AI in finance: which controls to require

First to arrive, and regulated

Financial services is one of the fastest sectors to adopt AI in Latin America, and also the one under the most scrutiny. Regulators’ message is consistent: AI is not banned; it is audited. Back in 2021 the OECD identified the risks that concern supervisors most: decisions that are hard to explain, bias, handling of personal data and dependence on third parties (OECD, 2021).

For an agent to operate inside a financial institution, five verifiable controls are needed. Each one maps to a concrete design decision, not to a policy in a PDF.

1. Traceability: every action recorded

Supervised institutions already have to keep records of their operations and be able to reconstruct them in a review, for example under Colombia’s anti-money-laundering framework (SARLAFT). An agent that serves customers or decides within those processes inherits the same requirement.

In practice, every action the agent takes (answer sent, case escalated, document consulted, decision made) is recorded with three facts: who acted, what information was consulted and which rule was applied. That way, answering a supervisor’s request takes minutes, not weeks.

2. Explanation: why it answered that

An agent in finance must be able to explain every answer to the customer, to the internal team and to the supervisor. The most direct way is for it to answer only with what it can cite: every statement is traced to the document that supports it and, if there is no source, the agent says “I could not find that information” and hands the case to a person. That closes the door on the most serious risk in finance: an invented fact stated with confidence.

3. Bias: the newest model does not fix it

Bias in credit scoring and fraud prevention is a known risk. The EU AI Act, for example, classifies systems that assess people’s creditworthiness as high risk (EU, Regulation 2024/1689). The practical answer has three parts: testing before going live, monitoring behavior changes afterwards and human review of a sample of automated decisions.

4. Personal data: consent and limited use

In Colombia, Law 1581 of 2012 governs the processing of personal data, under the supervision of the Superintendence of Industry and Commerce. An agent that handles customer data must respect the data subject’s consent and use the data only for the authorized purpose. In the design that means:

• Separation by client. One company’s information never mixes with another’s.
• Encryption. Both in transit and at rest.
• Controlled retention. A record of which data the agent saw, when and under which consent.

5. Continuity: no single point of failure

If customer service depends on an agent, its failure is an operational problem. The answer: backup across models, an explicit handover to a person when something fails and regular continuity testing.

In operation

Financial credit unions are among the cases where results arrive fastest. At Cootradecun, 85% of requests are resolved without human intervention, with a record of every action the agent takes.

Five questions before going live

• Who answers for each decision the agent makes?
• How is a specific decision explained to a customer and to the supervisor?
• How is bias detected and corrected, and how often?
• What happens if the agent fails, and how long until a person takes the case?
• Where is the data, who saw it and how long is it kept?

All five answers live in the design, not in a policy. The action record answers the first, fourth and fifth; answers with sources, the second; testing and monitoring, the third.

The question is not whether your institution can use AI. It is whether it can defend before an auditor every answer the agent gave.

What comes next

The EU AI Act applies in stages from 2024 and reaches providers operating in Europe. In the region, Brazil is debating its own bill (PL 2338 of 2023) and Colombia is moving forward with its AI policy. Regulatory requirements will only rise, and retrofitting a system that is already built costs more than designing it right from the start.