 CFR 1.11 (Risk Management Program) plus DCM rulebooks (CME 536/575, ICE).

Section IVEuropean Union (MiFID II, AI Act, DORA)

Personal use — Article 2(1)(d) own-account exemption

MiFID II Article 2(1)(d) exempts pure own-account dealing, unless you are a market maker, a member or participant of a venue, use a high-frequency algorithmic trading technique, or execute client orders. The HFT threshold in Delegated Regulation 2017/565 Article 19 is at least 2 messages per second per instrument or at least 4 per second across all instruments. Cross this and you lose the exemption.

Friends and family — no general exemption

MiFID II Article 2(1) is exhaustive; there is no friends-and-family carve-out. The trigger sits in Article 4(1)(4) “personal recommendation” as operationalised by Delegated Regulation 2017/565 Article 9. ESMA35-43-3861 (July 2023) confirms unpaid status is irrelevant.

Paid signal service — two overlapping regimes

MiFID II investment advice — Article 4(1)(4) plus Delegated Regulation 2017/565 Article 9. Generic paid Discord broadcasting the same message to all subscribers stays outside; tier-segmentation or direct messages cross in.

MAR investment recommendations — Regulation 596/2014 Article 3(1)(35) plus Article 20, operationalised by Delegated Regulation 2016/958 (identity, objectivity, conflicts >0.5%, presentation standards). This catches recommendations regardless of advice status. ESMA warning ESMA74-1103241886-912 (6 February 2024) is explicit: “not investment advice” disclaimers do not save you.

Managing client money — MiFID II Article 5 authorisation

Under IFR (Regulation 2019/2033) / IFD (Directive 2019/2034), most trading firms are Class 2 (or Class 3 SNI if below AUM €1.2bn, client orders handled below €100m cash / €1bn derivatives). Initial capital: €75k advisory / €150k default / €750k own-account dealing.

Algorithmic overlay: MiFID II Article 17 plus RTS 6 (Delegated Regulation 2017/589) — governance, testing and conformance, kill functionality, pre-trade controls (price collar, max order, message throttling), annual self-assessment, national competent authority notification, staff training.

EU AI Act — trading is not currently high-risk

Regulation (EU) 2024/1689 in force 1 August 2024, phased. Prohibited practices and AI literacy applied 2 February 2025; general-purpose AI and governance applied 2 August 2025; Annex III high-risk was originally 2 August 2026 but the Digital Omnibus provisional political agreement of 7 May 2026 would defer it to 2 December 2027 (not yet formally adopted — treat as pending).

Annex III high-risk in finance is narrow: 5(b) creditworthiness / credit scoring of natural persons (fraud-detection exempt); 5(c) risk assessment and pricing for life or health insurance. Algorithmic trading systems and investment advice tooling are not on the Annex III list.

DORA

Regulation (EU) 2022/2554 applies from 17 January 2025 to investment firms, trading venues, CCPs, CSDs and CASPs. Five pillars: ICT risk management, incident classification and reporting, digital operational resilience testing (annual, TLPT every 3 years for significant entities), third-party ICT risk (Register of Information), threat-intelligence sharing. Any external AI vendor is an ICT third party.

Cross-border to EU retail

Reverse solicitation is a narrow exception. ESMA’s January 2021 public statement and consistent BaFin / AMF enforcement confirm: German-language sites, targeted ads or influencer promotions kill the exception. Third-country firms serving EU retail generally need local authorisation or a branch.

Section VCross-cutting themes

Market abuse when using LLMs on news

Public information stays public after LLM reprocessing — mere summarisation is not fresh inside information. Live risk vectors: latency-tiered paid feeds released to premium subscribers before the broad investing public (arguably not “made public” under MAR Article 7); and derived or synthetic MNPI where a training or retrieval corpus contains leaked documents, embargoed press releases, private data-room materials or confidential alternative data. SEC v. Panuwat (verdict April 2024, upheld September 2024) confirms “shadow trading” on economically-linked issuers is actionable.

Market-data licensing

LSEG, NYSE, Nasdaq, Deutsche Börse and Bloomberg have all issued 2024-2025 policies treating LLM training and inference as Non-Display Use requiring explicit licences. Nasdaq (Data News 2025-2, 2025-6) and NYSE (mandatory annual Non-Display Declaration from 31 January 2025) now flag AI ingestion explicitly. Dow Jones / NY Post v. Perplexity (October 2024) confirmed “licence or litigate” as the industry stance.

Cybersecurity and resilience

UK FCA SYSC 15A plus PS21/3 (hard deadline 31 March 2025 for evidencing impact tolerances). EU DORA from 17 January 2025. US SEC Regulation SCI (SCI entities only) plus Regulation S-P amendments (December 2025 / June 2026 compliance). NIST AI RMF Generative AI Profile (July 2024) is the emerging reasonable-practice baseline.

Section VIWhat a builder should conclude in 2026

Building an AI or algorithmic trading system for your own money is outside every perimeter. All three regimes require you to be advising, arranging for, or managing money for others. Own account is safe.

Sharing informally with a small circle without fees or holding-out is usually safe. But “no fee” is not a bright line in the UK, and the US no longer has a federal friends-and-family exemption — state private-adviser thresholds are what protect you.

The moment you take a subscription, take custody of others’ funds, or push specific buy or sell signals to identifiable users, you have crossed into regulated territory. In the UK you hit RAO Article 53 or Article 25 plus s.21; in the US the Lowe exclusion is narrow and getting narrower; in the EU you land in MiFID II Article 4(1)(4) or MAR Article 20 — even a disclaimer will not save you.

AI does not have its own trading rulebook yet in any of the three jurisdictions. The UK Mills Review (launched January 2026) may produce one in late 2026 or 2027. The SEC’s Predictive Data Analytics proposal was formally killed in June 2025 and has not been re-proposed. The EU AI Act does not list trading in Annex III; the current EU pin is ESMA’s February 2026 Supervisory Briefing, which layers the AI Act on top of RTS 6 for algorithmic systems that qualify as AI systems.

---

Next: Glossary & sources →