AI agents in Swiss finance: explain and prepare, never just act

A concrete example: policy answers

A service agent answers a customer question using only the institution’s approved, versioned policy library. The response links to its source and says so when the available material cannot support an answer. Outdated and conflicting policies, missing language variants and a hidden instruction inside a retrieved file all belong in the test set.

The content owner is responsible for approved sources and retirement dates. The agent owner is responsible for retrieval settings and refusal behaviour. Compliance and legal teams decide whether the workflow needs extra review — the technical result never makes that decision for them.

Keep every customer’s data apart

We test role and customer-account boundaries across profiles, transactions, internal research and support records. Retrieval must filter before context reaches the AI. Hiding names in the final answer is too late if another customer’s data already entered the prompt or the record.

Prepare a payment — without executing it

In the draft payment workflow, the agent may collect invoice details and create a draft in a restricted system. It cannot release funds. A reviewer sees payer, payee, account, amount, currency, due date and source document — then approves those exact details through the payment service.

Verification submits the draft without approval, changes the amount after approval, reuses an old approval and attempts a second customer’s payment. All four must fail. The evidence links agent version, authorization decision, reviewed details, reviewer identity and downstream result — without exposing unnecessary customer data.

Your procurement and operations pack

Ask for the versioned workflow and policy sources, customer-separation design, tool scopes, approval and reuse tests, tamper-showing records, incident responsibilities, regression history and remaining-risk statement. Platform certificates can never replace evidence from your configured financial workflow.

The business owner owns permitted use and fallback, security owns authorization criteria, data protection reviews personal-data flows, operations owns monitoring and containment, and the accountable financial function keeps decision responsibility. Important connector, permission or policy changes trigger review before the quarterly rhythm.