Finance Industry AI: 5 Hard Requirements for Compliance

On-prem · No data exfiltration · Audit trail · Two-dimensional access · Output minimization

TL;DR — In banking / securities / insurance / consumer finance, AI assistants aren't "just another app." Five hard requirements (on-prem, no data leaves the network, audit trail, two-dimensional permissions, output minimization) sit between you and any audit. Skip one and you fail.

Requirement 1: On-prem, model never leaves your network

Customer KYC, credit data, internal policy docs: AI must read and process them inside your perimeter

A customer asks "what's my credit card annual fee?" — that question alone sits in a compliance gray zone: customer identity + bank data + model call form one chain. Send any link of that chain to a third party (e.g. a public OpenAI endpoint) and you've crossed the line.

✅ Deploy the entire AI stack (database + vector store + main service) on company intranet or a dedicated cloud. For LLMs: either self-hosted (vLLM + Qwen / DeepSeek) or use a vendor's dedicated-AZ offering (Azure OpenAI, Aliyun Bailian). Never feed production data through a public API.

Requirement 2: No data leaves the network boundary

Tools the AI can call must be controllable: queries to internal databases yes, arbitrary HTTP calls no

AI assistants often have "external" capabilities (weather, shipping, HTTP fetches). In finance these are disabled by default. Any outbound call is a potential exfiltration vector. AI can't "invent" new tools at runtime; the allowlist is locked.

✅ Mode: tool allowlist. The AI service reads an allowlist config; only "internal lookup", "internal KB" and "human handoff" type tools are exposed. All external APIs (search / translate / email) are off. Auditors can print the allowlist and be done.

Requirement 3: Audit trail — who asked, who answered, what was cited

Regulators will ask: "what did your AI tell user X on day Y?" You must answer.

If you only rely on IM-platform native storage, your audit trail lives on someone else's database. Auditors won't accept that.

✅ Mirror all AI conversations to two stores: (1) the IM platform's own (e.g. Feishu/WeCom logs), (2) your own structured storage with fields: user_id, question, answer, kb_citations (with file name + section). Two stores, not redundancy—it's the legal minimum.

Requirement 4: Two-dimensional permissions — role × tools

A relationship manager querying customer info: fine. The same person running arbitrary SQL via AI: disaster.

Permission isolation is an old topic, but AI amplifies it 10×: you now have to grant permissions to people and to the AI's toolset. Two-layer misconfiguration is where incidents happen.

✅ Two-dimensional authorization: role × AI tools. e.g. Relationship Manager → ["lookup policy", "lookup public customer info"]; Risk Analyst → ["lookup policy", "internal data (with approval)"]. Non-engineering roles must never get write/exec tools. Approval workflow runs on tools, not on AI.

Requirement 5: Output minimization, sensitive fields redacted by default

AI returns Customer A's ID number to Customer B → regulator fine

AI's biggest "fail" mode in finance isn't answering wrong—it's returning customer A's data to customer B, especially when RAG retrieves the wrong document. Minimize: an answer should never contain more sensitive fields than the question requires.

✅ Output filter on the AI service's last step, redacting ID / card / phone / CVV fields. Also: every KB query must include the current user's identity as a filter. If a customer asks "what's my credit limit," query their limit by user ID, not "all customers' limits and let AI pick."

SOP: 6 months to compliant AI in finance

M1: Architecture review — Security, compliance, legal all sign off on the deployment plan.
M2: Private LLM deploy — Recommend vLLM + Qwen2.5 72B to start, or vendor dedicated-AZ.
M3: Tool allowlist config — Even at M1 with only 3 tools, leave the config-driven scaffold in place.
M4: Audit fields + dual storage — Two storage chains, schema spec, 5-year retention.
M5: Role × Tool matrix — First version must be audit-signed, not backfilled later.
M6: Pilot one dept, 30 days — Pick the team most AI-tolerant AND most failure-sensitive: Risk Control or Compliance.