Verified intelligence · Expert-reviewed from public records, platform data, primary sources, and private research beyond AI search.

AGENTSFinancial servicesGLOBAL

AI agents for financial services

Financial AI agents should be approved by write-path consequence: posting, payment, file, customer action, rollback, system-of-record context, audit evidence and control ownership.

The colophon

Landscape reviewed: 2026-05-31
Latest revision: 2026-06-17
Kinetics: Finance-agent risk now sits at the write path: ledger, spend, KYC and audit actions need route-level approval. ERP releases, Vals refreshes and AI guidance can change approval gates faster than finance teams finish pilots.
To watch: 23 June 2026: European Commission high-risk AI consultation closes; credit and insurance agent gates may move ¹⁰⁰.
2 August 2026: AI Act transparency obligations apply; EU customer-facing agents need disclosure evidence ¹⁰³.
Known unknowns: Independent finance-agent benchmarks linking real ERP permissions, linked spreadsheets, filings, source data, payment gates, workflow rubrics, reviewer baselines, audit evidence, and cost per accepted output.

Contents

Executive summary
Decision frame
Provider landscape
Workflow approval
Agent action risk
Private evals
Ledger data and source control
Financial files and spreadsheets
Evals, benchmarks and ROI
Deployment and contract risk
Controls and regulation
Cross-border controls
Regulatory-political risk
Implementation plan
Operational-exhaust diligence
Implementation cases
Expert watchlist
Vendor directory
Known unknowns
Source ledger
Glossary

▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒Executive summary

Finance agents win when write paths are controlled and exportable. Financial AI agents are useful when they make finance work more reviewable, not when they make it look effortless. The market has crossed a line. Public finance-agent evidence now spans close and reconciliation work, invoice coding and AP automation, KYC and financial-services templates, audit evidence workflows, ERP productivity contexts and payment paths. That is enough capability to save real time and enough permission to cause real damage.

The selection rule is simple: approve the route, not the logo. For each use case, name the sources, system writes, approval gate, audit evidence, fallback owner and private eval. A provider can be approved for variance analysis, conditional for journal preparation and blocked for payment release.

Finance teams should buy mature workflows where vendor source context and audit UX are hard to replicate. They should build or tightly configure where the playbook, data lineage, model-risk posture, customer duty or sovereignty requirement is the advantage.

Corporate finance operations and regulated financial services need different controls. Close, AP, treasury and audit are ledger-control problems. Banking, insurance, asset management, KYC, credit, market research and customer advice add conduct, market, capital, fraud and model-risk obligations.

Treat any agent that can post, pay, approve, submit, file, message a customer, alter a workbook formula, or update a risk decision as a controlled actor with a scoped identity, not as a chat feature.

Related report

AI models for financial services

Use this alongside model routing, financial RAG, embeddings, OCR, model-risk controls, benchmarks, deployment routes and cost per accepted financial output.

Financial agent approval tree

Classify the action before approving the provider. The gate follows the financial consequence.

Is the agent reading approved sources without changing records?
Yes
Allow with source logs, user permissions and no-answer behaviour.
No
Screen for draft or write-path risk.
Next: Q2 draft
Will it draft workpapers, memos, models, reconciliations, journal entries or approvals?
Yes
Allow as proposed work with source links, diffs, formulas visible and reviewer assignment.
No
Screen for record mutation.
Next: Q3 write
Can it post, pay, approve, file, submit, message customers or change formulas?
Yes
Require explicit human approval, segregation-of-duties checks and rollback plan.
No
Run as a monitored workflow with sampling and regression evals.
Could the output affect credit, KYC, investor, customer, regulatory or market decisions?
Yes
Add model-risk, conduct, customer-outcome, audit and regulator-facing evidence.
No
Keep audit logs and measure accepted output.

A finance agent can be harmless as a reader and dangerous as a writer. The route should record which one it is.

The operating decision

Decision	Status	View
Buy versus build	Route	Buy mature finance workflows where ERP integration, controls and reviewer UX matter; build where data, policy, client duty or regulatory route is proprietary.
Action autonomy	Gate	Read, analyse and draft by default. Gate posting, payment, approval, filing, customer messaging, credit and KYC decisions.
Audit evidence	Require	Every output needs source, data timestamp, policy version, tool call, reviewer, decision, and exception trail.
Benchmarks	Localise	Use public finance benchmarks to find coverage gaps; use private evals to approve production routes.
Regulated services	Prove	Banking, securities, insurance and credit workflows need model-risk, operational-resilience, conduct and customer-impact evidence before scale.

Financial AI providers sell different pieces of a controlled work system. The finance market is not one market. It is a stack of systems that touch facts, money, records, customers and regulators. The model layer is becoming easier to swap. The source and control layers are not. An agent that knows the wrong entity, wrong fiscal period, wrong ledger account, wrong policy version or wrong approval path can be fluent and still unusable.

Provider selection should therefore start with the work system. Which layer does the provider own? Which layer does it borrow? Which layer does the buyer still have to build, audit and support?

This turns the shortlist from a brand argument into an operating choice: ERP-native agent, finance-ops platform, spend network, treasury or planning workflow, audit and controls layer, model-lab template, or cloud-built custom agent.

A useful finance route has seven named objects: work to perform, source universe, data boundary, allowed tools, write permissions, approval gate, and evidence export. Missing any one leaves approval without the evidence needed for audit, rollback or incident review.

Cloud and model-provider routes deserve separate approval from embedded SaaS routes. The same base model can have different retention, logging, region, service-credit, subprocessor and tool-execution terms depending on the route ³³³⁴.

Provider layer map

Layer	Controls	Advantaged routes	Buyer read
Model and agent runtime	LLMs, agent loops, tool calling, subagents, credential vaults, sandboxes, logs, and enterprise data controls.	Model labs, cloud platforms, and internal platform teams.	Necessary for capability; not enough for finance approval.
System of record	ERP, GL, subledgers, bank feeds, payment rails, procure-to-pay systems, CRM, warehouse, market data, and filing repositories.	ERP incumbents, finance platforms, banks, market-data providers, and firms with clean internal data.	Correctness begins here.
Workflow	Close, reconciliation, AP, AR, collections, expense, procurement, treasury, FP&A, audit, KYC, credit, research, and client coverage.	Vertical SaaS providers and internal product teams close to the finance job.	This is where ROI and adoption show up.
Governance and assurance	Permissions, segregation of duties, policy versions, evals, audit logs, approvals, rollback, monitoring, vendor risk, and regulator evidence.	Finance platforms built with controls, GRC systems, risk teams, and assurance-ready operators.	This is where production becomes defensible.

Approve the route at the layer where the buyer's risk lives.

Minimum write-path register

Field	Question	Failure it blocks
Work	What exact finance job may the agent perform?	A broad assistant quietly becomes a payments, postings or advice system.
Sources	Which systems, files, periods, entities and market data may it use?	Wrong fiscal period, wrong source hierarchy, stale data or unauthorised file access.
Tools	Which tools may it call and with whose credentials?	Unscoped service accounts, leaked permissions or hidden write paths.
Writes	Can it mutate records, formulas, approvals, payments, tickets or communications?	A draft workflow becomes a record-of-fact workflow.
Gate	Who approves the result before it matters?	Segregation of duties collapses into a single automated step.
Evidence	What audit artefact is exported?	The team cannot explain how the number, payment, model or decision was produced.
Owner	Who owns the workflow, source data, approval and exception path?	Finance, risk, IT and vendor teams can each deny responsibility after a bad action.
Fallback	What happens when the model, data source, connector or provider fails?	Close, payment, risk or reporting workflows halt without a manual path.
Private eval	Which recent local cases prove the route can perform under the buyer's data, policy and reviewer constraints?	A demo passes while production work fails on entity, period, approval or exception detail.

The useful shortlist depends on the finance lane. A provider's category matters because finance agents inherit the risks of the system they touch. ERP-native agents are close to the ledger but can be constrained by release cycles and product scope. Finance-operation platforms own the close, reconciliation, AP or AR workflow and may be faster to adopt. Spend networks own invoice, card, vendor and payment context. Audit and GRC tools own evidence and control workflows. Model labs and clouds offer flexible agent infrastructure but leave more finance-specific design to the buyer.

The wrong purchase happens when those layers are collapsed. A model lab can be excellent for financial research and weak for AP controls. An AP network can be excellent for invoice coding and inappropriate for credit decisioning. A GRC system can improve evidence and still leave source data messy.

Use provider names as examples, not as a universal ranking. Public claims differ in metric, scope, date, customer mix and validation method.

The practical buyer test is whether the provider can show the work: source document, ledger line, policy rule, tool call, approval, exception and final record.

What providers actually sell

Lane	Examples	Buy when	Proof to request	Residual risk
ERP and productivity incumbents	Oracle, Microsoft, Workday, SAP.	The agent must respect ERP data, security, entity structure, Excel work, and existing finance adoption.	Show write-path controls, role permissions, approval logs, formula handling and release-roadmap stability.	Workflow coverage, connector gaps, release timing and local configuration burden.
Record-to-report and close platforms	BlackLine, FloQast, HighRadius, Numeric, Ledge, Trintech.	The pain is close, reconciliation, intercompany, journal entries, reporting, and audit readiness.	Run a close-period bake-off on real reconciliations, workpapers, journal entries, exceptions and evidence export.	ERP edge cases, spreadsheet state, custom policies and overclaiming autonomous close coverage.
AP, spend, procurement and payment networks	Ramp, Brex, Tipalti, BILL, Stampli, AppZen, Coupa.	The pain is invoice capture, coding, PO matching, approvals, expenses, vendor risk or payment workflow.	Test real invoices, duplicate detection, fraud flags, approval routing, payment holds and audit trail.	Money movement, vendor identity, false approval, policy drift and payment-rail dependency.
Treasury, FP&A and planning	Kyriba, Anaplan, Pigment, Planful, Datarails.	The pain is cash visibility, forecasting, liquidity, scenario analysis or board reporting.	Compare forecast variance, source refresh, scenario assumptions, owner overrides and treasury sign-off.	Forecast confidence without data lineage or stress-case explanation.
Audit, GRC and oversight	DataSnipper, MindBridge, Optro, Workiva, AuditBoard legacy modules.	The pain is evidence collection, controls testing, anomaly detection, audit workpapers or assurance over AI-driven finance.	Show source-to-finding trace, control version, sample population, reviewer note and exportable workpaper.	Audit tooling cannot fix a bad source system or unclear control owner.
Model labs and cloud control planes	Anthropic, OpenAI, AWS, Google Cloud.	The buyer needs custom agents, market-data connectors, secure runtime, model routing or internal platform control.	Show retention, region, logging, tool permissions, connector governance, benchmark fit and fallback routing.	Finance-specific workflow, controls and adoption remain buyer responsibilities.

When to buy or build

Situation	Better route	Reason
Common finance workflow with mature vendor UX.	Buy or partner.	Close, AP, spend, audit evidence and treasury workflows already have product-specific controls.
ERP write path is central.	Prefer ERP-native or deeply certified integration.	Permission, entity, period and audit context sit inside the system of record.
Proprietary playbook, market data or client workflow is the advantage.	Build the workflow layer and route models behind it.	The differentiator is source meaning and judgement, not base-model access.
Regulated financial-services use affects customers or markets.	Use a controlled platform route with model-risk and conduct evidence.	Approval must satisfy regulator-facing evidence, not only productivity metrics.
Switchability matters.	Negotiate exportable prompts, templates, route logs, eval datasets and source mappings.	A finance-agent lock-in problem becomes visible at audit, renewal or incident time.

Finance-agent policy should be written around actions, not personas. The same agent pattern becomes safer or riskier depending on what it can change. Approve read-only analysis with source logs. Treat draft work as proposed work. Gate anything that posts, pays, approves, files, submits, messages a customer, changes a formula or mutates a financial record.

Segregation of duties is the main design constraint. The agent may prepare the entry, but the approval path must still prove who reviewed it, which evidence they saw, what changed, and whether a conflicting role was blocked.

For regulated services, the test broadens again. KYC, AML, credit, insurance, investor communications, market research and trading-adjacent workflows need customer, conduct, model-risk, fraud and market-abuse controls.

Set the forced handoff point explicitly: before posting, before payment release, before external send, before customer impact, before regulatory submission, and before model output enters a risk decision.

The default error budget for money movement should be zero unapproved movement, not low average error.

Gate by workflow consequence

Workflow	Default route	Gate	Acceptance test
Variance analysis and board-pack narrative	Read and draft.	Finance owner review.	Narrative ties to reconciled source tables, assumptions and period definitions.
Close checklist and reconciliation prep	Draft and propose.	Controller approval before posting or sign-off.	Agent output includes workpaper, support, exception list and reviewer notes.
Journal-entry preparation	Stage only.	Segregated human approval before posting.	Entry, account, entity, period, evidence and policy version are visible before approval.
Invoice coding and PO matching	Propose or auto-code below risk thresholds.	Exception and high-value approval path.	Duplicate, fraud, tax, vendor and PO discrepancies are caught on real invoices.
Payment scheduling or release	Human gate.	Explicit approval, bank-control alignment and rollback.	No payment moves without approver, payee, amount, source account and supporting invoice evidence.
KYC, AML or sanctions escalation	Package evidence.	Compliance review and escalation trail.	Entity identity, source documents, watchlist basis, adverse-media evidence and reviewer decision are retained.
Credit, insurance or customer decision	Decision-support only.	Model-risk and customer-outcome approval.	Decision basis, adverse-action evidence, bias checks, override reason and model version are exportable.
Investment research and pitchbook work	Draft and model.	Analyst and compliance review before client use.	Filing sources, market data, assumptions, formulas and deck updates remain linked.

Read, write and release are different risks

Read

Draft

Stage write

Execute

Close and reconciliationsReconciliations and workpapers are useful agent targets because review is already part of the workflow.

AllowSource inspection and variance triage.

AllowDraft tie-outs and workpapers.

GateJournal entries staged only.

BlockNo unapproved posting.

AP and spendThe risk rises sharply when the workflow can approve spend or release money.

AllowInvoice and policy lookup.

AllowCoding and approval recommendations.

GatePayment staged with payee and amount.

BlockNo autonomous payment release.

Financial servicesCustomer, market and capital impact require more than ordinary finance controls.

AllowResearch and source assembly.

GateCredit memo, KYC package or pitch draft.

BlockDecision staged only with evidence.

BlockNo final customer or market action.

AllowGateBlock

Write paths carry the risk. Finance agents become dangerous when a draft path quietly becomes an execution path. The control problem changes as soon as the agent can call tools. Tool use can read records, change records, stage payments, update models, move files, create tasks, send messages, or mutate workbooks. That is not the same risk as a finance chatbot answering a question.

FINRA's 2026 GenAI material is useful because it asks a practical agent question: how does the firm limit or restrict agent behaviours, actions, or decisions ⁴⁶? The same question belongs in every controller, treasurer, compliance, audit, FP&A and banking approval.

The right default is reader-writer separation. An agent may inspect untrusted invoices, filings and emails. It should not convert those instructions into tool calls without a mediated action menu, parameter validation and a reviewer-controlled write path.

Excessive agency is not only a security problem. In finance it can become a balance-sheet problem, a customer-harm problem or a regulatory-record problem.

The action taxonomy should be implemented in product configuration, identity and logs, not only in policy language.

What finance agents may do

Capability	Default rule	Audit requirement
Read approved source systems	Allow within role, entity and period scope.	Log user, route, source, record, query, timestamp and model.
Draft narrative or analysis	Allow with source support and uncertainty flags.	Retain sources, assumptions, output, reviewer and accepted version.
Prepare reconciliation or workpaper	Stage for review.	Retain population, sample, exceptions, support and reviewer decision.
Prepare journal entry or model update	Stage only.	Show account, entity, period, policy, formula diff, approver and rollback path.
Recommend approval, payment or customer action	Human approval mandatory.	Record decision payload, evidence, approver, SoD check and final action.
Post, pay, file, submit, message customer or change permissions	No autonomous execution for high-impact routes.	Matter-level or process-level approval trail, service identity, rollback and incident channel.

Where finance autonomy breaks

Failure	Example	Control
Tool misuse	Wrong ERP company code, bank account, tax jurisdiction or source table.	Tool scoping, parameter preview and allowlisted systems.
Silent write path	A draft journal entry is posted because the connector inherits user permission.	Separate reader and writer identities; require write approval.
Payment overreach	Invoice is coded, approved and scheduled without independent payee review.	Payment hold, vendor verification and segregated approval.
Formula mutation	Agent changes a workbook formula while explaining a variance.	Formula diff, workbook versioning and reviewer acceptance.
Partial completion	Agent reviews 80 invoices and treats the batch as complete.	Coverage report, stop condition and exception queue.
Prompt injection	Invoice text instructs the agent to bypass policy or change payment details.	Untrusted-content isolation, dispatcher-mediated tools and adversarial evals.
Customer impact	Credit, KYC or fraud output is acted on without review.	Decision-support lane, human review and adverse-action evidence.
Loop or cost blowout	Agent keeps querying filings or ERP tables without reaching a stopping condition.	Step budgets, timeout, escalation and audit of failed loops.

Who answers for what

Actor	Best placed to control	Expected evidence
Model provider	Base model behaviour, update notices, data controls, safety properties and known failure modes.	Model card, privacy terms, evals, lifecycle notice and incident channel.
Cloud or agent platform	Runtime isolation, credentials, logging, tool permissions, network boundaries and observability.	Architecture, permission model, retention settings, audit export and resilience evidence.
Finance SaaS provider	Workflow design, ERP integrations, financial controls, evidence export and role-based approvals.	Route documentation, write-path controls, customer evidence and audit trail.
System integrator	Connector configuration, identity mapping, data transformation and production handoff.	Configuration record, test evidence, rollback plan and support model.
Finance deployer	Use-case scope, policy thresholds, reviewer assignment, route approval and process ownership.	Route register, private eval, owner, approval log and incident process.
End user	Instruction quality, exception escalation and acceptance of proposed output.	Training, user acknowledgement, reviewer note and rejected-output trail.
Auditor or risk reviewer	Independent challenge, sample testing and control design review.	Review memo, sample population, deficiencies and management response.

A finance agent crosses too many boundaries for responsibility to sit in a single vendor disclaimer.

The private eval is the production approval test. Public benchmarks show slices of capability. Private evals decide whether the write path can touch the books. A private finance eval is a controlled work sample with source systems, documents, expected outputs, reviewer rubrics, failure categories, approval gates and replayable logs.

The eval set should include the cases that create audit findings: broken workbook links, duplicate vendors, stale filings, missing PO support, ambiguous KYC evidence, policy exceptions, late close entries, unusual currencies, manual journals and source-system outages.

Morgan Stanley's eval-driven deployment is the reusable pattern: regression tests, retrieval-method tuning, advisor review and zero data retention as part of trust building ⁵¹⁵¹.

Finance evals need three scores beside accuracy: evidence quality, reviewer burden and action safety.

The private eval should be versioned with the route. If the model, connector, policy, source or approval path changes, the eval result is stale.

The private test set

Eval	Size	Purpose
Close and reconciliation eval	Representative recurring, exception and manual-entry close work.	Test source lineage, exception handling, journal staging and reviewer acceptance.
AP and payment eval	Representative invoice, vendor, duplicate, fraud-flag and payment-hold cases.	Test coding, matching, duplicate detection, fraud flags, approval routing and payment holds.
Spreadsheet mutation eval	Representative linked workbooks with formulas, hidden sheets and scenario cells.	Test formulas, hidden sheets, named ranges, links, scenario cells and version diffs.
Filing and market-data eval	Representative research questions across filings, licences and freshness states.	Test SEC filing retrieval, data licences, assumptions, source freshness and model updates.
KYC and customer-impact eval	Representative normal, ambiguous, escalated and adverse-action cases.	Test identity evidence, sanctions/adverse-media basis, escalation and adverse-action records.
Agent safety eval	Representative workflows with tool use, permission edges and rollback paths.	Test tool calls, permission leaks, prompt injection, partial completion and rollback.

Failure categories to score

Failure	Score as	Route effect
Unsupported number or conclusion	Evidence failure.	Block final output; allow only draft with citation gaps.
Wrong entity, period, account, filing or customer	Source failure.	Restrict source path and add metadata filters.
Changed record without approval	Action failure.	Block write path until identity and approval controls are fixed.
Missed exception or partial completion	Coverage failure.	Require coverage reporting and exception queue before production.
Prompt injection or unsafe tool call	Security failure.	Require architecture change, not prompt tuning.
Reviewer spends more time checking than doing	ROI failure.	Do not scale; re-scope or change provider route.

Bad source context makes a good model expensive. Financial truth is not stored as prose. It is spread across ledgers, subledgers, bank feeds, invoices, approval systems, workbooks, filings and market-data contracts. An agent can only be as reliable as the data path it sees. In finance, the route needs entity, period, account, currency, source system, policy version, approval state, materiality threshold and refresh timing.

The hardest cases are not glamorous. Linked spreadsheets, hidden tabs, copied formulas, stale exchange rates, manual journal entries, partial bank feeds, duplicate vendors and inconsistent dimensions can all make a fluent answer wrong.

FinRetrieval's finding that tool availability can dominate retrieval performance is a useful warning ²⁷. For finance agents, the difference between a structured data API and web search is not convenience. It is the difference between a source path and a rumour route.

RAG is not enough by itself. Retrieval must preserve the financial semantics of the source. A filing paragraph, a GL line, an invoice image, a bank statement, and a workbook formula need different provenance.

Treat the missing source as a finding. A close agent should say when a schedule, supporting document, account mapping, approval, bank feed or source filing is absent.

Financial source hierarchy

Source	Agent requirement	Failure to block
ERP and general ledger	Entity, account, period, currency, close status, role permissions and posting rules.	Wrong period, wrong entity, unauthorised write or unsupported journal.
Subledgers and AP/AR systems	Invoice, vendor, PO, receipt, payment, collection and dispute links.	Duplicate payment, poor cash application, stale collection action or false match.
Bank and treasury feeds	Source bank, account, value date, FX rate, sweep logic, liquidity assumption and cut-off.	Bad cash forecast, unmatched transaction or liquidity surprise.
Spreadsheets	Workbook lineage, formula graph, hidden sheets, links, named ranges and version history.	Formula mutation, broken link or unmanaged manual adjustment.
Filings and market data	Filing date, issuer identity, data licence, provider timestamp, calculation convention and refresh SLA.	Stale model, wrong comparable, bad credit memo or unsupported pitchbook.
Policies and controls	Policy version, materiality threshold, approval matrix, control owner and effective date.	Correct number processed under the wrong rule.

From source to finance output

Source universe

The agent starts with more material than it can safely use.

ERP, GL, invoices, bank feeds, workbooks, filings, market data and policy documents.

GL account 6100, April closeAuthoritative but needs entity and period status.
Old board-pack workbookUseful context, not a source of truth.
Unlinked PDF invoiceNeeds vendor and PO match.
Broker note excerptMay be licensed and stale.

Retrieved

Candidate evidence appears.

Search, connectors, APIs and workbook parsers.

GL line and supportMatches period and entity.
Prior-year formulaRetrieved but not current.
Invoice imageOCR reads amount but needs PO match.
Market-data tableRequires licence and timestamp.

Ranked and checked

Finance semantics beat textual similarity.

Entity, period, materiality, policy, formula and licence checks.

Current GL supportIncluded in workpaper.
Prior-year formulaKept as reference only.
Invoice without PO matchException queue.
Licensed market dataIncluded if permitted for this route.

Accepted output

The output is only finance-grade if the evidence survives review.

Workpaper, journal proposal, forecast note, model update, or risk memo.

Draft reconciliationCites GL line, source support and exception.
Journal entryStaged, not posted.
Missing PO supportShown as an exception.
Reviewer decisionRetained with approval or rejection.

Context quality beats context size. Finance work needs source meaning, not just more text.

Finance files are evidence, not attachments. The file layer is where finance agents often lose the case before the model starts reasoning. Invoices, bank statements, board packs, SEC filings, market-data exports, ERP screenshots and workbooks carry different meanings. Treating all of them as text strips away the controls: formulas, hidden sheets, named ranges, approval state, data licence, timestamp, currency, entity, period and source owner.

Spreadsheet agents deserve special suspicion. Pista's research is useful because it decomposes spreadsheet execution into auditable and controllable actions ²⁹. For finance, every model edit needs to be visible, reversible and approved.

SEC filings belong in a source-authoritative EDGAR lane rather than general web retrieval ⁸¹. Moody's and S&P Global data paths carry licensed source hierarchy and analyst-review constraints ⁷⁰⁷¹. FactSet adds the financial-data terminal and workflow-embedded assistant lane ⁷².

A parser failure in finance is not only OCR failure. It can be a row/column relationship lost, a subtotal misread, a workbook link broken, an approval watermark ignored, or a licence restricted field moved into an unauthorised output.

The eval should start with the ugliest files: scanned invoices, multi-entity workbooks, exported bank files, late adjusting entries, disclosure tables, debt schedules and marked-up board decks.

Parse the awkward files first

File	Required output	Fatal error
Linked close workbook	Formula graph, hidden tabs, named ranges, external links, manual overrides and version history.	Formula changed or hidden tab ignored.
Scanned invoice packet	Vendor, PO, receipt, tax, currency, payment terms, bank details and duplicate signal.	Payment details accepted from untrusted invoice text.
Bank statement export	Account, value date, transaction ID, currency, counterparty, fee and reconciliation status.	Unmatched item treated as resolved.
SEC filing	Issuer, filing type, period, exhibit, table, footnote and source link.	Stale filing or wrong issuer used in a model.
Board or investor deck	Slide source, underlying table, chart data, update date and approved owner.	Chart narrative updated without source data.
Audit evidence packet	Population, sample, control, evidence, preparer, reviewer, exception and sign-off.	Evidence collected without preserving population and reviewer trail.

Spreadsheet-agent controls

Control	Requirement	Why
Diff before save	Show formulas, values, links, named ranges and hidden-sheet changes.	Finance users need to approve the exact mutation, not the model's summary of it.
Cell lineage	Trace output cells to source cells, filings, ERP lines or market data.	A model can be arithmetically correct and source-wrong.
Workbook quarantine	Run on a copy until approval.	A spreadsheet is often the system of record in practice, even when everyone denies it.
Scenario boundary	Separate forecast assumptions from historical actuals.	Agents should not let a forecast overwrite the books.
Licence check	Prevent restricted market data from entering unauthorised decks or prompts.	Source rights are part of financial control.
Reviewer note	Retain who accepted or rejected each material change.	Audit trails need human judgement, not only model telemetry.

Measure accepted work, not agent theatre. A finance-agent benchmark is a failure probe, not a production approval. Public benchmarks are improving quickly. Vals' benchmark page showed a Finance Agent v2 snapshot updated on May 22, 2026 ²⁵²⁵. Anthropic's Opus 4.8 launch then put Opus 4.8 at 53.9% on Finance Agent v2, above the 4.7 row ¹⁰⁵. Rogo's BigFinanceBench pushed the benchmark shape toward workflow-grounded rubric scoring and model routing rather than final-answer accuracy alone ¹⁰⁴. Benchmark claims age faster than procurement committees.

Use public benchmarks to design private evals. A finance eval should include the firm's own ERP extracts, linked workbooks, policies, close calendar, filings, market-data permissions, approval gates and reviewer rubrics.

ROI should be measured at accepted output: closed reconciliation, approved journal, paid invoice, resolved exception, reviewed KYC package, corrected model, accepted audit evidence or reduced reviewer minutes. Prompt volume and seat activation are weak substitutes.

KPMG's 2026 survey is useful because it ties AI scaling to assurance readiness, error reduction, confidence and evidence production ¹². That maps to the correct finance question: can the team explain the work after the agent has sped it up?

A private eval should intentionally include messy cases: duplicate vendors, scanned invoices, unusual currencies, material manual journals, broken spreadsheet links, stale market data, policy exceptions, adverse-media ambiguity and close-calendar pressure.

The grid below turns each public benchmark into a private proof burden: which source, tool, workbook, approval or reviewer failure should enter the buyer's eval pack.

Published finance-agent rows are only candidate-route evidence

Vals Finance Agent

Proprietary industry benchmark for core financial analyst tasks; public snapshots now include Anthropic's Opus 4.8 launch table ²⁵¹⁰⁵.

1Gemini 3.5 Flash57.9% ¹⁰⁵
Anthropic launch-table footnote.
2Claude Opus 4.853.9% ¹⁰⁵
Anthropic launch-table snapshot.
3GPT 5.551.8% ¹⁰⁵
Anthropic launch-table snapshot.

Anthropic launch table and Vals AI

Rows are published model results on one finance-agent benchmark snapshot. They do not approve ERP, close, AP, treasury, audit or customer-facing finance routes.

Benchmark coverage becomes private proof burden

Source	Public signal	Private eval to add
BigFinanceBench	928 questions, 15,656 rubric criteria and 36,241 weighted points across ten frontier systems; workflow x source routing adds 4.5 pp ¹⁰⁴.	Use the rubric scale to design private workflow, source-type and review-gate coverage.
Vals finance-agent dataset	SEC-filings research problems requiring analysis with recent filings ²⁶.	Add ERP writes, payments, controls, customer decisions, stale filings and source-entitlement tests.
FinRetrieval	Financial retrieval questions with ground-truth answers and tool-call traces ²⁷.	Test connector routing, data-source permissions, retrieval confidence and no-answer behaviour.
BankerToolBench	End-to-end analytical workflows scored against investment-banker rubrics ²⁸.	Test pitchbook, model-building, data-room and reviewer-acceptance routes.
Pista	Auditable, controllable spreadsheet-agent actions ²⁹.	Test spreadsheet mutation controls, cell provenance, rollback and reviewer approval.

Measure the completed finance job

Workflow	Weak metric	Better metric
Close and reconciliation	Tasks touched by AI.	Accepted reconciliations, exceptions resolved, reviewer minutes, rework rate, and audit findings.
AP and spend	Invoices scanned.	Correct coding, duplicate catch rate, fraud flag precision, approval cycle time, and payment exceptions.
Treasury and forecasting	Forecasts generated.	Forecast variance, freshness SLA, scenario accuracy, override rationale, and cash-decision quality.
Audit and controls	Evidence collected.	Control population coverage, valid samples, source traceability, reviewer sign-off, and retained workpapers.
Financial research	Pages summarized.	Source-supported model update, formula correctness, assumption trace and analyst acceptance.
Regulated decisions	Cases processed.	Policy adherence, adverse-action evidence, bias/error checks, escalation quality and customer-outcome review.

A finance agent's contract is part of the system. The same workflow can have a different risk profile depending on where it runs and who operates the write path. A direct model API, a cloud-hosted model, an ERP-embedded agent, a finance SaaS feature and an internally built platform may all use a similar base model. They do not have the same retention, logging, incident, subprocessor, audit-export, service-credit, region, data-residency, tool-permission or exit terms.

That matters because finance agents are often third-party-risk objects before they are productivity tools. DORA makes ICT dependency visible for EU financial entities ⁴¹. The FSB warns that AI adoption can amplify third-party, concentration, cyber and model-risk vulnerabilities ⁴⁴.

Contract diligence should be route-specific. A variance narrative over de-identified internal data is not the same contract as a payment agent with bank access or a KYC agent processing customer documents.

The contract should name the data boundary, audit evidence, incident notice, model-update notice, subprocessor chain, support response, exit artefacts and restrictions on provider training or human review.

A cloud marketplace listing or enterprise MSA is not enough if the production write path depends on a connector, plugin, service account, workflow automation layer or third-party data provider.

Write path changes the contract question

Route	Use when	Contract question	Watch
Finance SaaS embedded agent	Close, AP, spend, audit or planning workflow is already in the product.	Can the vendor export source, action, reviewer and approval evidence?	Opaque model route, weak write-path logs and locked-in workpapers.
ERP-native agent	The agent must respect ERP roles, entities, periods and write controls.	How are service identities, SoD conflicts, approvals and rollback handled?	Release cadence and configuration complexity.
Cloud model platform	The buyer wants custom agents with enterprise security and managed infrastructure.	Which data, region, logging, incident, model and tool terms apply?	Buyer owns finance workflow and evidence design.
Direct model API	The team has platform engineering, evals and controls maturity.	What retention, training, abuse monitoring, enterprise privacy and update terms apply?	Missing finance controls, support path and fallback route.
Self-built or self-hosted route	Sovereignty, IP, latency, data segregation or custom workflow is the advantage.	Who patches, monitors, validates, secures and supports the stack?	Idle infrastructure, weak observability and hidden maintenance cost.
Data-provider assistant	Licensed market, credit, ratings or filings data is the core source.	Can outputs preserve data licence, source hierarchy and downstream-use restrictions?	Unauthorised redistribution and stale-source use.

Minimum contract artefacts

Artefact	Must name	Why
Data-use schedule	Training use, retention, human review, region, subprocessor and deletion terms.	Finance data is sensitive even when the workflow looks internal.
Model and route notice	Approved models, model changes, fallback route and deprecation notice.	Model drift is a procurement event.
Audit-export clause	Source, tool call, prompt, output, approval, reviewer and system-write logs.	Screenshots are not an audit trail.
Incident process	Security, privacy, model, outage, incorrect-action and payment incidents.	Agent incidents cross IT, finance, legal, audit and risk.
Exit package	Prompts, templates, workpapers, route logs, evidence, evals and configuration exports.	Switchability matters at audit, renewal and incident time.
Third-party dependency map	Cloud, model, data provider, connector and outsourced operations chain.	Financial institutions cannot diligence the top logo only.

Finance agents inherit the rulebook of the process they touch. A finance-agent approval is a controls decision with a model inside it. Financial institutions already have rules for models, outsourcing, customer communications, operational resilience, records, fraud, conduct, and fair treatment. Agentic AI does not erase those obligations; it adds a faster path to breach them.

The US model-risk position is in motion. The April 2026 OCC bulletin expressly treats generative and agentic AI as novel and outside the revised guidance's scope, while pointing to further work on AI use by banks ³⁷. That is not a free pass. It is a warning that existing control habits must be adapted before prescriptive guidance arrives.

In Europe, DORA turns critical ICT third-party dependency into a board and supervisory issue for financial entities ⁴¹. The EU AI Act can make creditworthiness and similar natural-person financial decisions high-risk when Annex III applies ⁴².

For broker-dealers and securities firms, FINRA's technology-neutral stance matters: GenAI is another tool under existing rules, not an exemption from them ³⁶. For UK firms, the FCA continues to frame AI through principles and outcomes while studying agentic change through the Mills Review ³⁹⁴⁰.

The write-path register should therefore classify every agent by legal regime: corporate finance only, SOX/audit-relevant, bank model-risk relevant, securities relevant, consumer-credit relevant, insurance relevant, EU AI Act relevant, DORA/outsourcing relevant, or customer-communication relevant.

Control requirements by risk lane

Lane	Minimum control	Evidence to retain
Corporate close and SOX-adjacent work	Source lineage, preparer-reviewer separation, policy versioning and audit trail.	Workpaper, source support, reviewer note, exception list, system timestamp and model route.
AP, spend and payment	Vendor identity, duplicate/fraud check, approval matrix, payment hold and bank-control alignment.	Invoice, vendor record, PO/receipt match, approval log, payment state and exception reason.
Treasury and liquidity	Bank-feed lineage, forecast assumptions, scenario versioning and sign-off.	Data refresh, variance explanation, rate source, cash position and override reason.
Bank model-risk relevant work	Model inventory, validation, monitoring, owner, use-case boundary and challenger process.	Model card, validation record, performance monitoring, approvals and issue remediation.
Securities and investor communications	Supervision, records, disclosure, source support and communication approval.	Draft, sources, reviewer approval, distribution record and retention archive.
EU financial entity ICT dependency	DORA third-party, subcontractor, resilience, incident and exit-plan diligence.	Contract register, service mapping, incident process, test results and concentration assessment.
Creditworthiness or customer-impacting AI	High-risk classification, human oversight, explainability, bias monitoring and appeal path.	Decision basis, adverse-action record, model route, source variables and override log.

Risk signals that change approval

US bankingNear term

Model-risk guidance catches up to agentic AI

The OCC says generative and agentic AI are outside the revised model-risk guidance's current scope, but future information gathering is expected.

Evidence: OCC Bulletin 2026-13 names agentic AI as novel and rapidly evolving ³⁷.
Buyer impact: Bank agent approvals should preserve model inventory and validation evidence even before AI-specific guidance lands.
External read: Supervisors are avoiding premature prescription while keeping the door open for targeted AI measures.
Watch: OCC, Federal Reserve, and FDIC requests for information on bank AI use.
Caveat: The bulletin is not an AI safe harbour.

EU financial servicesCurrent

DORA turns agent platforms into third-party-risk objects

DORA applies to EU financial entities and can bring critical ICT third-party providers into EU oversight.

Evidence: The EBA describes DORA's framework and CTPP oversight role ⁴¹.
Buyer impact: Agent platform due diligence needs resilience, incident, subcontractor, exit and concentration evidence.
External read: AI agents riding on cloud and model platforms intensify existing ICT concentration concerns.
Watch: Critical ICT third-party designations and DORA register implementation materials.
Caveat: DORA is not AI-specific, but the agent route can be an ICT dependency.

EU AI Act2026 onward

Credit and customer impact trigger high-risk AI questions

Creditworthiness evaluation of natural persons can fall within Annex III high-risk AI use cases.

Evidence: The EU AI Act text and Commission materials identify creditworthiness as a high-risk area when conditions are met ⁴².
Buyer impact: Finance-agent approvals touching credit or similar customer decisions need classification, oversight and documentation.
External read: Financial services will remain a visible test case for high-risk AI scope.
Watch: Commission high-risk classification guidance and financial-sector interpretations.
Caveat: Preparatory or narrow procedural tasks may require separate classification analysis.

Do not confuse local language with local financial competence. Cross-border finance agents must pass four separate tests: source, law, data path and reviewer. A model can read a local-language invoice or filing and still apply the wrong accounting rule, disclosure convention, customer-duty standard or outsourcing obligation. Financial fluency is not jurisdictional competence.

The EU route is the most visible example. DORA changes ICT third-party diligence for EU financial entities ⁴¹. The EU AI Act can make creditworthiness and similar uses high-risk ⁴². The AI Act timeline and high-risk guidance consultation are therefore route-monitoring signals, not background colour ⁹⁹¹⁰⁰.

Market-data and research agents add another boundary. A data provider may license a field for internal research, but not for a customer deck, model output or downstream AI training set.

Separate five approvals: data residency, transfer mechanism, local financial rule, source licence and local reviewer. Passing one does not pass the others.

For multinational groups, entity and booking-location metadata can matter as much as language. The same payment, credit exposure or intercompany entry can belong to different controls depending on entity, branch and regulator.

Cross-border approval lanes

Lane	Test	Common error
Data movement	Where does input, output, log, embedding, prompt cache and support data travel?	Approving model region while ignoring connector logs and support access.
Local rule	Which accounting, tax, conduct, credit, outsourcing or securities rule applies?	Using language fluency as a proxy for local competence.
Source licence	Can the agent use, transform, store and redistribute the source data?	Treating market data and ratings text as public web material.
Operational resilience	Does the route create critical dependency, concentration or exit risk?	Treating AI provider uptime as an IT issue only.
Human review	Is the reviewer authorised and competent for the jurisdiction and product?	Routing local-law or customer-impacting output to a generic finance owner.
Customer impact	Could the output affect credit, insurance, suitability, KYC or adverse action?	Classifying the workflow as internal because the agent's first user is an employee.

What to record by jurisdiction

Record	Minimum	Why
Jurisdiction tag	Entity, branch, customer country, booking location and source law.	Financial controls often follow the entity, not the language.
Regime tag	DORA, AI Act, FCA/PRA, FINRA/SEC, banking model risk or local outsourcing flag.	Route controls differ by regime and use case.
Source-law evidence	Authoritative rule, guidance, filing, market-data licence or policy document.	The agent should not invent the controlling source.
Reviewer	Named accountable reviewer with competence and approval authority.	Human review is not meaningful unless the reviewer can judge the output.
Transfer and retention	Where source, prompt, output, logs, embeddings and support data are retained.	AI routes create data exhaust beyond the visible answer.

Finance-agent approvals should move when public rules, exams and politics move. Financial AI is a supervisory and political object before the product category has settled. The signal set is broader than AI law. SEC exam priorities, FINRA notices, OCC model-risk posture, FCA reviews, DORA implementation, EU AI Act classification, FSB vulnerability monitoring, lobbying records and election timing can all change which evidence a finance-agent route needs.

That does not mean procurement should freeze. It means route approval should have refresh triggers. A new exam priority can change adviser and broker-dealer evidence. A high-risk AI classification update can change credit or customer-impact routes. A DORA designation can change platform and cloud due diligence.

Political signals are weaker than primary legal records, but they still matter for timing. Lobbying and election calendars can tell a buyer when a topic is moving toward hearings, oversight, appropriations or preemption debates ⁹⁷⁹⁸.

Use this lane as a monitor, not as proof. Change a route conclusion only when a primary source such as a statute, regulator page, consultation, guidance document, court filing or official exam priority supports the move.

The output is a changed write-path register: new evidence required, use case restricted, contract refreshed, eval rerun or rollout delayed.

Diligence scenarios

Scenario	Trigger	Diligence risk	Control
Broker-dealer or adviser uses GenAI for communications, supervision, research or investor-facing support.	FINRA or SEC exam priorities emphasize AI, supervision, advertising, privacy, cybersecurity or automated tools ⁴⁵⁴⁸.	The agent may create records, recommendations or communications that existing securities rules already cover.	Map route to supervision, recordkeeping, advertising, privacy and vendor oversight controls.
Bank routes agent output into credit, risk, capital, fraud, model monitoring or customer decisions.	OCC, Federal Reserve or FDIC materials clarify agentic AI treatment under model-risk or safety-and-soundness expectations ³⁷.	The route may need validation and monitoring before AI-specific guidance is final.	Keep model inventory, challenger test, validation evidence, monitoring and owner assignment current.
EU financial entity depends on a cloud, model or finance-agent provider for regulated workflow.	DORA oversight or critical ICT third-party designations change dependency analysis ⁴¹.	The agent route becomes an ICT dependency with incident, exit and concentration implications.	Refresh third-party register, exit plan, incident process, subcontractor map and resilience test.
Agent touches creditworthiness, insurance pricing, fraud or similar natural-person outcomes.	EU AI Act high-risk guidance or classification consultation affects financial-services use cases ⁴²⁹⁹.	A route approved as internal workflow may become a high-risk AI use requiring additional controls.	Classify intended use, add human oversight, documentation, monitoring and affected-person evidence.
A vendor increases lobbying on AI liability, privacy, copyright, banking, securities, payments or preemption.	LDA filings show new issues, spending, clients or bills ⁹⁷.	The vendor may expect legal constraints not yet reflected in product language.	Ask about roadmap dependencies, indemnity, source rights, risk allocation and compliance features.
Election timing changes committee control, appropriations, hearings or agency leadership.	FEC calendars and official transition signals mark windows for political attention ⁹⁸.	Public posture can change procurement appetite before binding law changes.	Time high-salience production approvals and renewals around oversight windows.

Signal strength

Signal	Strength	Use
Final rule, statute, official guidance or exam priority.	Strong.	Update route controls, evidence pack and approval conditions.
Regulator consultation or information request.	Material.	Prepare classification analysis and possible control uplift.
Court filing, enforcement action or settlement.	Case-specific.	Turn fact pattern into vendor question and private eval.
Status page, CVE, archive diff or procurement record.	Operational.	Reopen resilience, security, contract or evidence-export diligence.
Lobbying or trade-association posture.	Directional.	Ask what constraint the vendor is planning around.
Election, polling or news-volume shift.	Weak alone.	Use only as timing context unless backed by primary legal or regulator record.

Ninety days should prove control, not ambition. The first finance-agent rollout should be small enough to audit and real enough to matter. Start with one workflow where the sources are known and the review path already exists: account reconciliation, variance analysis, invoice coding, evidence collection or KYC package preparation. Avoid starting with payment release, customer decisions or anything that posts final records.

Shadow mode should compare agent output with human output before the route writes to a production system. The review should capture not only accuracy but also missing evidence, source misuse, formula changes, exception handling, reviewer minutes and fallback quality.

The production gate should be a written route approval, not a general AI policy. Finance, IT, risk, legal, audit and the process owner should all be able to inspect the same artefact.

If a vendor cannot export the evidence needed for internal audit, external audit, model risk or regulator review, do not use that route for consequential work.

The goal is not to automate the largest workflow first. It is to prove that the organisation can control one useful workflow end to end.

Ninety-day rollout

Days 0-15Scope and write-path register

Workflow

One bounded workflow with source systems, owners and allowed outputs.

Controls

Segregation-of-duties map, approval gate and blocked actions.

Data

Source inventory with period, entity, account and permission rules.

Days 16-45Private eval and shadow mode

Eval

Golden set of real cases, messy edge cases and reviewer rubric.

Audit

Evidence export tested against internal audit and process-owner needs.

Security

Tool permissions, credential handling, retention and logging validated.

Days 46-75Controlled production

Operations

Agent runs on a limited population with human approval before writes.

Monitoring

Exception, rework, reviewer-minute, latency and fallback metrics.

Finance

Accepted-output cost and cycle-time comparison.

Days 76-90Scale or stop

Decision

Approve, restrict, renegotiate, rebuild or stop the route.

Evidence

Route register updated with incidents, eval result and residual risk.

Roadmap

Next workflow chosen only after control evidence passes.

A narrow controlled route that survives audit is more valuable than a broad demo.

Questions to ask before purchase

Topic	Question	Weak answer
Source lineage	Can every material output cite source system, record, document, period, entity and timestamp?	The answer has a confidence score but no source trail.
Write permissions	Which APIs, UI actions, records, formulas or payments can the agent change?	The vendor says the agent follows normal user permissions without showing action logs.
Segregation of duties	Can the same person or service identity prepare and approve?	Approval is a generic workflow setting, not a finance-control object.
Evidence export	Can internal and external audit inspect the full path?	Screenshots or chat transcripts are the audit artefact.
Data controls	What retention, training, region, subprocessor, and connected-app controls apply?	The vendor cites general enterprise security without route-level data terms.
Fallback	What happens when a connector, model or source provider fails during close?	The workflow retries until it works.
Evaluation	Can we run private evals on real finance cases before production?	The vendor points only to public model benchmarks.

The public residue often reveals the real implementation risk. Provider maturity leaks through public operational records before it appears in a customer story. Finance-agent vendors sell control, reliability and trust. Those claims leave traces: status-page incidents, archived trust-page wording, certificate expansion, new subdomains, security advisories, procurement language, filings, court records, lobbying and regulator calendars.

Use these sources as tripwires, not verdicts. One incident, one CVE, one certificate or one archived claim rarely proves the provider is weak. A pattern across outages, integration bugs, dependency exposure, shrinking claims, procurement friction and regulatory pressure changes the diligence agenda.

The same method applies to close windows, payment uptime, model routes, data controls, vendor risk, resilience and regulator-facing evidence.

The practical output is a diligence memo: what changed, which route is affected, which control needs retesting, and whether production approval narrows.

Operational exhaust belongs in weekly monitoring for production write paths that can affect close, payments, customers, markets, capital, risk reports or regulatory submissions.

Sources for the diligence file

Source	Signal	Diligence use
Federal Register, SEC, FINRA, OCC, FCA and EBA pages	Rulemaking, consultations, exam priorities, supervisory posture and implementation dates.	Reopen model-risk, conduct, outsourcing and high-risk classification questions.
SEC EDGAR and market-data APIs	Filing availability, issuer data, source freshness and data-route dependencies.	Turn filing retrieval and data-source claims into eval cases.
USAspending and SAM.gov	Public-sector financial-management, fraud, audit, ERP and AI procurement language.	Find demand, requirements and failed assumptions before buying similar claims.
CourtListener	Contract disputes, enforcement, fraud, AI litigation and vendor-related docket signals.	Flag indemnity, source-rights, customer-harm and performance disputes.
Internet Archive and Common Crawl	Changed AI claims, trust terms, pricing pages, security language and feature scope.	Ask why a claim changed before renewal or production expansion.
NVD and CISA KEV	Known vulnerabilities and exploited dependencies in agent frameworks, connectors and data platforms.	Map every production write path to an owner, patch policy and compensating control.
OpenAI, Anthropic, Google, Azure and AWS status pages	Outages, degraded components and incident patterns.	Test fallback routes for close, payments, reporting and customer-impacting workflows.
RDAP and certificate transparency	Domain moves, subdomain launches, trust portals and integration surfaces.	Spot product, integration and deployment surfaces before press releases.
LDA filings and election calendars	Lobbying pressure, committee timing, agency oversight and preemption debates.	Use as a monitor, not legal proof, for regulatory-risk posture.

What changes a production write path

Signal	Route affected	Move
Repeated status incidents during close windows.	Close, reporting, treasury and board-pack agents.	Add fallback route, manual close plan and SLA review.
New exploited vulnerability in connector or vector-store dependency.	Any agent with tool or retrieval access.	Pause expansion, patch, retest prompt-injection and data-exfiltration cases.
Archived trust page removes data-retention or audit-language claim.	Cloud, model and SaaS-embedded agent paths.	Request written clarification and update write-path register.
New regulator consultation names agentic AI or high-risk classification.	Credit, KYC, customer, model-risk and EU financial-entity routes.	Reclassify use case and adjust evidence pack.
Procurement record asks for audit export or AI governance controls.	Vendor maturity screen.	Add that language to RFP and contract schedule.
Court docket shows AI output, source, fraud or vendor dispute.	Similar workflow or provider class.	Turn facts into private eval and indemnity question.

Case studies are useful only when they change the eval. The best finance case studies show a bounded workflow, a source boundary, a human gate and a measurable adoption pattern. Morgan Stanley's public material is the strongest financial-services case in the source set because it names the source corpus, the workflow, the eval posture, the advisor review path and the data-retention concern ⁵⁰⁵¹.

Banking assistants such as Erica and Fargo show that financial institutions can operate AI assistants at large scale ⁵²⁵³. They are not direct proof that agents can post journals, approve payments, change credit decisions or give regulated advice.

The case-study rule is therefore strict: use the case to design a private test. If the case claims adoption, test adoption by role. If it claims speed, measure reviewer minutes. If it claims trust, inspect data controls and regression evals.

Vendor-authored case studies remain pattern evidence unless a customer names the denominator and outcome. They can still be valuable because they reveal the adoption mechanics that product pages hide.

A finance case study should never be copied across workflows. Wealth-advisor research support, AP invoice routing and close reconciliation have different error costs.

What implementation stories prove

Wealth management, institutional securities and researchUS and global

Morgan Stanley

Morgan Stanley announced AskResearchGPT over a research corpus of more than 70,000 proprietary reports ⁵⁰; OpenAI's case study describes evals, regression testing, review and adoption ⁵¹.

Workflow: Research retrieval, advisor assistant, meeting summarisation and CRM follow-up.
Stack: OpenAI-powered tools, Morgan Stanley research corpus, Debrief and internal evals.
Deployment: Eval-driven rollout with advisor review, consent for meeting recordings and zero-data-retention concerns addressed.
Result: Public material reports 98% adoption for the advisor assistant and faster follow-ups; production approval still depends on local compliance controls ⁵¹.
Caveat: Strong evidence for source-bounded assistant adoption; not proof of autonomous trading, credit, payment or ledger workflows.

Retail bankingUS

Bank of America

Bank of America public newsroom material on Erica interactions.

Workflow: Customer-facing virtual financial assistant.
Stack: Erica.
Deployment: Large-scale consumer assistant embedded in banking channels.
Result: Useful evidence that banks can operate AI assistants at scale.
Caveat: Customer-service scale does not establish accounting, payments, credit or investment-advice controls.

Consumer bankingUS

Wells Fargo

Wells Fargo newsroom material on Fargo launch and assistant use.

Workflow: Customer-service virtual assistant.
Stack: Fargo.
Deployment: Digital banking assistant for account and service tasks.
Result: Useful pattern evidence for bounded banking-assistant adoption.
Caveat: Does not prove safe autonomous action for payments, lending, investment, or close workflows.

Enterprise finance and accountingGlobal

BlackLine customers

BlackLine public pages cite connected finance workflows ³. Its announcement and evidence row emphasize governed data, traceable actions, explainability and auditability ⁴⁴.

Workflow: Record-to-report, invoice-to-cash, close, journal entries and intercompany.
Stack: BlackLine Studio360, applications and Verity AI.
Deployment: Agentic Financial Operations in a connected auditable platform.
Result: Strong as a vendor-lane signal for controlled financial operations.
Caveat: Buyer should verify workflow fit against its own ERP complexity, close calendar and audit standards.

Enterprise financeGlobal

Workday early-access customers

Workday's public release says the Financial Audit Agent saved early-access customers up to 900 hours per year ⁶.

Workflow: Audit evidence collection and finance workflow automation.
Stack: Workday Illuminate agents.
Deployment: AI agents embedded in Workday.
Result: Useful evidence for audit-evidence automation potential.
Caveat: Vendor-reported and workflow-specific; audit quality and evidence export still need local validation.

Enterprise finance operationsGlobal

HighRadius customers

HighRadius says it is releasing 186 agentic AI agents across six product suites and 20 products ⁹.

Workflow: Receivables, payables, treasury, close and consolidation.
Stack: HighRadius autonomous finance platform and agents.
Deployment: Suite-based autonomous-finance roadmap.
Result: Useful signal for breadth of agentic finance claims.
Caveat: Breadth requires stricter route-by-route validation; one agent's maturity does not approve the suite.

Case studies are evidence of deployment shape. They are not transferable ROI until local evals reproduce the result.

Track the sources publishing tests, controls and failure analysis. The useful monitoring targets are finance-agent tests, tool traces, workbook controls and failure analysis. Financial AI agents sit between accounting, financial data, software, security, audit and regulation. Monitor concrete artefacts: benchmark tasks, tool traces, rubrics, workbook-action controls, eval code and post-mortems.

Prioritize sources whose public work changes eval design, route control, vendor questions or failure analysis; track institution-level signals separately.

Treat these sources as a monitoring map, not endorsement. Replace a source when its public signal stops improving eval design, route control, vendor questions or failure analysis.

A good source signal changes a private eval, route control, vendor question or watch item.

Sources to monitor

Expert	Lane	Signal	Links
Vals Finance Agent benchmark Finance benchmark source	Finance evalsSEC-filing finance-agent tasks, dated scores and benchmark harness changes.	The benchmark turns finance-agent claims into dated task, tool and cost evidence ²⁵. Watch task taxonomy changes, public validation examples, score revisions and harness notes.	Open Vals Finance Agent benchmark primary work
FinRetrieval benchmark Financial retrieval paper	Financial retrievalFinancial retrieval, tool use and structured data access.	The benchmark shows how tool availability can dominate finance-agent performance ²⁷. Watch tool-call traces, structured-data ablations, geography gaps and ground-truth methodology.	Open FinRetrieval benchmark primary work
BankerToolBench Investment-banking workflow benchmark	Investment banking workflowsEnd-to-end junior-banker analytical workflows and rubrics.	The benchmark gives finance-agent buyers a harder test than single-answer analyst QA ²⁸. Watch banker rubrics, client-ready output rates, artifact checks and new task categories.	Open BankerToolBench primary work
Pista Spreadsheet-agent control paper	Spreadsheet controlAuditable and controllable spreadsheet-agent actions.	The paper targets a core finance-agent failure mode: hidden spreadsheet mutation ²⁹. Watch action decomposition, intervention points and user-control findings.	Open Pista primary work
MLFinLab documentation Financial-ML method source	ValidationFinancial ML validation, backtesting and leakage control.	The documentation is useful when finance-agent demos look strong because the eval is leaky or unrealistic ¹⁰⁶. Watch backtesting discipline, leakage warnings and financial ML validation methods.	Open MLFinLab documentation primary work

Named providers and infrastructure to screen.

AI agents for financial services

Inclusion does not imply endorsement. Classes reflect provider positioning and buyer-screening lanes.

The missing evidence is the procurement brief. Public evidence is improving, but the market still avoids the evidence finance teams most need. Vendor pages now name agents, workflows, data connectors and auditability. They rarely publish comparable error rates, reviewer minutes, exception handling, formula-damage rates, payment near-misses, external-audit outcomes or regulator-facing evidence packs.

Benchmarks remain thin around the hardest finance work: ERP permissions, write paths, linked spreadsheets, document quality, approval gates, payment controls, customer impact and regulated-service review.

That does not block adoption. It changes procurement. Every missing public proof should become a local eval row, contract obligation, route restriction or watch signal.

The next decisive evidence would connect three things in one dataset: agent route, human review burden and accepted output quality. Most public material still shows only one of the three.

Evidence gaps to convert into diligence

Gap	Why it matters	Private test
Cost per accepted output	Seat, token and invoice counts ignore review and rework.	Measure reviewer minutes and rework on accepted reconciliations, invoices, models or evidence packs.
Spreadsheet mutation safety	Finance workbooks carry formulas, hidden state and linked assumptions.	Run agent changes on linked workbooks and diff formulas, values, links and hidden tabs.
Payment near-miss rates	A low average AP error rate can hide unacceptable money-movement risk.	Test duplicate vendors, account changes, fake invoices, approval conflicts and payment holds.
ERP permission inheritance	Agent identity can blur human roles, service accounts and workflow approvals.	Audit every tool call against user, service account and segregation-of-duties policy.
Regulator-facing evidence	Financial-services agents may affect customers, markets, credit, KYC or conduct.	Produce a model-risk and conduct evidence pack for one real route before scale.
Benchmark drift	Finance benchmark leaders can change between vendor launch and procurement close.	Snapshot every public benchmark with date, method and task coverage; rerun private evals after model changes.
Operational-resilience concentration	Agent routes may depend on one model provider, cloud, vector store, connector or data provider.	Run fallback drills during close, payment, reporting and customer-impact workflows.
Prompt injection and unsafe agency	Untrusted invoices, filings, emails and documents can become tool-call instructions.	Adversarially test dispatcher, tool allowlist, output filtering and service-account permissions.
Audit acceptance evidence	An internal productivity win can fail external audit if evidence is not inspectable.	Ask internal and external audit to review exported workpapers before production expansion.
Cross-border route classification	Data movement, local rule, reviewer competence and customer impact can diverge by jurisdiction.	Classify each route by entity, country, product, source licence, regulator and reviewer.
Political and supervisory timing	Exam priorities, consultations, elections and lobbying can change adoption appetite before product terms catch up.	Attach refresh triggers to route approval and renewal dates.

Primary sources and benchmark anchors.

Primary source list

Ref	Source	Verification	Evidence	Open source
1	KPMG US - AI in Finance 2026 survey	Publisher: KPMG US; Kind: Industry survey; Checked: 2026-05-31; Status: verified	E1: KPMG's US 2026 finance survey says 93% of US companies expect to deploy or scale AI in finance over the next 18 months, with half planning to orchestrate or develop multi-agent AI systems.	Open source
2	KPMG International - AI adoption in finance doubles	Publisher: KPMG International; Kind: Industry survey; Checked: 2026-05-31; Status: verified	E2: KPMG International reports that assurance-ready finance organizations have materially higher error-reduction and scaling-confidence outcomes than peers, with data quality named as both a top barrier and opportunity. \| E50: KPMG's global finance survey states that AI assurance readiness means the organization can produce audit evidence and explain it, not merely show that AI was used.	Open source
3	BlackLine - Agentic Financial Operations platform	Publisher: BlackLine; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E3: BlackLine positions Agentic Financial Operations around record-to-report and invoice-to-cash automation, a connected auditable platform, and Verity AI agents across close, intercompany, and invoice-to-cash work. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
4	BlackLine - Agentic Financial Operations announcement	Publisher: BlackLine; Kind: Vendor press; Checked: 2026-05-31; Status: verified	E4: BlackLine's April 2026 announcement frames agentic financial operations as a control-layer problem, with governed data, workflow orchestration, auditable AI, traceable actions, and financial-control alignment. \| E45: BlackLine's agentic architecture explicitly pairs AI agents with a ground-truth layer, financial controls, explainability, traceability, and auditability. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
5	FloQast - accounting transformation platform	Publisher: FloQast; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E5: FloQast describes an accounting transformation platform powered by AI agents that automate accounting workflows while moving preparers toward reviewer roles in an audit-ready platform. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
6	Workday - Illuminate finance agents	Publisher: Workday; Kind: Vendor press; Checked: 2026-05-31; Status: verified	E6: Workday's Illuminate agents include a Financial Audit Agent that the company says saves early-access customers up to 900 hours per year by automating audit evidence collection and reporting. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
7	Microsoft Learn - Finance agents in Microsoft 365	Publisher: Microsoft; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E7: Microsoft describes Finance agents in Microsoft 365 as role-based Copilot agents that connect Excel and productivity tools with existing financial systems such as ERP for real-time insights and actions. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
8	Oracle - AI agents for Oracle Cloud ERP	Publisher: Oracle; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E8: Oracle's ERP agent overview describes finance agents embedded in ERP for document IO, ledger work, advanced prediction, touchless operations, predictive insight, connected actions, and human review or approval. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
9	HighRadius - autonomous finance platform goal	Publisher: HighRadius; Kind: Vendor press; Checked: 2026-05-31; Status: verified	E9: HighRadius says it is shipping 186 agentic AI agents across six product suites and 20 products covering receivables, payables, treasury, close, and consolidation, with a 2027 autonomous-finance target. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
10	HighRadius - AI-powered finance solutions	Publisher: HighRadius; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E10: HighRadius positions AI agents for finance across order-to-cash, treasury, record-to-report, and accounts payable, using measurable outcome claims rather than generic chatbot positioning. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
11	Auditoria.AI - finance and accounting agents	Publisher: Auditoria.AI; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E11: Auditoria.AI states that its agents work inside ERP systems to handle AP, AR, and finance workflows end to end. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
12	Ramp - AP agents in Bill Pay	Publisher: Ramp; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E12: Ramp's Bill Pay documentation says AP Agents understand invoice context, code line items, check for fraud, recommend approvals, and optimize payment workflows. \| E47: Ramp's AP Agents are fully autonomous within Bill Pay, but the documented actions include recommending approvals and optimizing workflows rather than turning finance policy into an unbounded payment mandate. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
13	Brex - intelligent finance agents	Publisher: Brex; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E13: Brex frames intelligent finance around AI agents that categorize, review, and approve spend based on company policies with transparency. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
14	Tipalti - AI-powered AP automation	Publisher: Tipalti; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E14: Tipalti says its AI Assistant and Agents automate AP from capture and coding to approval and payment while giving finance visibility and insight. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
15	Stampli - accounts payable platform	Publisher: Stampli; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E15: Stampli's AP platform preserves every action, change, question, and approval in an immutable record and embeds AI for coding, PO matching, approver prediction, and exception handling. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
16	BILL - accounts payable automation	Publisher: BILL; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E16: BILL describes AI-powered AP automation for invoice capture, approval routing, payment processing, automatic coding, matching, suspicious-activity monitoring, and accounting-system sync. \| E48: BILL combines AP automation with payment options, vendor network access, suspicious-activity monitoring, approval workflow, accounting sync, and explicit caveats around results varying by invoice layout and data quality. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
17	Ledge - close management with AI agents	Publisher: Ledge; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E17: Ledge turns close checklist tasks into agents that run every period across systems, spreadsheets, and UI, then present reconciliations, workpapers, and journal entries for review and approval. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
18	Numeric - AI-powered close automation	Publisher: Numeric; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E18: Numeric positions its AI-native record-to-report platform around close management, reconciliations, cash matching, journal-entry automation, bank integrations, and GL transaction monitoring. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
19	AppZen - AP and expense agentic AI	Publisher: AppZen; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E19: AppZen says its AP and expense agents are purpose-built for finance, trained on more than $50 billion in enterprise spend, and auditable from action to outcome. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
20	Kyriba - AI-powered cash forecasting	Publisher: Kyriba; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E20: Kyriba's Cash AI uses artificial intelligence to analyse large data volumes, automate data integration and variance tracking, and support cash forecasting and scenario planning. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
21	DataSnipper - agentic platform for audit and finance	Publisher: DataSnipper; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E21: DataSnipper describes audit and finance agents that perform testing while teams review and approve, including evidence tracing and end-to-end workflows such as revenue testing and tests of detail. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
22	MindBridge - autonomous financial oversight	Publisher: MindBridge; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E22: MindBridge positions continuous AI oversight across financial transactions, systems, and entities to detect anomalies, control breakdowns, unusual patterns, and issues before close or audit. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
23	Optro - AI for GRC	Publisher: Optro; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E23: Optro says its GRC AI uses domain-trained models with configurable oversight and full audit trails to keep teams in control. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
24	Anthropic - agents for financial services	Publisher: Anthropic; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E24: Anthropic released ten financial-services agent templates for pitchbooks, KYC screening, month-end close, statement audit, GL reconciliation, valuation review, and related workflows, with connectors, subagents, permissions, credential vaults, and audit logs. \| E46: Anthropic says users remain in the loop to review, iterate, and approve Claude's work before it goes to a client, gets filed, or is acted on. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
25	Vals AI - benchmarks	Publisher: Vals AI; Kind: Agent benchmark; Checked: 2026-05-31; Status: verified	E25: Vals AI's May 22, 2026 benchmark page lists Finance Agent v2 as a proprietary industry benchmark for core financial analyst tasks, showing why public benchmark rows should be treated as dated snapshots. \| E49: Vals AI's Finance Agent v2 snapshot on May 22, 2026 shows why public benchmark results should be treated as dated failure probes, not permanent vendor medals.	Open source
26	Vals AI - Finance Agent benchmark dataset	Publisher: Vals AI; Kind: Agent benchmark; Checked: 2026-05-31; Status: verified	E26: The Vals AI finance-agent dataset describes real-world finance research problems that require analysis using recent SEC filings.	Open source
27	FinRetrieval benchmark	Publisher: FinRetrieval benchmark; Kind: Retrieval benchmark; Checked: 2026-05-31; Status: verified	E27: FinRetrieval reports that tool availability can dominate finance-agent performance, with structured data APIs materially outperforming web search alone in its retrieval setting.	Open source
28	BankerToolBench	Publisher: BankerToolBench; Kind: Agent benchmark; Checked: 2026-05-31; Status: verified	E28: BankerToolBench evaluates end-to-end analytical workflows performed by junior investment bankers using rubric criteria defined by veteran investment bankers.	Open source
29	Pista - auditable spreadsheet agents	Publisher: Pista; Kind: Agent benchmark; Checked: 2026-05-31; Status: verified	E29: Pista decomposes spreadsheet-agent execution into auditable and controllable actions so users can see and intervene in an agent's decision process.	Open source
30	AWS - generative AI for financial services	Publisher: AWS; Kind: Cloud documentation; Checked: 2026-05-31; Status: verified	E30: AWS positions generative AI for financial services around purpose-built AWS services, Amazon Bedrock, and Bedrock AgentCore for building financial-services solutions that use enterprise data. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
31	Google Cloud - Gemini Enterprise	Publisher: Google; Kind: Cloud documentation; Checked: 2026-05-31; Status: verified	E31: Google Gemini Enterprise is positioned as a workplace agent platform with agent creation, orchestration, security, permissions, and enterprise data connections. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
32	OpenAI - financial services solutions	Publisher: OpenAI; Kind: Vendor documentation; Checked: 2026-05-31; Status: verified	E32: OpenAI's financial-services solutions page positions OpenAI for finance with enterprise controls, reliability, and security requirements. Limitation: vendor-controlled source; use for route shape and test operating claims in diligence.	Open source
33	OpenAI - enterprise privacy	Publisher: OpenAI; Kind: Privacy and data terms; Checked: 2026-05-31; Status: verified	E33: OpenAI's enterprise privacy page states that business data is not used to train models by default, that enterprise admins control connected sources, retention, and access, and that SOC 2 controls and encryption are part of the enterprise posture.	Open source
34	Microsoft Foundry - data, privacy and security	Publisher: Microsoft; Kind: Privacy and data terms; Checked: 2026-05-31; Status: verified	E34: Microsoft Foundry data-privacy documentation states that prompts, completions, embeddings, and training data are not available to other customers or model providers and are not used to train foundation models without permission or instruction.	Open source
35	Google Cloud - Vertex AI data governance	Publisher: Google; Kind: Privacy and data terms; Checked: 2026-05-31; Status: verified	E35: Google Cloud Vertex AI data-governance documentation provides a data-control route for Gemini and related generative-AI workloads on Google Cloud.	Open source
36	FINRA - artificial intelligence topic page	Publisher: FINRA; Kind: Regulator; Checked: 2026-05-31; Status: verified	E36: FINRA states that its rules and the securities laws remain technology neutral and continue to apply when member firms use GenAI or similar technologies in their businesses.	Open source
37	OCC - model risk management revised guidance	Publisher: OCC; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E37: The April 2026 OCC model-risk bulletin says generative AI and agentic AI are novel and rapidly evolving, outside that guidance's scope, and expected to be addressed through further information gathering on AI use by banks. Limitation: verify dated release or consultation status before relying on timing.	Open source
38	Federal Reserve - SR 11-7 model risk management	Publisher: Federal Reserve; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E38: Federal Reserve SR 11-7 remains the classic US banking model-risk reference for model development, validation, governance, and controls across banking uses such as underwriting, valuation, risk measurement, and capital adequacy. Limitation: verify dated release or consultation status before relying on timing.	Open source
39	FCA - AI and the FCA approach	Publisher: FCA; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E39: The FCA says its AI approach for UK financial services is principles-based and outcomes-focused, relying on existing frameworks rather than new AI-specific rules. Limitation: verify dated release or consultation status before relying on timing.	Open source
40	FCA - Mills Review on AI and retail financial services	Publisher: FCA; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E40: The FCA's Mills Review is examining how advanced, generative, agentic, and emerging AI may reshape consumers, firms, markets, and regulators in retail financial services toward 2030. Limitation: verify dated release or consultation status before relying on timing.	Open source
41	European Banking Authority - Digital Operational Resilience Act	Publisher: European Banking Authority; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E41: The EBA describes DORA as a comprehensive digital-operational-resilience framework for EU financial entities, with critical ICT third-party providers subject to EU oversight. Limitation: verify dated release or consultation status before relying on timing.	Open source
42	EUR-Lex - Regulation (EU) 2024/1689 Artificial Intelligence Act	Publisher: EUR-Lex; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E42: The EU AI Act treats certain financial-services use cases, including creditworthiness evaluation of natural persons, as high-risk systems when Annex III conditions are met. Limitation: verify dated release or consultation status before relying on timing.	Open source
43	NIST - AI Risk Management Framework	Publisher: NIST; Kind: Standard; Checked: 2026-05-31; Status: monitor	E43: NIST's AI Risk Management Framework and Generative AI Profile provide cross-sector control language for mapping, measuring, managing, and governing AI risks. Limitation: verify dated release or consultation status before relying on timing.	Open source
44	Financial Stability Board - monitoring AI adoption in finance	Publisher: Financial Stability Board; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E44: The FSB identifies financial-sector AI vulnerabilities including third-party dependencies, market correlations, cyber risks, and model-risk or governance challenges. Limitation: verify dated release or consultation status before relying on timing.	Open source
45	FINRA - Regulatory Notice 24-09 on GenAI and LLMs	Publisher: FINRA; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E51: FINRA Regulatory Notice 24-09 reminds member firms that FINRA rules and securities laws remain technology neutral when firms use generative AI and LLM tools. Limitation: verify dated release or consultation status before relying on timing.	Open source
46	FINRA - 2026 Annual Regulatory Oversight Report on GenAI	Publisher: FINRA; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E52: FINRA's 2026 GenAI oversight report asks how firms establish guardrails or control mechanisms to limit or restrict agent behaviours, actions, or decisions. Limitation: verify dated release or consultation status before relying on timing.	Open source
47	FINRA - types of AI agents	Publisher: FINRA; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E53: FINRA's AI topic page links AI-agent resources, prompt-injection guidance, GenAI oversight material, vendor-outsourcing reminders, and investor-fraud warnings. Limitation: verify dated release or consultation status before relying on timing.	Open source
48	SEC - 2025 examination priorities	Publisher: SEC; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E54: The SEC's 2025 examination priorities include artificial intelligence among risk areas for registrants and market participants. Limitation: verify dated release or consultation status before relying on timing.	Open source
49	SEC - 2025 examination priorities PDF	Publisher: SEC; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E55: The SEC 2025 examination-priorities PDF gives advisers, funds, broker-dealers, and other registrants an official risk-priority source for AI-adjacent exam planning. Limitation: verify dated release or consultation status before relying on timing.	Open source
50	Morgan Stanley - AskResearchGPT announcement	Publisher: Morgan Stanley; Kind: Case study; Checked: 2026-05-31; Status: monitor	E56: Morgan Stanley Research announced AskResearchGPT for Investment Banking, Sales and Trading, and Research staff, grounded in more than 70,000 proprietary research reports published annually. \| E109: Morgan Stanley Research announced AskResearchGPT for defined staff groups over a proprietary research corpus. Buying use: use it as a bounded research-workflow case, not as open-web agent evidence. Limitation: verify dated release or consultation status before relying on timing.	Open source
51	OpenAI - Morgan Stanley eval-driven case study	Publisher: OpenAI; Kind: Case study; Checked: 2026-05-31; Status: monitor	E57: OpenAI's Morgan Stanley case study describes eval-driven deployment, regression testing, zero data retention, advisor review, Debrief meeting summaries, CRM integration, and 98% adoption for the assistant. \| E110: Morgan Stanley's eval-driven OpenAI case turns public case-study material into diligence questions: regression suite, retrieval method, consent, CRM write-back, advisor review, and data retention. Limitation: verify dated release or consultation status before relying on timing.	Open source
52	Bank of America - Erica virtual financial assistant	Publisher: Bank of America; Kind: Case study; Checked: 2026-05-31; Status: monitor	E58: Bank of America's Erica virtual assistant is a scaled financial-services AI assistant case, useful as adoption evidence for customer-facing assistant operations rather than finance-agent write paths. \| E111: Bank of America reports Erica usage at large customer-assistant scale. Buying use: the case informs adoption and customer-service operations, not approval for ledger writes, payments, credit or regulated advice. Limitation: verify dated release or consultation status before relying on timing.	Open source
53	Wells Fargo - Fargo virtual assistant	Publisher: Wells Fargo; Kind: Case study; Checked: 2026-05-31; Status: monitor	E59: Wells Fargo's Fargo virtual assistant is a consumer-banking assistant case that belongs in the customer-service lane, not in the ledger-posting lane. Limitation: verify dated release or consultation status before relying on timing.	Open source
54	JPMorgan Chase - 2025 annual report	Publisher: JPMorgan Chase; Kind: Company filing; Checked: 2026-05-31; Status: monitor	E60: JPMorgan Chase annual-report materials are public primary sources for bank-level AI, technology, risk, and operating posture, though specific internal-agent claims need direct evidence. Limitation: verify dated release or consultation status before relying on timing.	Open source
55	JPMorgan Chase - investor day AI remarks	Publisher: JPMorgan Chase; Kind: Investor material; Checked: 2026-05-31; Status: monitor	E61: JPMorgan Chase investor-day materials are a monitoring source for bank AI deployment, finance-team use cases, and management framing of productivity versus risk. Limitation: verify dated release or consultation status before relying on timing.	Open source
56	SAP - Joule agents for finance	Publisher: SAP; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E62: SAP positions Joule agents as AI agents that work across SAP business processes, including finance-relevant workflows inside the SAP application estate. Limitation: verify dated release or consultation status before relying on timing.	Open source
57	SAP - Business AI for finance	Publisher: SAP; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E63: SAP Business AI for finance is a source-system route: it inherits SAP data, permissions, process models, and release cadence rather than operating as a generic finance chatbot. Limitation: verify dated release or consultation status before relying on timing.	Open source
58	Coupa - AI for spend management	Publisher: Coupa; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E64: Coupa's AI materials position spend-management AI around procurement, sourcing, supplier, contract, invoice, expense, and payment workflows. Limitation: verify dated release or consultation status before relying on timing.	Open source
59	Workiva - generative AI for reporting and controls	Publisher: Workiva; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E65: Workiva's generative-AI product surface is relevant to reporting, controls, and connected reporting workflows where source evidence and review trails matter. Limitation: verify dated release or consultation status before relying on timing.	Open source
60	AuditBoard - AI for audit, risk, and compliance	Publisher: AuditBoard; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E66: AuditBoard's AI surface belongs in the audit, risk, and compliance lane, where control evidence and reviewer workflow are the buyer object. Limitation: verify dated release or consultation status before relying on timing.	Open source
61	Datarails - FP&A Genius	Publisher: Datarails; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E67: Datarails FP&A Genius positions AI around finance questions, planning analysis, and spreadsheet-adjacent FP&A workflows. Limitation: verify dated release or consultation status before relying on timing.	Open source
62	Pigment - AI for business planning	Publisher: Pigment; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E68: Pigment AI positions planning AI around business-planning analysis and scenario work rather than ledger write-back. Limitation: verify dated release or consultation status before relying on timing.	Open source
63	Anaplan - PlanIQ and AI	Publisher: Anaplan; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E69: Anaplan PlanIQ is a planning and forecasting AI lane where forecast variance, assumptions, and scenario governance matter more than document retrieval. Limitation: verify dated release or consultation status before relying on timing.	Open source
64	Planful - Predict AI	Publisher: Planful; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E70: Planful Predict AI is another planning lane where source refresh, forecast bias, override controls, and planning-owner review are the core diligence questions. Limitation: verify dated release or consultation status before relying on timing.	Open source
65	Trintech - AI financial close	Publisher: Trintech; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E71: Trintech's AI financial-close material adds another record-to-report and reconciliation provider lane with enterprise close and control claims. Limitation: verify dated release or consultation status before relying on timing.	Open source
66	Nominal - AI-native close agents	Publisher: Nominal; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E72: Nominal positions AI-native close agents around flux analysis, bank reconciliation, trigger, transaction matching, and transaction patrol workflows. Limitation: verify dated release or consultation status before relying on timing.	Open source
67	ComplyAdvantage - AI financial crime risk	Publisher: ComplyAdvantage; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E73: ComplyAdvantage is a financial-crime risk source for AML, sanctions, adverse-media, and risk-screening AI workflows where evidence packaging and escalation matter. Limitation: verify dated release or consultation status before relying on timing.	Open source
68	Feedzai - risk operations platform	Publisher: Feedzai; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E74: Feedzai is a fraud and risk-operations lane where agentic automation would require false-positive, false-negative, customer-impact, and model-monitoring evidence. Limitation: verify dated release or consultation status before relying on timing.	Open source
69	NICE Actimize - X-Sight financial crime platform	Publisher: NICE Actimize; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E75: NICE Actimize X-Sight is a financial-crime and compliance platform lane for AML, fraud, surveillance, and case-management workflows. Limitation: verify dated release or consultation status before relying on timing.	Open source
70	Moody's - Research Assistant	Publisher: Moody's; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E76: Moody's Research Assistant represents the credit, ratings, and research-workflow lane, where licensed sources, assumptions, and analyst approval matter. Limitation: verify dated release or consultation status before relying on timing.	Open source
71	S&P Global - ChatAI	Publisher: S&P Global; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E77: S&P Global ChatAI represents a market-intelligence and data-platform route where data licence, source hierarchy, and analyst review drive approval. Limitation: verify dated release or consultation status before relying on timing.	Open source
72	FactSet - Mercury	Publisher: FactSet; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E78: FactSet Mercury represents the financial-data terminal and research assistant lane, where provider data permissions and workflow embedding are the product asset. Limitation: verify dated release or consultation status before relying on timing.	Open source
73	Bloomberg - BloombergGPT research paper	Publisher: Bloomberg; Kind: Research paper; Checked: 2026-05-31; Status: monitor	E79: BloombergGPT is research evidence for finance-specialised language modelling, but it does not by itself approve agentic finance workflows under real permissions. Limitation: verify dated release or consultation status before relying on timing.	Open source
74	PCAOB - technology and audit innovation resources	Publisher: PCAOB; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E80: PCAOB technology and audit-innovation resources are a monitoring lane for how audit evidence and technology-assisted procedures may be scrutinised. Limitation: verify dated release or consultation status before relying on timing.	Open source
75	AICPA and CIMA - AI and automation in finance	Publisher: AICPA and CIMA; Kind: Professional guidance; Checked: 2026-05-31; Status: monitor	E81: AICPA and CIMA technology resources are professional-guidance inputs for finance and accounting teams designing AI controls and workforce operating models. Limitation: verify dated release or consultation status before relying on timing.	Open source
76	ISO - ISO/IEC 42001 AI management system	Publisher: ISO; Kind: Standard; Checked: 2026-05-31; Status: monitor	E82: ISO/IEC 42001 gives buyers a management-system standard signal for AI governance, lifecycle controls, monitoring, and continuous improvement. Limitation: verify dated release or consultation status before relying on timing.	Open source
77	COSO - internal control framework	Publisher: COSO; Kind: Standard; Checked: 2026-05-31; Status: monitor	E83: COSO internal-control guidance remains the finance-control backdrop for agent workflows that touch financial reporting and control evidence. Limitation: verify dated release or consultation status before relying on timing.	Open source
78	BCBS - Principles for operational resilience	Publisher: BCBS; Kind: Standard; Checked: 2026-05-31; Status: monitor	E84: Basel operational-resilience principles are a useful control analogue for financial institutions approving agent routes with dependency, continuity, and incident implications. Limitation: verify dated release or consultation status before relying on timing.	Open source
79	IOSCO - AI and machine learning guidance	Publisher: IOSCO; Kind: Regulator; Checked: 2026-05-31; Status: monitor	E85: IOSCO's AI and machine-learning guidance is a securities-market source for governance, controls, oversight, outsourcing, and investor-protection concerns. Limitation: verify dated release or consultation status before relying on timing.	Open source
80	Federal Register documents API	Publisher: Federal Register documents API; Kind: Regulatory registry; Checked: 2026-05-31; Status: monitor	E86: The Federal Register API is a monitorable source for AI, banking, securities, consumer finance, operational resilience, and rulemaking signals. Limitation: verify dated release or consultation status before relying on timing.	Open source
81	SEC EDGAR APIs	Publisher: SEC; Kind: Filing API; Checked: 2026-05-31; Status: monitor	E87: SEC EDGAR APIs make filings a structured source for finance-agent retrieval tests, market-analysis workflows, public-company financials, and vendor evidence checks. Limitation: verify dated release or consultation status before relying on timing.	Open source
82	FINRA API developer centre	Publisher: FINRA API developer centre; Kind: Regulatory registry; Checked: 2026-05-31; Status: monitor	E88: FINRA's developer surfaces support monitorable broker-dealer, rule, and regulatory-data workflows where agent outputs depend on current regulatory records. Limitation: verify dated release or consultation status before relying on timing.	Open source
83	USAspending award search API	Publisher: USAspending award search API; Kind: Procurement record; Checked: 2026-05-31; Status: monitor	E89: USAspending award-search APIs are useful for tracking public-sector finance, audit, fraud, AI, cloud, and financial-management procurement signals. Limitation: verify dated release or consultation status before relying on timing.	Open source
84	SAM.gov opportunities API	Publisher: SAM.gov opportunities API; Kind: Procurement record; Checked: 2026-05-31; Status: monitor	E90: SAM.gov opportunities data is a procurement-monitoring surface for AI, financial-management, ERP, audit, and compliance solicitations. Limitation: verify dated release or consultation status before relying on timing.	Open source
85	CourtListener API	Publisher: CourtListener API; Kind: Court API; Checked: 2026-05-31; Status: monitor	E91: CourtListener APIs can expose litigation, enforcement, contract, fraud, and AI-dispute signals that change financial-agent vendor diligence. Limitation: verify dated release or consultation status before relying on timing.	Open source
86	Internet Archive CDX API	Publisher: Internet Archive CDX API; Kind: Web archive; Checked: 2026-05-31; Status: monitor	E92: Internet Archive CDX is a claim-drift source for vendor AI, trust, pricing, security, and capability pages. Limitation: verify dated release or consultation status before relying on timing.	Open source
87	Common Crawl index	Publisher: Common Crawl index; Kind: Web archive; Checked: 2026-05-31; Status: monitor	E93: Common Crawl public index records can preserve dated finance-agent provider pages and public claim changes. Limitation: verify dated release or consultation status before relying on timing.	Open source
88	NVD API	Publisher: NVD API; Kind: Security advisory; Checked: 2026-05-31; Status: monitor	E94: NVD APIs expose vulnerability surfaces for finance-agent infrastructure dependencies such as agent frameworks, vector databases, model servers, workflow engines, and connectors. Limitation: verify dated release or consultation status before relying on timing.	Open source
89	CISA Known Exploited Vulnerabilities catalogue	Publisher: CISA; Kind: Security advisory; Checked: 2026-05-31; Status: monitor	E95: CISA's known-exploited-vulnerabilities catalogue gives a separate exploited-vulnerability screen for dependencies behind agentic finance systems. Limitation: verify dated release or consultation status before relying on timing.	Open source
90	OpenAI status page	Publisher: OpenAI status page; Kind: Status page; Checked: 2026-05-31; Status: monitor	E96: OpenAI status is an operational-resilience input for routes that depend on OpenAI APIs or ChatGPT Enterprise features. Limitation: verify dated release or consultation status before relying on timing.	Open source
91	Anthropic status page	Publisher: Anthropic; Kind: Status page; Checked: 2026-05-31; Status: monitor	E97: Anthropic status is an operational-resilience input for routes that depend on Claude, MCP connectors, or Anthropic-hosted agent workflows. Limitation: verify dated release or consultation status before relying on timing.	Open source
92	Google Cloud status page	Publisher: Google; Kind: Status page; Checked: 2026-05-31; Status: monitor	E98: Google Cloud status is an operational-resilience input for routes that depend on Gemini, Vertex AI, Agentspace, or Google Cloud data infrastructure. Limitation: verify dated release or consultation status before relying on timing.	Open source
93	Azure status page	Publisher: Azure; Kind: Status page; Checked: 2026-05-31; Status: monitor	E99: Azure status is an operational-resilience input for routes that depend on Microsoft Foundry, Azure OpenAI, Microsoft 365 Copilot, or Dynamics integrations. Limitation: verify dated release or consultation status before relying on timing.	Open source
94	AWS Health Dashboard	Publisher: AWS; Kind: Status page; Checked: 2026-05-31; Status: monitor	E100: AWS Health is an operational-resilience input for routes that depend on Bedrock, AgentCore, SageMaker, DynamoDB, Kendra, or financial-services workloads on AWS. Limitation: verify dated release or consultation status before relying on timing.	Open source
95	RDAP bootstrap registry	Publisher: RDAP bootstrap registry; Kind: Domain registry; Checked: 2026-05-31; Status: monitor	E101: RDAP domain metadata is a public surface for tracking vendor domain ownership, nameserver moves, and infrastructure change signals. Limitation: verify dated release or consultation status before relying on timing.	Open source
96	crt.sh certificate search	Publisher: crt.sh certificate search; Kind: Certificate transparency; Checked: 2026-05-31; Status: monitor	E102: Certificate-transparency search exposes new subdomains and trust-surface expansion for finance-agent vendors, clouds, and integrations. Limitation: verify dated release or consultation status before relying on timing.	Open source
97	US Senate Lobbying Disclosure Act database	Publisher: US Senate Lobbying Disclosure Act database; Kind: Lobbying data; Checked: 2026-05-31; Status: monitor	E103: US Senate LDA filings are a monitorable pressure source for AI liability, banking, securities, payments, data, consumer finance, copyright, and preemption lobbying. Limitation: verify dated release or consultation status before relying on timing.	Open source
98	FEC dates and deadlines	Publisher: FEC dates and deadlines; Kind: Election calendar; Checked: 2026-05-31; Status: monitor	E104: FEC calendars are timing inputs for US election-cycle risk that can affect hearings, agency oversight, appropriations, and federal AI preemption debates. Limitation: verify dated release or consultation status before relying on timing.	Open source
99	RegulationRoom - EU AI Act service desk timeline	Publisher: RegulationRoom; Kind: Regulatory timeline; Checked: 2026-05-31; Status: monitor	E105: The AI Act implementation timeline is a dated monitor for EU AI Act obligations that may affect financial-services agent approvals. Limitation: verify dated release or consultation status before relying on timing.	Open source
100	European Commission - AI Act high-risk classification consultation	Publisher: European Commission; Kind: Regulatory consultation; Checked: 2026-05-31; Status: monitor	E106: The European Commission high-risk classification consultation closes on 23 June 2026 and is relevant because classification guidance can change which financial AI uses need high-risk controls. Limitation: verify dated release or consultation status before relying on timing.	Open source
101	Cloud Security Alliance - AI Controls Matrix	Publisher: Cloud Security Alliance; Kind: Security framework; Checked: 2026-05-31; Status: monitor	E107: The Cloud Security Alliance AI Controls Matrix gives a security-control lens for agentic finance workflows, especially where cloud platforms, connectors, and model providers are part of the workflow. Limitation: verify dated release or consultation status before relying on timing.	Open source
102	OWASP - Top 10 for LLM Applications	Publisher: OWASP; Kind: Security framework; Checked: 2026-05-31; Status: monitor	E108: OWASP's LLM application risks give a practical adversarial-testing lane for prompt injection, data leakage, insecure output handling, excessive agency, and supply-chain risk. Limitation: verify dated release or consultation status before relying on timing.	Open source
103	European Commission - draft AI transparency-obligations guidelines	Publisher: European Commission; Kind: Regulatory consultation; Checked: 2026-05-31; Status: monitor	E112: The European Commission's draft AI transparency-obligations consultation closed on 3 June 2026 and says Article 50 transparency duties apply from 2 August 2026 for AI-system interactions and certain AI-generated or manipulated content. Limitation: verify dated release or consultation status before relying on timing.	Open source
104	Rogo - BigFinanceBench announcement	Publisher: Rogo; Kind: Vendor reported benchmark; Checked: 2026-05-31; Status: monitor	E113: Rogo's vendor-reported May 2026 BigFinanceBench announcement describes a 928-question workflow-grounded benchmark across financial workflows, scored with 15,656 rubric criteria and 36,241 weighted points; Rogo reports top closed models are separated by less than 0.3 percentage points overall and that a workflow/source router improves rubric score by 4.5 percentage points over the best single model. Limitation: verify dated release or consultation status before relying on timing.	Open source
105	Anthropic - introducing Claude Opus 4.8	Publisher: Anthropic; Kind: Official model documentation; Checked: 2026-05-31; Status: monitor	E114: Anthropic's 28 May 2026 Opus 4.8 launch benchmark table reports Claude Opus 4.8 at 53.9% on Finance Agent v2, above Opus 4.7 at 51.5% and GPT-5.5 at 51.8%, while a footnote reports Gemini 3.5 Flash at 57.9%. Limitation: verify dated release or consultation status before relying on timing.	Open source
106	MLFinLab documentation	Publisher: MLFinLab documentation; Kind: Expert profile; Checked: 2026-05-31; Status: monitor	E115: MLFinLab documentation is a public method source for financial-ML validation and leakage-control practices. Buying use: use it as a method signal, not as evidence of a person's location or current role. Limitation: verify dated release or consultation status before relying on timing.	Open source
107	ServiceNow Store - Now Assist for Accounts Payable Operations	Publisher: ServiceNow Store; Kind: Vendor documentation; Checked: 2026-05-31; Status: monitor	E116: ServiceNow Store lists Now Assist for Accounts Payable Operations as a paid generative-AI app for AP operations, supporting a separate AP case-handling and approval lane. Limitation: verify dated release or consultation status before relying on timing.	Open source
108	Stripe - Machine Payments Protocol	Publisher: Stripe; Kind: Payments infrastructure; Checked: 2026-05-31; Status: monitor	E117: Stripe's Machine Payments Protocol positions agent-triggered payments as a payments-infrastructure route that still needs fraud, tax, reporting, authorization and reconciliation controls. Limitation: verify dated release or consultation status before relying on timing.	Open source
109	Alloy - Identity orchestration and fraud risk decisioning engine	Publisher: Alloy; Kind: Kyc fraud infrastructure; Checked: 2026-05-31; Status: monitor	E118: Alloy describes an identity-orchestration and fraud-risk decisioning engine that connects many third-party data sources and supports fast decisioning across global markets. Limitation: verify dated release or consultation status before relying on timing.	Open source
110	Plaid - agents in action	Publisher: Plaid; Kind: Financial data infrastructure; Checked: 2026-05-31; Status: monitor	E119: Plaid describes agent use around categorization, fixes and product resilience, making permissioned financial-data quality and correction loops part of the agent evidence path. Limitation: verify dated release or consultation status before relying on timing.	Open source

Terms used in this report

Term	Plain meaning
Route	The approved path from work to accepted output: source set, data boundary, model or vendor channel, tools, reviewer, evidence record and reapproval trigger.
API	Application programming interface: a governed software connection used by an app or workflow to call a model or service.
LLM	Large language model: a model trained to read and generate text-like tokens.
Token	A chunk of text used for billing, context windows and rate limits. It is usually smaller than a word, not a page count.
RAG	Retrieval-augmented generation: search approved sources first, then pass selected evidence into the model.
OCR	Optical character recognition: converting scanned or image text into machine-readable text.
SLA	Service-level agreement: a contractual availability or support commitment, not observed uptime history.

Definitions are reader aids, not separate evidence claims.