AI for financial services that model risk, compliance and examiners can sign off on

AI for financial services succeeds or fails on architecture. We design the platforms, controls and evidence trails that let banks, lenders and asset managers move generative AI and agents from pilot to production without stalling in model risk review.

Book a briefing

Row of classical stone columns on the facade of a financial institution

What is different about AI in financial services

AI for financial services runs inside one of the most mature control environments in any industry. Most banks already have a model inventory, independent validation, a three-lines-of-defense structure and examiners who know how to ask for evidence. That is an advantage: the governance muscle exists. It is also why pilots stall, because a large language model does not fit neatly into a validation process built for scorecards and regressions.

The hard questions are specific. How do you validate a model you did not train and cannot inspect? What counts as a material change when a vendor updates the model behind an API? How do you explain a decision assembled from retrieved documents, a prompt and a probabilistic output? Which conversations are business communications that must be retained?

The institutions that get AI into production answer these questions in the architecture, not in a policy document written afterward. Every model call is routed, logged and attributable. Every use case is tiered by risk before it is built. Evaluation evidence is produced continuously, so validation reviews a system, not a slide deck.

Where AI earns its place

Credit memo and underwriting assistance

Draft credit memos from financial statements, covenants and relationship history, with every figure linked to its source document. The underwriter stays the decision-maker, and the system records what the model produced, what the human changed and why.

Financial crime investigation support

Summarize alerts, assemble transaction timelines and draft suspicious activity narratives for investigator review. Retrieval spans case management, KYC files and prior investigations, with entitlements enforced so analysts only see what their role permits.

Policy, procedure and regulatory knowledge

A retrieval system over policies, procedures, regulatory guidance and interpretive memos that answers with citations and flags when a source is superseded. Useful for first-line staff, compliance advisory and audit, each with its own access scope.

Advisor and relationship manager copilots

Meeting preparation, call summaries and follow-up drafts for wealth advisors and commercial bankers. Outputs that reach clients pass through supervision and retention controls, so the copilot fits existing communications review rather than bypassing it.

Complaint and servicing triage

Classify complaints and servicing requests, detect potential regulatory issues such as fair lending or UDAAP concerns, and route cases with a draft response. Classification accuracy is measured against labeled samples and reported to the complaint management owner.

Engineering and operations productivity

Code assistance, test generation, runbook automation and incident summaries for technology teams. Lower model risk tier, faster approval, and often the quickest way to prove out the platform, gateway and logging before customer-facing use cases arrive.

The regulatory and operational constraints we design for

Financial institutions do not need a new governance regime for AI. They need AI architected so existing obligations can be met and evidenced. These are the constraints that shape our designs most often.

Model risk management (SR 11-7 and OCC guidance): The interagency supervisory guidance on model risk management expects inventory, independent validation, ongoing monitoring and effective challenge. We map generative AI and third-party foundation models into that framework, with risk tiering, evaluation suites and change triggers validation teams can actually use.
Fair lending and adverse action (ECOA and Regulation B): Where AI touches credit decisions, creditors must still give applicants specific and accurate reasons for adverse action, and the CFPB has said model complexity is no excuse. We keep decisioning explainable, test for disparate impact and separate assistive drafting from decision logic.
Customer data protection (GLBA): The Gramm-Leach-Bliley Act and its Safeguards Rule govern how nonpublic personal information is protected and shared. We design data flows so customer data reaches only approved model endpoints, under contracts that prohibit training on it, with masking where the use case allows.
Recordkeeping and supervision (SEC and FINRA): Broker-dealers and advisers must retain and supervise business communications, including under SEC Rule 17a-4 and FINRA's recordkeeping and communications rules. AI-drafted client communications and AI-assisted conversations need capture, retention and review built into the workflow, not added later.
Third-party and vendor risk: Interagency guidance on third-party risk management applies to model providers and AI vendors. We document dependencies, concentration risk, exit plans and data handling terms for each provider, and design the platform so a model can be swapped without rebuilding applications.
Operational resilience: Critical services cannot depend on a single model endpoint with no fallback. For institutions with EU operations, the Digital Operational Resilience Act (DORA) adds ICT third-party requirements. We design failover, degradation modes and capacity plans that resilience teams can test.

How we architect AI for financial institutions

Everything starts with a governed model gateway. Every application calls models through one layer that enforces approved models per risk tier, applies data loss prevention, attaches the user and use case identity, and writes an immutable log of prompts, retrieved sources and outputs. That single choke point is what makes model inventory, retention and incident investigation possible at scale.

Retrieval respects entitlements. Knowledge systems inherit access controls from source systems rather than flattening them into one shared index, so a teller assistant cannot surface a restricted investigation file. Documents carry lineage, effective dates and supersession, so answers cite current policy and auditors can trace any response to its sources.

Evaluation is treated as validation evidence. For each use case we define test sets, acceptance thresholds, bias checks where relevant, and monitoring that runs in production. When a provider changes a model version, the gateway pins versions and the evaluation suite re-runs before traffic moves, which gives model risk a defined change process instead of a surprise.

Finally, we separate assistive AI from decisioning. Generative models draft, summarize and retrieve. Decisions that carry fair lending, suitability or capital consequences stay in explainable, validated models or with accountable humans. That line, drawn clearly in the architecture, is usually what gets AI for financial services approved.

AI in financial services: common questions

How does SR 11-7 apply to generative AI and large language models?

SR 11-7 applies to generative AI when outputs inform business decisions, so most banks treat LLM use cases as models or model-like tools in their inventory. Validation shifts from inspecting training data to testing behavior: task-specific evaluation sets, hallucination and bias checks, prompt and retrieval review, and ongoing monitoring. Vendor model version changes should trigger re-evaluation before production traffic moves.

Can banks use public cloud AI services like Azure OpenAI or Amazon Bedrock?

Yes, many banks use Azure OpenAI, Amazon Bedrock and Google Vertex AI through enterprise agreements. The conditions are what matter: contractual terms that prohibit training on your data, regional data residency, private networking, encryption with keys you control where available, and third-party risk review of each provider. A gateway in front of all providers keeps controls consistent across them.

Can AI be used in credit decisions under fair lending rules?

AI can be used in credit decisions, but the creditor must still provide specific, accurate adverse action reasons and must test for disparate impact. In practice that means explainable decision models, documented feature choices, fair lending testing before and after launch, and a clear boundary between generative AI that assists underwriters and the models that actually decide.

Do AI-generated client communications need to be retained?

For broker-dealers and investment advisers, generally yes. If an AI tool drafts or sends business communications with clients, those records fall under existing retention and supervision obligations. The safest design captures the final communication and the AI draft in your archiving system, routes client-facing outputs through supervisory review, and blocks channels that cannot be captured.

What is the fastest safe first AI use case for a bank?

The fastest safe first use cases are usually internal and low risk tier: policy and procedure search with citations, engineering productivity, or operations summarization. They prove the gateway, logging, access control and evaluation process with limited customer impact. Once those controls pass model risk and audit review, higher-risk use cases reuse the same platform and move faster.

Other industries

In the capital region? We are based in Rockville, Maryland, and run architecture workshops in person. See enterprise AI consulting in Washington DC, Maryland and Virginia.

Bring us the architecture question you are stuck on.

Kelsey, our AI assistant, can answer questions and book you a 30-minute briefing with a senior architect in about two minutes, by voice or by typing.

Vendor-neutral advice. We resell nothing.
Senior architects on the call, not a sales team.
Mutual NDA available before we talk specifics.

Book with Kelsey

She finds a time that works, books it on our calendar and sends the invite. No forms.

By talking or chatting with Kelsey, you agree we may text and email you about your request. Message and data rates may apply. Reply STOP to opt out. Terms and Privacy.

Prefer a person? Call (301) 301-5765.