AI in Finance

Financial workflows, consequences, and decision roles

A financial instrument is a contract creating a financial asset for one party and a liability or equity interest for another. Loans and bonds establish contractual obligations; shares represent equity interests. These distinctions matter because extracting a contract’s terms, explaining them, and exercising rights under it are different activities. The AASB definition supplies this foundational vocabulary. [1]

These are responsibilities, not universal job titles. An accountable owner decides whether the result is acceptable and who must resolve exceptions. A bounded institutional example is Morgan Stanley’s announced meeting assistant: it drafts an email for an advisor to edit and send, while another output enters a customer-record system. Drafting and sending remain distinct, and record writes need their own controls. [5]

Here, risk exposure means the nature and amount of potential loss associated with a position, obligation, or action. Incorrect research can influence a decision; a mistaken posting changes records; disclosure can harm a customer. Operational risk includes losses from failed processes, people, or systems. Scale, deadlines, detectability, and reversibility determine how far a small error can spread. [6]

Delegation can permit assistance, a prepared proposal, human-confirmed execution, or explicitly bounded automation. These levels should be assigned per operation. Accuracy and confidence do not grant permission to act. [7]

The meaning of a financial fact

A financial value needs an entity or instrument, measurement definition, currency, scale, sign convention, period, and source location. Assets are resources; liabilities are obligations; equity is the residual interest. A balance sheet describes a date. Revenue, expenses, and profit describe activity over a period; cash-flow statements describe cash movements. The SEC statement guide explains why profit and cash are different quantities. [8]

A ledger maintains financial account entries. In double-entry bookkeeping, total debits equal total credits. Providing a service on credit increases accounts receivable and revenue without receiving cash. Later collection increases cash and decreases the receivable; it does not record revenue again. Balanced entries can still use the wrong accounts, amounts, or dates. A counterparty is the other party to a financial transaction. [10][11]

Extraction must retain these qualifiers with the value. Evidence-bearing fields and records covers that representation boundary. A currency-free “1.23” cannot safely substitute for the fixture’s monetary fact. [9]

Availability, revisions, and as-of answers

An as-of answer uses an explicit information cutoff. The reporting period describes the underlying activity; publication makes a version available externally; permissions determine who may use it; ingestion determines when the application receives it. A figure about an earlier quarter can therefore be unavailable at a later decision date. Historical reconstruction must preserve these distinctions. [16][17]

A restatement corrects previously issued financial reporting. The IAS 8 overview explains retrospective correction of material prior-period errors. A later report can change an earlier period’s value without changing what was available for the original decision. [18]

Present-day historical data is not automatically historical evidence. FRED ordinarily returns today’s information, including revisions; vintage queries request an earlier information set. EDGAR calendar frames select a last-filed fact fitting the period. Neither an old observation date nor an old frame label establishes that the selected version was available then. [16][12]

First exclude versions unavailable at the cutoff, then select the applicable event and version. Event-time filtering alone can admit later backfills. A created timestamp is useful only if it represents actual availability and the retrieval implementation enforces that meaning. Preserve original versions, corrections, and transformation history; stale ingestion and unresolved source conflicts should remain visible. [17][19]

Permitted financial information

Access, permitted purpose, and disclosure authority are separate conditions. Entitlements specify which users and uses are permitted. Rights, restrictions and decision authority explains the general boundary. In financial applications, the permission to read information internally must not silently become permission to send it to a model provider or disclose it to a customer. [2]

Material nonpublic information is a legal category, not a synonym for confidential data. In the bounded U.S. SEC discussion, materiality concerns information important to a reasonable investor; nonpublic information has not been generally disseminated. Information barriers restrict passage between institutional functions. The applicable jurisdiction and activity determine the precise legal test. [20]

Public visibility does not establish AI-use permission. CME’s website market-data terms, for example, restrict covered data uses and expressly prohibit specified AI processing. These terms do not describe every exchange or separately negotiated license. [14]

The institution must establish the actual provider contract: permitted inputs and purposes, training use, retained copies, downstream processors, derived-output restrictions, and deletion arrangements. Vendor and model-processing obligations supplies the broader framework. FINRA’s notice makes clear that using third-party GenAI does not remove a member firm’s existing supervisory responsibilities. [2]

Research assistance with inspectable evidence

Grounding connects a claim to evidence that supports it. A citation enables inspection; it does not establish source quality or correct extraction. Applicable sources and unresolved disagreement and Claim support and resolvable citations explain the general mechanism. [21]

A constructed report comparison contains revenue of EUR 120 million and EUR 144 million. Assume the same entity, equal-length periods, consistent currency and scale, matching revenue definitions, and source versions appropriate to the question. These conditions make the arithmetic meaningful; selecting two numbers that happen to be labeled revenue is insufficient. [22][8]

Non-GAAP measures are adjusted measures outside the applicable standard accounting presentation. Similar labels can conceal different calculations, and changed adjustments can undermine comparisons across periods. The SEC’s interpretations describe these problems. If an adjustment definition changes, retain both definitions and qualify or withhold the comparison until a consistent basis is established. [24]

Assistance can move document search, extraction, and first-draft preparation into a reviewable pipeline. The analyst still checks applicability, definitions, calculations, and unresolved claims. Version extraction templates and compare results on representative documents. BlackRock’s described workflow gives domain experts a sandbox for that iteration; short, simple documents and complex instruments may require different extraction strategies. No time saving follows merely from introducing the sandbox. [25][26][27]

Reconciliation and unresolved discrepancies

Reconciliation compares separately maintained records to identify, explain, and resolve differences. A reconciliation break is an unresolved discrepancy. Connecting records can reveal inconsistencies that individual document checks miss; the useful output is an investigable case, not an automatic conclusion of fraud. [28][3]

Posting records an entry in the accounting system. Settlement means completion of the relevant cash or asset transfer. They are different completion boundaries: recording a receivable or another obligation does not establish that cash arrived. [10][11]

Differences can reflect timing, a bank fee, duplicate-looking records, a partial payment, or several internal entries corresponding to one statement amount. Those are investigation hypotheses. Matching totals alone cannot determine which explanation applies or whether an adjustment is needed. [29]

Rules are a concrete baseline. Dynamics can select the first qualifying transaction, with configurable manual handling for ambiguous amount matches. AI assistance should be tested against that process, especially where descriptions require interpretation. [30]

In Dynamics reconciliation, marking a bank-originated item new is not posting it. A reconciled statement can also carry unmatched items forward. Preserve case-level unresolved status. [29]

Customer assistance and accountable handoffs

Financial service begins with the customer’s actual problem. A generic policy explanation may leave an account-specific issue unresolved. The CFPB chatbot report describes failures involving inaccurate answers and inaccessible human assistance. Resolution and a usable service route must remain explicit outcomes. [4]

Pending means a transaction has not fully processed or posted; posted means it has been recorded on the account. A pending credit-card amount can change, for example when a restaurant tip is added. Processing depends on the parties and transaction type, so an assistant should preserve the observed status without inventing a completion date. [31]

Request meaning also matters. Within covered U.S. consumer electronic transfers, Regulation E’s interpretation distinguishes asking whether a transfer occurred from alleging an error. A lost access device accompanied by an allegation of possible unauthorized use can trigger error handling. These distinctions do not supply a universal rule for credit cards or every payment product. [32]

General product information, account-specific factual assistance, personalized recommendations, and transaction initiation need separate authority decisions. Identity and entitlement checks precede account access. When escalation is needed, provide the request, relevant evidence, proposed action, unresolved conflict, and likely consequences. A reviewer cannot meaningfully authorize an opaque operation merely because it ends with a confirmation button. [33][34]

A handoff transfers responsibility only when an empowered recipient accepts it. Keep an identified owner while acceptance is pending; preserve unresolved status after rejection or silence. Shared case context can support both a human interface and model input, but does not confer identical permissions. Accepted handoffs and responsibility develops that operating contract. [35]

Financial authority and institutional oversight

Authorization binds an action to its actor, account, recipient or instrument, amount, currency, operation, limits, and validity period. Preserve that binding through retries and callbacks. Changed material details require renewed approval, and current permissions must still allow execution. Approval, changing state, and retries explains the general mechanism. [36]

Maker-checker control separates preparation from independent approval where required. Segregation of duties more broadly separates conflicting responsibilities. Basel’s internal-control principles distinguish committing a bank, paying funds, and accounting for assets and liabilities. They call for appropriate delegation, approval limits, and control resources; they do not impose identical dual approval on every action. [37]

Enforce the final decision outside the model. A prompt instruction cannot substitute for a gate controlling actual system access and actions. [38]

EU payment dynamic linking supplies a bounded example: under its applicable authentication conditions, changing amount or payee invalidates the code. [39]

Model risk is potential harm from incorrect outputs or inappropriate model use. Effective challenge is qualified scrutiny with enough independence and influence to change a decision. Federal Reserve SR 26-2 describes these practices for its scope but expressly excludes generative and agentic AI. Applying them here is an engineering analogy, not a GenAI regulatory mandate. [40]

Oversight requires evidence access, expertise, review time, and authority to reject or suspend work. A second model does not automatically supply institutional independence. An escalation should explain the proposed action, the suspected constraint conflict, and its consequences; exhausted review capacity requires a narrower operating scope rather than nominal approval. [34][37]

Confirmed financial changes and uncertain outcomes

A system of record is the designated authoritative source for a business fact. Transaction status, account balance, and customer-case ownership may belong to different systems. Integration and confirmed effects connects their identifiers, field meanings, and required completion evidence. [41]

An approved adjustment can commit while its acknowledgment is lost. The figure assumes a receiver modeled on Stripe’s documented recovery behavior; it is not a claim about a particular ledger. [13]

Idempotency provides bounded protection against repeating an operation. Stripe retries reuse the same key and parameters; changed parameters produce an error. The stored response can include an HTTP 500. Keys may be pruned after at least 24 hours, and reuse after pruning starts a new request. Validation failures and concurrent execution conflicts need not create saved results. These limits prevent treating a key as permanent exactly-once processing. [42]

The receiving contract must specify status lookup, concurrent-version checks, accounting dates, batch cutoffs, and completion states. Preserve operation identity, attempts, and external evidence. If the available records cannot establish the effect, leave it unresolved rather than converting a timeout into a declared financial failure. [43]

Rolling back application code does not reverse a financial effect. Compensation is an explicit corrective operation, potentially requiring new authorization. A Saga can invoke compensations in reverse completion order when those operations exist; that pattern does not guarantee that every payment or posting is reversible, or that compensation itself succeeds. [44]

Reconstructable decisions and proportionate audit evidence

An audit trail is an attributable chronological record of relevant evidence, decisions, approvals, and effects. The SEC electronic-recordkeeping release illustrates reconstructable modifications and deletions within its specified broker-dealer and security-based-swap scope. A success message alone cannot recreate the original and intermediate records. [45]

Recorded rationale can help inspection without faithfully exposing internal model reasoning. Likewise, evidence available to a reviewer, evidence accessed, and evidence substantively reviewed are different claims. Missing links remain gaps; a generated explanation cannot repair them. [46]

Define necessary evidence, authorized readers, retention triggers, and disposal before logging. Protect integrity and retain correction history without indiscriminately copying personal data. Lineage and proportionate audit evidence explains the general design; financial record categories and applicable obligations determine actual retention. [47]

Evidence of completed work and consequential errors

Evaluate complete scenarios against the existing process. Coverage and independent assessment defines population and slice boundaries; finance adds workflow-specific outcomes and consequential errors. [48]

Separate error frequency from severity. Report abstentions, missing judgments, review workload, latency, and recovery alongside completion. A narrow average can conceal consequential failures or transferred human effort. [50]

Similar aggregate scores can conceal opposite weaknesses in arithmetic and methodology, as one private financial evaluation reported. A checked calculator can establish arithmetic without validating the selected inputs or analytical approach. Compare the same task population and preserve rubric-level results rather than selecting a model from one combined score. [49]

Human review also needs testing. A reported Duolingo experiment placed fabricated alerts into legitimate historical sessions and observed reviewers accepting some of them. It supports testing whether reviewers reject deliberately wrong evidence, not assuming that ordinary calibration scores guarantee resistance to automation bias. This is cross-domain evidence, not a financial error rate. [51]

Financial outcomes can arrive late and change status. A dispute may still await evidence or issuer review at the evaluation cutoff. Preserve payment time, observation time, reason, and evolving status. No observed dispute means none has been observed yet; it does not establish a legitimate payment. Label meaning and observation limits explains this boundary. [52]

A fraud-coded dispute records an allegation of unauthorized payment, which can include a legitimate charge the customer did not recognize. A reported dispute, adjudicated case outcome, and separately investigated fraud are different targets. Select the target that matches the service claim instead of silently substituting one for another. [53]

Historical validity and difficult operating conditions

Look-ahead bias uses information unavailable at the simulated decision time. Independent data boundaries explains leakage generally. A historical case should record its decision cutoff, permitted sources, source versions, and ingestion state. Selecting documents about earlier periods is insufficient when their values were published or revised afterward. [16]

Later knowledge can also reside in model parameters. Research on pretrained language models found later pandemic information appearing in analyses of pre-pandemic earnings calls. Instructions against using later information did not eliminate the demonstrated leakage, and masked identifiers could sometimes be inferred. Restricting retrieved documents therefore cannot independently certify historical validity. [54]

For a claim about future operation, move the evaluation origin forward and use only earlier information for each case. Preprocessing and model selection must respect that boundary too. Test new entities separately when the claim concerns them; legitimate prior customer history need not be removed when the intended task allows it. [55]

A multi-turn simulation must preserve state across calls: a payment cannot be simultaneously absent in one tool and posted in another without an explicit consistency condition. Scenario coverage should name workflows, institutions, customer groups, periods, and exception types. Constructed difficult cases reveal failure mechanisms; their selected frequency is not a production failure-rate estimate. [56][57]

Deployment scope and demonstrated value

Shadow operation runs beside the existing process without controlling its actions. Historical testing, shadow observation, restricted assistance, and separately approved expansion form a useful engineering progression. It is a proposed release design, not a universal banking requirement. [61]

Measure checking, queueing, integration, support, and customer outcomes across the combined workflow. Observed savings do not alone establish a deployment effect; Live evidence and causal improvement explains credible comparisons. [50]

Versioned prompt cohorts can expose regressions before wider release. Prewire agent-wide and per-tool stops, and record configuration changes. Acceptance and stop thresholds must fit the institution’s severity, workload, and review capacity; suggested rollout percentages are not universal evidence. [62][63][64]

Shared model and infrastructure providers create dependencies beyond local answer quality. The FSB identifies concentration, correlated behavior, cyber risk, and model risk as potential financial-stability channels. A locally useful assistant still needs a workable continuity plan; a provider switch requires evidence of compatible behavior rather than an assumption that another endpoint is interchangeable. [65]

Monitoring, correction, and authorized resumption

Operational records should connect the versions used to the actions taken. Protected references can separate sensitive evidence from general diagnostic events. Those references enable affected work to be located without granting every operator access to the underlying customer data. [66][67]

A stop control limits future execution at checked decision points; it does not undo completed effects or necessarily interrupt an executing tool. Continue observing in-flight work. Drill permanent controls, record who changed them, and alert on activation. Removing a temporary rollout flag is different from removing emergency shutdown capability. [63][64][71]

Contestability gives an affected person a route to challenge an outcome. Link the complaint to the original decision and evidence, then assign a reviewer authorized to inspect and correct it. Record the rationale, revised disposition, downstream correction status, and communicated result. NIST’s voluntary framework supports these practices; a trace alone supplies no correction path. [70]

Changes to sources, terms, permissions, model configurations, providers, or intended use can invalidate earlier acceptance evidence. Reassess the affected behavior, preserve manual continuity, and test recovery before restoring authority. Failure localization and competing explanations supports diagnosis; resumption remains an accountable operating decision. [57]

Open questions

1. 01

   AI assistance on ambiguous reconciliation cases still needs comparative evidence. Plausible explanations may increase checking work; progress requires matched cases showing fewer false matches or lower total review effort without hiding unresolved discrepancies. [30][74]

2. 02

   Historical LLM assessment remains difficult when later knowledge may reside in parameters. Clean document cutoffs cannot isolate that channel. Progress would include independently specified information boundaries and tests sensitive to leakage without assuming that every correct historical prediction is contaminated. [54]

3. 03

   Review capacity must preserve independent judgment under increasing throughput. Expertise alone may not prevent acceptance of misleading evidence. Progress requires measuring error rejection, review time, and queue pressure together, then establishing operating limits that maintain effective scrutiny. [51]

4. 04

   Recovery across receiving systems lacks a universal contract. Key retention, uncertain effects, and corrective operations vary, making generic retry logic dangerous. Progress requires receiver-specific interruption tests that demonstrate duplicate protection and separately authorized correction after the original outcome is resolved. [42][44]