AI agents for finance, compliance and audit

An AI agent working on financial data is not a chatbot. It is a system that takes operational decisions. Internal audit, risk management and compliance will ask: who authorised this action? Which model decided? On what data? Is the log immutable? Was the four-eyes principle respected?

We design agentic architectures with governance built in as an architectural constraint, not as a feature bolted on at the end:

• Human-in-the-loop approval gates before any write action by the agent
• Tamper-evident audit trail on Postgres, encrypted and hash-chained, with a configurable retention period
• RBAC with domain segregation between front office, risk, compliance and IT
• Complete LLM logging: input, output, model version, timestamp — for every inference

Every decision the agent takes can be explained: who triggered it, which model decided, on what data, at what time. That is the level of traceability regulators and internal audit expect.

Regulatory alignment: DORA (operational resilience, incident logging), MiFID II (traceability of decisions), the EU AI Act (obligations for high-risk systems), GDPR (data minimisation, right to explanation).

Sector experience: we implemented Dynamics 365 CRM for Banca Mediolanum, illimity Bank and Unipol — Italian banking and insurance groups where data segregation, audit trails and multi-level approvals were non-negotiable requirements. The same governance discipline now drives how we design agentic AI systems.

The infrastructure runs on Nexus MDS Core: on-premise deployment, Keycloak for RBAC, n8n for approval workflows, Postgres for the audit trail. No hyperscaler lock-in. EU data residency follows from the architecture.