Generative AI in Banking: Security & Compliance Requirements

Short answer: Yes.

Banks, wealth managers, and lenders can deploy generative AI copilots today without putting customer data or their next examination at risk. The outcome depends on the controls around the model: who can reach it, which data it can read, where that data is processed, who reviews its output, and how you prove all of that to an auditor later.

Generative AI in banking is past the pilot stage: advisors want faster meeting prep and credit teams want faster document review. This guide lays out the six requirements a compliant banking copilot has to meet, a reference architecture on Microsoft Azure, and the data-control questions your risk team will ask first.

The real question isn’t “if”: it’s “with which controls”

Most financial institutions of any size already have generative AI in the building, approved or not. Employees paste text into consumer chat tools, and vendors ship AI features inside software the bank already licenses. Blocking the category outright pushes usage out of sight, which is the worst outcome for a risk officer. The useful question is which controls make a given use case acceptable: a copilot that summarizes internal policy carries different risk than one that suggests credit decisions.

There is also a regulatory wrinkle. In April 2026 the OCC, Federal Reserve, and FDIC replaced the long-standing SR 11-7 model risk guidance with revised, principles-based guidance. That revision explicitly leaves generative and agentic AI outside its scope, and points banks to their broader risk management and governance practices instead. No regulator has handed you a GenAI checklist, so your institution has to design the controls and be ready to defend them. That is why we argue governance and architecture matter more than which model vendor you pick.

Six requirements for a compliant banking copilot

These are the requirements we hold every financial-services AI deployment to. Treat them as a checklist for your own program.

Private, controlled infrastructure. The model runs inside your Azure tenant, behind private networking, under your existing cloud security controls. Prompts and responses should never travel to a public consumer service.
Role-based access control (RBAC). The copilot only sees what the person asking is allowed to see. A branch employee should not be able to surface a commercial borrower’s file just by asking a clever question.
Retrieval on approved sources. Ground answers in a curated, permission-aware set of documents and data using retrieval-augmented generation (RAG), not the open internet. If a source is not approved, it is not indexed.
Human-in-the-loop. Anything that touches a customer outcome (credit, disclosures, complaints, account changes) gets a named human reviewer before it takes effect. The copilot drafts; a person decides.
Runtime AI security. Filter prompts and outputs in real time for prompt injection, jailbreak attempts, and sensitive data leaving the boundary, and feed those signals to your security operations team.
Model risk management. Inventory every AI use case, tier it by risk, validate it before production, and monitor it after. The 2026 guidance excludes GenAI from its scope, but the disciplines it describes (effective challenge, validation, ongoing monitoring) are still the right ones to borrow.

The hardest of the six is usually the second. Copilots are good at finding things, so oversharing that already exists in SharePoint, Teams, or a file share becomes visible fast. Fixing permissions first is the step most institutions underestimate. For the full governance model behind requirement six, see our guide to responsible AI and model-risk management.

Reference architecture on Microsoft Azure

Here is the Microsoft-native pattern we use as a starting point with financial-services clients.

LAYER	MICROSOFT SERVICE	WHAT IT DOES FOR COMPLIANCE
Model	Azure OpenAI in Microsoft Foundry	Runs the model in your Azure tenant; prompts and completions are not used to train foundation models
Identity and access	Microsoft Entra ID	Single sign-on, Conditional Access, and the user identity that drives RBAC on every request
Retrieval	Azure AI Search over approved sources	Returns only content the requesting user is entitled to see
Data protection	Microsoft Purview	Classifies and labels sensitive data, applies data loss prevention, and audits AI interactions
Runtime safety	Foundry Guardrails (formerly content filters) and Prompt Shields	Screens prompts and outputs for harmful content and injection attempts
Threat detection	Microsoft Defender for Cloud and Microsoft Sentinel	Flags attacks against AI workloads and routes alerts into your SOC for investigation

The pattern only holds if the foundation underneath is sound: private endpoints, a governed landing zone, and logging your auditors can query. That is the work behind secure Azure cloud foundations, and it is where banking copilot projects succeed or stall long before anyone writes a prompt.

Two assembly lessons: label your data in Purview before you index it, because the copilot inherits whatever labels (or gaps) exist on day one. And connect AI telemetry to Sentinel from the first pilot, so your SOC has a baseline before real users arrive.

Data residency, zero-retention, and customer-managed keys

Risk and compliance teams tend to ask three questions about data control. Here is what Microsoft documents today for Azure OpenAI in Microsoft Foundry.

Data residency. With a standard (regional) deployment, prompts and responses are processed in the Azure geography you choose. Global and DataZone deployment types can process data in other locations (a US DataZone keeps processing inside the United States), while data at rest stays in your designated geography. Pick the deployment type deliberately, and document why.

Zero-retention. By default, Microsoft can store prompts and completions for up to 30 days for abuse monitoring. Eligible customers can apply for modified abuse monitoring, which turns that storage and human review off for an approved resource. You can then verify the setting yourself in the Azure portal or CLI, which gives auditors something concrete.

Customer-managed keys. Data the service stores at rest (uploaded files, fine-tuning data, conversation history for stateful features) is encrypted by default, with the option to use your own keys. Some preview features may not support customer-managed keys, so check before you rely on one.

These settings control what happens inside the model service. They do not replace data governance and protection across your estate, which decides what reaches the model at all.

Case study: How Concurrency, Inc. built an AI-ready advisor experience for a wealth manager

Challenge. A large financial services and wealth management organization had a legacy household summary application that advisors found hard to navigate and expensive to maintain. Client information was split across activities, communications, tasks, and opportunities, so advisors switched between screens and assembled meeting prep by hand.

Approach. Rather than bolting AI onto a fragmented system, Concurrency rebuilt the household management application on the firm’s existing Microsoft Dynamics 365 and Dataverse investment, with a single advisor workspace. The goal was a clean, governed foundation first. Read the full advisor experience case study.

Outcome. Advisors now get one view of household activities, communications, opportunities, and tasks, on an architecture designed to support AI capabilities such as meeting preparation and activity summarization.

A copilot that summarizes a client relationship is only as accurate, and as access-controlled, as the data model under it. We took the same approach with a Midwest bank holding company’s loan portfolio reporting: about 65 Power BI report pages in roughly eight weeks, with role-based security so each office sees only its own data. A copilot on that data has to respect the same permissions.

How Concurrency approaches this

Concurrency has helped clients adopt new technology since 1989, and financial services is one of the industries we work in most. We act as an extension of your team: your risk and compliance leaders set the guardrails, and we engineer them into the platform so the system enforces them. We also use AI in our own delivery, so we live with these controls ourselves.

A typical engagement starts with an assessment that inventories your AI use cases, ranks them by risk and value, checks permissions and data labeling, and produces a plan your risk committee can sign. For how that plan scales across the institution, see our guide to scaling generative AI from pilot to production. Our generative AI consulting team then builds the first use case end to end.

Frequently Asked Questions

Is Microsoft Copilot safe for banks?

Microsoft 365 Copilot works within your Microsoft 365 tenant, respects the permissions users already have, and Microsoft states that prompts and responses are not used to train its foundation models. The bigger risk is internal: Copilot surfaces anything a user can already access, so clean up oversharing in SharePoint and Teams and apply Microsoft Purview sensitivity labels before rollout.

How do you keep generative AI compliant with financial regulations?

Treat each AI use case as something you have to explain to an examiner. Inventory it, tier it by risk, validate it before launch, keep a human reviewer on decisions that affect customers, and log every interaction. Recent US model risk guidance leaves generative AI to banks’ broader risk management practices, so documenting your own controls matters more, not less.

What data controls do regulated AI deployments need?

At minimum: processing in a geography you choose, encryption at rest with the option of customer-managed keys, a documented position on abuse-monitoring retention, and permission-aware retrieval so users only see data they are entitled to. Around the model, you also need data classification, DLP, and audit logging, which Microsoft Purview provides across the Microsoft estate.

Ready to deploy generative AI with the controls your regulators expect? Request a free AI assessment and we will map your highest-value use cases against these six requirements.