ESMA Initial Guidance on MIFID II Requirements for Firms Using AI in Retail Investment Services

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt The European Securities and Markets Authority (“ESMA”) Issues Initial Guidance Emanating from MIFID II Requirements to Firms using Artificial Intelligence Technologies when Offering Retail Investment Services Introduction ESMA published a statement to provide initial guidance to investment firms that already use or are planning to use AI, taking into consideration their main obligations under MIFID II while highlighting the related benefits and risks. The Statement affirms that it is crucial to always give priority to the clients’ best interests. ESMA expects that when firms provide information to clients on how they use AI tools for the provision of investment services, they should make sure that such information is presented in a clear, fair and not misleading manner. Furthermore, investment firms using AI for client interactions, such as through chatbots or other types of AI-related automated systems, should transparently disclose to clients the use of such technology during these interactions. Potential use of AI in Investment Services and Related Benefits Whilst the integration of AI by firms is developing in unequal ways throughout the industry, various applications of this technology can be foreseen, and each brings with it different types and levels of risks. Below are the different areas where implementation of AI options is currently being considered or applied by firms:

• Customer Service and Support – Some firms already provide support to their clients by answering queries. AI tools can be used by firms to analyse clients’ information as well as to develop investment strategies and identify potential investment opportunities. It could also be used to monitor the overall risk exposure of a client’s portfolio in particular risk tolerance and investment objectives.
• Compliance – There are firms that use AI systems to compare internal policies and procedures with legal requirements and can detect non-compliance with MIFID II investor protection rules. 19 June 2024

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt

• Risk Management – AI tools could be used to monitor the overall risk exposure and can evaluate the risk associated the different products and strategies.
• Fraud Detection – Unusual patterns may indicate fraudulent activity.
• Operational Efficiency – AI can be set to automate various tasks such as data entry, report generation and transaction processing. ESMA highlighted that the aim of the Statement is not only to address scenarios where AI tools are specifically developed or officially adopted by the investment firm or bank but also extends to situations involving the use by firm staff of third-party AI technologies (such as Chat GPT, Google Bard, and others) with or without the direct knowledge and approval of senior management. The principles and controls outlined in this Statement would aim at reminding firms that they should have in place appropriate measures to also control the use of AI systems by employees in any form, including any third-party AI technologies, whether specifically envisaged or already adopted by the firm itself or without any the direct knowledge and approval of senior management. Risks for Firms and Clients AI tools are currently encountering challenges related to:
• Over-Reliance – The service providers and clients might over-rely on AI for decision￾making and ignore human judgement. This can be risky in complex unpredictable financial markets where AI may not precisely predict the outcomes.
• Lack of Transparency and Explainability – Decision-making processes might be not understandable by firms and lack of explainability may affect service quality.
• Security/Data Privacy – Collection, storage, and processing of large amounts of data required by AI tools raises significant privacy and security concerns.
• Algorithmic Biases and Data Quality Issues – AI tools for natural language generation are known to produce incorrect outputs. In investment advice and portfolio management, this can lead to receiving the wrong advice. MiFID II Requirements The ESMA Statement aims to guide firms utilising or planning to use AI technologies so they can ensure compliance with the key MiFID II requirements, particularly those pertaining to organisational requirements (including Governance, Risk Management, Knowledge,

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt Competence and Staff training), conduct of business requirements, and the general obligation to act in the best interest of the client. Next Steps Utilising AI in investment services offers opportunities and challenges. Adhering to MIFID II requirements and putting clients’ best interests as a priority serve as guiding principles for investment firms. In ESMA’s Statement, investment firms are encouraged to seek further resources and engage with their supervisory authorities to navigate complex AI￾related challenges effectively. ESMA and National Competent Authorities will keep monitoring the evolution of the phenomenon and of the relevant EU legal framework on AI to determine if further action is needed in this area. Contacts Should you have any queries regarding the above, please do not hesitate to contact: csuinvestments@mfsa.mt.