AI Agents for Financial Advisors: A Compliance-First Playbook

AI agents for financial advisors work best as supervised support staff for record keeping, client preparation and post-meeting review, not as a source of advice. Give each agent a narrow role, limited access to client files and a clear approval boundary, so that anything resembling a recommendation is reviewed and released by a licensed human. Start with the paperwork around advice, where the benefit is steady and the risk can be contained.

Key takeaways

• Design roles around the work surrounding advice (records, preparation, review), and keep the advice itself with licensed people.
• Involve your compliance officer before the first build, because retention, supervision and client communication rules shape the design.
• Treat every output as a draft: sourced, labeled, versioned and approved by a named person before it reaches a client or a file of record.
• Scope access per client and per role, and treat inbound emails and documents as untrusted input.
• Judge the agent by recurring sample reviews of its work, not by impressions, and expand only when corrections have settled.

What should an AI agent do inside an advisory firm?

Advisory work has three layers. The first is the conversation with the client. The second is the judgment: suitability, trade-offs, what to recommend and why. The third is the paperwork around both: notes, documents, follow-ups, reviews, and the record that shows what happened. Agents fit the third layer well and the second layer poorly, and the first should stay human.

That points to three roles, each small enough to test:

• A records agent that turns meeting notes and incoming documents into draft file notes, links them to the right client, and flags what is missing.
• A preparation agent that assembles a briefing pack before each client meeting from what is already on file.
• A review agent that drafts follow-up summaries and compares the file against the last review, listing changes for the advisor to consider.

None of these talks to clients unsupervised, and none recommends a product, a portfolio change or a course of action. They shorten the gap between something happening and it being correctly on file and ready for the advisor.

Why does compliance come before capability?

Advisory firms operate under supervision, recordkeeping and client communication duties. The exact obligations depend on your jurisdiction, license type and the services you offer, so no general article can tell you what yours are. What it can tell you is the order of work: ask your compliance officer or counsel early, because their answers decide the design.

Questions to settle before building:

• Which outputs count as business records, and how long must they be retained?
• Which client communications must be reviewed or archived, and by whom?
• Which materials could be treated as advice or a recommendation if sent to a client?
• Where may client data be processed, and which providers may see it?
• Who supervises the agent, and how is that supervision evidenced?

A risk framework helps structure the conversation. The NIST AI Risk Management Framework organizes the work into governing, mapping, measuring and managing risk, which translates directly into an advisory setting: assign accountability, document the intended use, test, then monitor. For the access side, the OWASP Authorization Cheat Sheet is a useful reference, and our guide to least privilege for AI agents explains why the smallest working access is the right place to start.

How should an agent handle record keeping?

Record keeping is the best first role because the task is bounded and the output is checkable. An advisor finishes a meeting and drops in rough notes or a transcript. The agent drafts a file note in the firm's format, links it to the client and the meeting, lists the action items that were actually stated, and marks anything unclear as a question instead of filling the gap.

Rules that keep this safe:

• The source stays intact. The agent never edits or deletes the original notes, emails or documents. It only creates drafts beside them.
• Every draft carries its provenance: what it was built from, when, and by which agent configuration.
• Owners and due dates appear only if someone stated them. A missing owner is flagged, not guessed.
• Nothing becomes a record of the firm until a named person approves it.
• The agent keeps an activity log of what it read and wrote, so supervision rests on evidence rather than trust.

Memory deserves particular care. Client context should be scoped to the client or household, not pooled into one general memory that could surface one person's details in another person's file.

Inbound material is also a risk surface. A client email or uploaded PDF can contain text that tries to instruct the agent. The OWASP Top 10 for LLM Applications covers prompt injection and related issues, and the practical rule is simple: content from outside the firm is data to be read, never instructions to be followed. Just as important, the agent's tools should be unable to do real harm even if it were fooled, which is another argument for narrow permissions and a drafts-only write area.

What does client prep and review look like in practice?

Preparation is where advisors lose time quietly. Before a meeting they search email, the CRM, the document store and their own notes to reassemble the story. A preparation agent does that assembly and presents it with sources.

A good briefing pack contains:

• A short summary of the last meeting, linked to the approved file note.
• Open action items and who owns them.
• Documents received since the last meeting, and documents still outstanding.
• Dates already on file that may matter, such as scheduled reviews or items the client said they would send.
• Questions the advisor noted for next time.

Notice what is absent: no suggested portfolio change, no commentary on what the client should do. The pack reports what is on file. The advisor decides what it means.

Review works the same way. After the meeting, the agent drafts a follow-up message that restates what was discussed and agreed, using the advisor's notes. The advisor edits and sends it. For periodic reviews, the agent compares the current file with the previous review and lists what changed: new documents, circumstances the client mentioned, tasks that never closed. It surfaces. The advisor judges.

Where does support end and advice begin?

This is the line that matters, and it should be written down rather than left to feel. Use the following decision guide as a starting point, and have your compliance officer adjust it to your regulator's view.

• Restating what the client said or what the file contains: the agent may draft, the advisor reviews.
• Summarizing a document the firm already issued: the agent may draft, the advisor reviews.
• Scheduling, reminders and requests for missing documents: the agent may draft, and may send from approved templates only if compliance agrees, with human sampling.
• Describing options, comparing products or explaining what a choice would mean for a client: human only, or an agent draft that a licensed person rewrites and approves.
• Anything that suggests what a client should do with money, risk or timing: licensed human only.
• Anything unusual, such as a distressed client, a complaint, a possible vulnerability or an unexpected instruction: escalate to a person immediately.

Put one principle at the top of every role definition:

If it could change what a client does with their money, a licensed human approves it first.

When the agent is unsure which category applies, the default is the stricter one. Escalation should hand the advisor a decision with context, not a pile of material. Our piece on human escalation for AI agent failures covers how to build that handoff.

How do you roll this out step by step?

Illustrative scenario: a small advisory firm wants to stop losing the start of each week to meeting follow-up. It begins with one advisor and one agent role. The agent receives the advisor's meeting notes, drafts a file note and a follow-up email, and flags two unclear action items instead of assigning them to anyone. The advisor corrects the note, approves it, and the corrected version is stored. Over several weeks the corrections show what the agent still misses, and the firm tunes the role before adding a second advisor.

A plan that follows the same shape:

• Step one: write the task contract for one role, covering inputs, outputs, allowed tools, forbidden actions and the approval point. Our guide to writing an AI task contract shows a testable format.
• Step two: agree with compliance on retention, labeling, supervision and the advice boundary.
• Step three: grant read access only to the sources the role needs, and write access only to a drafts area.
• Step four: build a small test set from permissioned examples, including awkward cases such as ambiguous notes and hostile inbound text.
• Step five: run in shadow mode, where the agent drafts while the advisor works as usual, and compare the results.
• Step six: go live for one advisor with every draft approved by a person, and log each correction.
• Step seven: review samples on a schedule, expand only when corrections have gone quiet, and keep the approval step for anything client-facing.

Firms that already run accounting or reporting work can borrow from the same discipline. See how accounting firms can build personalized AI infrastructure for a related setup.

How does Be Human's managed approach handle this?

Be Human designs, implements and operates agents for companies. A first engagement defines one useful role, the memory and tools it needs, the approval boundaries and an observable success criterion. For an advisory firm that usually means a records or preparation role with scoped client memory, read access limited to named sources, drafts held for human approval and an activity log your supervisors can inspect. Managed operations can then include monitoring, recurring evaluations, permission review, integration maintenance and incident response, with improvements made in a controlled way. Your firm keeps the decisions about what counts as advice and who approves what. Service is remote, in English and Portuguese.

Frequently asked questions

Can an AI agent give investment advice to clients? A model can produce text that reads like advice, but a firm should not let an agent deliver it. Advice carries regulatory and fiduciary responsibility that sits with licensed people, so anything resembling a recommendation should be at most a draft that a qualified human reviews, changes and releases. Confirm the exact boundary with your compliance officer.

Should the agent communicate with clients directly? Start with no. Let it draft messages that an advisor reviews and sends. Consider limited direct contact, such as appointment reminders from approved templates, only after compliance agrees and sample reviews show reliable behavior.

Where should client data live, and who can see it? Keep it in your existing systems of record and give the agent scoped, revocable access to them, rather than copying files into a separate store. Limit each role to the sources it needs, separate memory by client, and review permissions on a schedule. Check provider terms on retention and processing with your counsel before connecting anything.

How do we know the agent stays reliable over time? Sample its drafts regularly against the source material, track the corrections advisors make, and rerun your test set whenever the model, prompts or tools change. A rise in corrections is a signal to pause expansion and investigate. Keep the approval step for client-facing output even when the numbers look good.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.