AI Playbook
for Financial Services

Suitability Override: Flag any recommendation that deviates from client risk profile by >2 standard deviations; require advisor review and consent form.

Concentration Limits: Enforce position size caps (e.g., no single holding >15% of portfolio) and sector exposure limits per regulatory guidance.

Liquidity Guardrails: Ensure rebalancing trades maintain minimum cash buffer (2-3% for advisors' operational needs); avoid forced selling in illiquid positions.

Tax Drag Monitoring: Alert advisors when estimated tax drag exceeds 0.5% annually; auto-suggest harvesting pairs ranked by magnitude of loss.

Recommendation Drift Detection: If same client receives conflicting advice (e.g., increase/decrease equity allocation) within 6 months, escalate for model review.

Advisor Discretion Threshold: Allow advisors to override AI recommendations for compelling reasons; log reason codes for continuous model improvement.

Assumption Sensitivity: Update all forward projections (retirement, goal funding) monthly using latest market data; alert clients to material plan variance (>10%).

Model Risk Review: Conduct annual independent validation of AI models by compliance/audit; document assumptions, limitations, and performance degradation scenarios.

Explainability Requirement: Maintain audit trail of key decision factors for every approval and denial; enable applicant-level explanations for adverse actions within 30 days.

Disparate Impact Thresholds: Flag any protected class group with approval/loss rate deviation >10%; require remediation (model retuning or policy override) before expanding.

Manual Override Tracking: Log underwriter overrides of AI recommendations; quarantine low-performing override patterns for model feedback.

Data Quality Gates: Reject applications with missing critical fields (income, employment, alternative data) unless explicitly approved by exception workflow.

Collections Fairness: Ensure collection strategy respects debt-to-income thresholds; do not pursue borrowers with imminent hardship signals.

Pricing Transparency: Disclose APR/fee rationale to borrowers; flag unusually high or low pricing for underwriter review to prevent predatory or loss-making offers.

Explainability: Maintain transparent underwriting reasons and provide claimants with clear explanations for automated denials to satisfy FCRA and state regulations

Anti-Discrimination: Implement fairness constraints on protected attributes (age, gender, race, zip code) and monitor disparate impact metrics quarterly

Audit Trail: Log all underwriting and claims decisions with model versions, thresholds, and decision reasoning for regulatory examination

Human Escalation: Route unusual claims, high-value decisions, and edge cases to trained adjusters for override authority and judgment calls

Third-Party Validation: Have external actuaries validate pricing models and reserve adequacy before deployment to new markets or risk classes

Data Security: Encrypt all PII and medical data in transit and at rest; implement role-based access controls for AI model access

Circuit Breakers: Implement hard stops on algorithmic execution if daily losses exceed threshold or market volatility spikes beyond tolerance

Order Validation: Apply pre-execution checks on all AI-generated orders to ensure size, price, and venue compliance with SEC Reg SHO and exchange rules

Surveillance Logging: Maintain detailed audit trail of all trades, orders, and cancellations for SEC examination and FINRA reporting

Human Oversight: Require senior trader sign-off on high-risk strategies and reserve ability to override AI execution in real-time

Stress Testing: Run monthly scenarios on edge cases (flash crashes, liquidity crises) to validate algorithm stability under duress

Vendor Validation: Audit third-party data providers for accuracy and verify alternative data sources are legally compliant

Backtesting Rigor: Use out-of-sample validation and walk-forward testing to avoid overfitting and false alpha claims

Investment decisions must remain with qualified investment professionals — AI provides analysis and signals, not investment recommendations

Data room AI tools must operate in isolated environments — cross-contamination between competing deal contexts creates fiduciary risk

AI-generated LP communications must be reviewed by IR professionals before distribution

Valuation models must be validated by independent professionals for fund NAV and reporting purposes

Document AI tool usage in investment process for LP due diligence and regulatory examination

Model Performance Monitoring: Track accuracy, precision, recall, and AUC weekly; alert when any metric degrades >5% vs. baseline; halt model use if performance falls below minimum thresholds.

Bias & Fairness Testing: Measure model performance across demographic groups quarterly; document protected class parity; escalate disparities >3% for investigation.

Data Quality Validation: Enforce completeness, timeliness, and accuracy checks on input data streams; reject transactions with missing critical fields from processing.

Alert Escalation Rules: Route high-confidence alerts to analysts; auto-escalate unresolved alerts after 24 hours; require supervisor sign-off on case closure.

Sanctions List Currency: Update screening lists daily from official sources (OFAC, UN, EU); flag gaps or delays in list updates for compliance approval.

Explainability & Audit Trail: Maintain reason codes and evidence for every alert and decision; enable 100% traceable audit logs for regulatory exams and legal discovery.

Model Versioning & Rollback: Tag all model deployments with version, date, validator approval; maintain ability to roll back to prior version within 1 hour if drift detected.

Automatic Decline Threshold: Block transactions with fraud score >95th percentile automatically; flag for investigation within 24 hours; enable quick release via customer verification.

Step-Up Authentication Trigger: Require additional auth (OTP, biometric) for scores 75-95th; personalize challenges based on customer history (rare events, new devices, unusual locations).

Velocity Limits: Enforce transaction count, amount, and merchant category velocity limits per device/account/IP; escalate unusual patterns for review.

Geographic Impossibility: Flag transactions from geographically impossible locations (e.g., same account used in two cities <2 hours apart); require confirmation.

Device Fingerprint Monitoring: Track device changes and anomalies; require re-authentication after new device registration or device list tampering detection.

Merchant Blacklist Management: Maintain dynamic merchant risk ratings; block transactions from high-risk merchant categories for new cardholders; escalate suspicious merchant patterns.

Dispute Rate Monitoring: Track post-transaction fraud disputes and chargebacks; retrain models quarterly using confirmed fraud labels to catch emerging patterns.

AML/KYC Validation: Screen beneficiaries against multiple OFAC, sanctions, and PEP databases in real-time before transaction execution

SLA Enforcement: Ensure AI routing decisions meet agreed settlement times and payment velocity requirements with counterparties

Audit Logging: Record all routing decisions, exceptions, and overrides with timestamp and reasoning for regulatory examination

Manual Override Authority: Preserve treasury team's ability to override AI decisions on high-value or strategically important payments

Cross-Border Compliance: Validate payment corridors against OFAC, FCPA, and sanctions rules in all destination countries

Data Encryption: Encrypt all payment data in transit to payment processors and at rest in reconciliation systems

Data Encryption: Encrypt all payment data in transit to payment processors and at rest in reconciliation systems

Consent Management: Maintain explicit opt-in consent for personalization and marketing communications; respect opt-out requests immediately

Data Privacy: Encrypt customer data in transit and at rest; limit AI model access to PII and enforce minimum necessary data principles

Transparency: Disclose when customers are interacting with bots and provide easy handoff to human agents on request

Fair Lending: Audit recommendations for potential discrimination by protected attributes; monitor disparate impact in credit and product recommendations

Recording Compliance: Obtain recorded consent before voice calls and comply with state two-party consent requirements (California, Florida, Pennsylvania, etc.)

CCPA/GDPR: Honor customer data access, deletion, and portability requests within regulatory timelines

Maintain human-in-the-loop for all SAR filing decisions — AI should recommend, compliance should decide

Document model methodology and feature importance for regulatory examination readiness

Sanctions list updates must be applied within 24 hours of publication — automate this process

Segment AML models by customer type and channel — a retail model applied to correspondent banking will underperform

Conduct adversarial testing to identify model blind spots before deployment

All payment executions above a defined threshold must require dual human approval — AI can recommend but not autonomously execute large payments

Investment decisions must stay within board-approved Investment Policy Statement (IPS) parameters — AI cannot override policy constraints

Cash forecast models should be validated quarterly against actuals and recalibrated if MAPE exceeds 15%

FX hedge recommendations require treasurer review and sign-off — never fully automate hedging execution

Maintain audit trail for all AI-generated treasury recommendations and decisions

AI forecasts must be reviewed and approved by a qualified finance professional before being presented to board or external parties

Document all material assumptions in AI-generated forecasts for audit and governance purposes

Maintain human override capability — AI forecast is an input, not a mandate

Ensure AI-generated financial narratives are reviewed for accuracy before inclusion in investor communications or regulatory filings

Validate models against out-of-sample data before production deployment

All AI-generated ESG disclosures must be reviewed and approved by qualified sustainability professionals before publication

Maintain complete audit trail of data sources, calculation methodologies, and assumptions for assurance and regulatory examination

Do not use AI-generated estimates to replace supplier-specific emissions data where material — regulators and assurers will scrutinize estimation methodologies

ESG claims in marketing and client communications must be substantiated before release — legal review required

Climate scenario models are projections, not predictions — communicate uncertainty ranges in all disclosures

Define explicit action limits — agents should not be permitted to execute transactions above defined thresholds without human approval

Implement a “circuit breaker” — automated mechanism to pause agent operations if error rate or anomaly score exceeds threshold

Maintain a complete, immutable audit log of all agent actions, inputs, and outputs for regulatory examination

Human accountability must be clearly assigned for all regulated decisions made with AI agent assistance

Test agents with adversarial inputs before production deployment — edge cases will occur and agents must handle them gracefully

Week 1: Announce AI pilot to business unit leadership. Share vision, timeline, and compliance framework.

Week 2-3: Train pilot group on tools & prompts. Go live with document processing or research synthesis.

Week 4: Collect feedback. Share early wins. Brief compliance team on governance adherence.

Week 5-8: Expand to full team. Add 2nd tool. Publish prompt library. Weekly tips in team meetings.

Week 9: Formalize policy with legal review. Document SOPs. Cross-train backups.

Week 10-12: Measure impact. Present to leadership. Celebrate wins. Plan next wave.