Financial GenAI controls: data flow, access and audit evidence

Financial GenAI controls need to answer two questions: what the system did and what it was permitted to do. Citations, authorization and content quality are separate checks. A cited answer is not automatically suitable for external use.

This checklist helps engineering, security, compliance and internal audit teams document architecture and operating evidence. Establish task scope and applicable requirements before choosing controls; different institutions and uses may need different approvals.

Six control groups: retain checkable evidence

The FSC's June 20, 2024 AI guidance is non-binding administrative guidance using a risk-based approach. Applicable law, outsourcing and institutional approval requirements need separate assessment. This table does not establish universal board approval, consent or hosting rules.

Map logs and backups into the data flow

Document data, recipients and permissions from source systems through retrieval, model services, outputs and external tools. A model's processing location is only one part; include observability platforms, error records, annotation services and backups.

Supplier assessment can cover locations, terms, retention, training use, subprocessors, deletion and incident notification. Local deployment does not solve every risk, and location alone does not establish that every overseas service use is prohibited. Responsible teams decide based on data, purpose, requirements and contracts.

Keep incident evidence while limiting sensitive content. Depending on the task, use request identifiers, document versions and controlled evidence references. Where raw material needs retention, define access, redaction and duration separately.

Check authorization when retrieving or acting

Retrieval services need to know which documents the user may read; tools need to know which actions the request may perform. Enforce these checks in services. A prompt instructing the model not to disclose information cannot replace authorization.

OWASP's 2025 Prompt Injection guidance notes that external documents can affect behavior and RAG does not fully mitigate this risk. Restrict tool privileges and arrange approval for consequential actions according to risk.

An illustrative internal-policy assistant can be tested with unauthorized documents, embedded instructions, obsolete sources and questions lacking evidence. Check that rejected material does not reappear through citations, caches or logs. Assign exception handlers. One successful test does not establish safety for every future input.

Audit evidence is different from an identical rerun

Records can help reconstruct the data and configuration used, retained output, human revisions and actual actions. Calling the model again and getting identical text is a separate requirement.

Anthropic's January 9, 2026 evaluation guide distinguishes trials because model outputs vary between runs. Representative cases and repeated trials can help assess model or retrieval changes; acceptance criteria should reflect the task's risk.

Missing historical evidence cannot be recreated by adding a logging feature later. Future controls can still improve. Identify the evidence gap and activation date rather than claiming a complete historical reconstruction.

Verify ownership at handover

Walk through a source update, unauthorized-request refusal, human revision, incident report and suspension or takeover. Retain results, outstanding issues and owners, then let the appropriate approver decide readiness.

Scope monitoring and evaluation according to workload, risk and changes. Daily use indicates use; quality, applicable requirements and traceability need their own evidence.