How AI Support Agents Stay Compliant in Financial Services (2026)

TL;DR: AI support agents stay compliant in financial services through layered system design, never through model accuracy alone. The pattern that holds up: deterministic workflows execute regulated steps outside the model, runtime guardrails screen incoming messages and outgoing drafts, every action lands in a replayable audit trail, adversarial simulation runs before launch, and data terms include no training on customer data plus zero retention with model vendors. Certifications such as SOC 2 Type II are the entry requirement, never the differentiator. This guide teaches that framework first, then compares eight platforms against it.

The question matters because regulators have stopped treating support automation as a curiosity. The CFPB has warned that financial institutions risk violating legal obligations when a chatbot gives inaccurate information or traps customers in loops without a path to a human. In the UK, the FCA's Consumer Duty holds firms to good outcomes on every interaction, including the ones an AI handles. An AI agent that misstates a fee has created a regulatory event, and the deployment has to be designed with that possibility priced in.

This guide is written for compliance officers, CX leaders, and founders at banks, lenders, fintechs, and insurers who are evaluating AI support for financial services. It covers the five control layers that make an agent defensible in front of a regulator, how to evaluate vendors against those layers, and where eight current platforms stand. One framing note up front, borrowed from the field engineers who do this work: building AI support correctly in a regulated environment is, before anything else, an understanding problem. The technology is the easy half; knowing which conversations carry regulatory weight is the hard half.

Why financial services is different

In most industries, a wrong answer from a support bot costs a follow-up ticket. In financial services, it can cost a remediation program. Three named regimes illustrate the stakes, described here for orientation rather than as legal advice:

• UDAAP (US). Under the Consumer Financial Protection Act, giving customers inaccurate information about fees, rates, or account status can constitute an unfair, deceptive, or abusive act or practice. The CFPB has made clear this applies to information delivered by chatbots, which turns hallucination control into a compliance obligation rather than a product-quality preference.

• Regulation E (US). Electronic fund transfer disputes carry strict investigation timelines and documentation duties. An AI agent that mishandles the intake of a dispute, or fails to recognize one, starts a clock the institution does not know is running. We cover this scenario in our guide to Reg E dispute compliance with AI.

• FCA Consumer Duty (UK). Firms must deliver good outcomes for retail customers, with heightened care for customers showing signs of vulnerability or financial difficulty. A missed-repayment conversation handled by an AI agent falls squarely inside this duty.

The EU AI Act adds a horizontal layer: AI used to assess creditworthiness is classified as high-risk, with documentation and human-oversight duties attached. And the CFPB has documented the "doom loop" pattern, where customers get stuck inside automation with no route to a person. That is why deflection rate, the metric many vendors lead with, is the wrong yardstick for this sector. A deflected customer whose dispute never got filed is a compliance problem wearing a cost-saving costume.

The consequence for buyers: an AI agent in financial services has to be evaluated as a regulated system, with the same discipline applied to any other system that talks to customers about their money. The five layers below are the framework practitioners actually use.

Layer 1: Put regulated steps behind deterministic workflows

The single most important design decision is choosing what the model is never allowed to improvise. Generative models are probabilistic; regulated process steps are procedural. Identity verification, payment execution, mandated disclosures, dispute intake, and hardship escalations should run as deterministic workflow steps that execute identically every time, regardless of how the conversation arrived there.

In a well-designed system, the deterministic layer works like this:

• The agent triggers workflows; it does not perform them. A payment or one-time-passcode step runs as sealed code. The model sees the result ("verification passed"), never the internals, so conversational manipulation cannot alter how the step executes.

• Tool access is scoped to the workflow. The agent holds a tool only while the workflow that needs it is active. An agent answering a balance question has no refund tool available to misuse.

• Actions carry hard execution caps. Per-refund limits, rate limits, and value ceilings are enforced in code. Even a fully manipulated conversation cannot exceed them.

• Sensitive actions are gated on authentication. A tool that changes account data fires only after the customer passes verification, enforced server-side rather than by the model's judgment.

This is the architecture behind Lorikeet's AI agents, where structured workflows carry sensitive calls such as one-time passcodes and payments, and the model cannot see or modify their internals. Whichever platform you choose, ask the vendor to show you where the deterministic boundary sits in the product. A platform that routes everything through the model has no boundary to show. For a deeper treatment of this layer, see our practitioner's guide to AI compliance.

Layer 2: Guardrails on the AI layer, designed for blast radius

Every AI system that processes natural language is susceptible to prompt injection. Lorikeet's own security documentation puts it bluntly, describing vendors who claim immunity as "either uninformed or dishonest." The mature question is what a successful manipulation can reach. The design goal is a blast radius of a single conversation: no lateral movement into other customers' data, no persistent compromise of the system, no action beyond the caps set in Layer 1.

Within that frame, runtime guardrails do real work on both sides of the exchange:

• Incoming checks classify customer messages for prompt-injection patterns and bad-actor behavior, escalating suspicious conversations to humans before damage compounds.

• Outgoing checks inspect the draft response before it reaches the customer, and can block, rewrite, or escalate it. Grounding checks compare claims against source content to catch hallucinations; canary tokens detect attempts to exfiltrate system prompts.

• Configurable stringency lets teams choose, per topic, whether a triggered guardrail steers the agent, tags the ticket for review, or hard-escalates to a human.

Two honest caveats belong in any guide that teaches this layer. First, streamed responses complicate the claim that "every response is checked" before delivery; ask vendors how their checks interact with streaming rather than accepting the absolute. Second, guardrails vary widely in sophistication: some are semantic classifiers, some are keyword rules. Lorikeet's keyword-based guardrail rules, for instance, are exact-match today, so a team relying on them needs to enumerate variants. The details of this layer are documented on Lorikeet's trust center, and our guides to hallucination prevention and transparent AI support platforms go deeper on each control.

Layer 3: Audit trails a supervisor can replay

When a regulator asks why the agent said what it said six months ago, "the model decided" is not an answer. An audit-ready record captures every message, every retrieved document, every tool call, every guardrail check that fired, and the reasoning connecting them, on every ticket, in a form a compliance analyst can replay without engineering help.

Three properties separate a real audit trail from a chat log:

• Action-level logging. When the agent executes a refund or updates an address, the trail records the action, its authorization, and its outcome alongside the conversation itself.

• Guardrail events as tracked outcomes. Escalations triggered by guardrails should be a first-class, quantifiable ticket outcome, so compliance teams can report on how often controls fire and why.

• Quality scoring on 100% of interactions. Sampled QA was built for human teams. AI-run support can be scored on every ticket; Lorikeet's TQS system quality-scores all of them, whether a human or the AI handled the case. See Lorikeet's quality assurance product and our review of compliance QA tools for financial services support.

During procurement, test this directly: pick a closed conversation in the demo environment and ask the vendor to reconstruct it step by step, including the guardrail checks that fired. The speed and completeness of that reconstruction predicts how every future complaint investigation will feel.

Layer 4: Simulate and red-team before customers arrive

In regulated deployments, launch day is the wrong time to discover how the agent handles a hardship disclosure. Simulation-first development means running the agent against large volumes of synthetic conversations before any customer sees it: happy paths, edge cases, and deliberately adversarial sessions designed to break it.

A serious pre-launch program includes four elements:

• Bulk simulations across realistic scenario libraries, rerun as regression suites whenever workflows or knowledge content change.

• Adversarial modes in which the simulator plays a hostile customer attempting injections, social engineering, and policy circumvention. Lorikeet runs hundreds and thousands of adversarial simulations per deployment.

• Guardrail test scenarios that verify each control fires when it should, and stays quiet when it should not.

• External pressure: third-party red-team engagements and, ideally, a standing public challenge. Lorikeet operates Own Goal, a public hack-our-agent challenge, alongside third-party AI red-teaming.

Our guide to red-teaming an AI support agent and our comparison of adversarial simulation and red-team platforms cover how to run this yourself during a proof of concept, including how to convert your worst historical tickets into test scenarios.

Layer 5: Data handling that assumes scrutiny

Financial data raises the floor on data handling. The terms to demand, in roughly descending order of importance:

• No training on customer data, written into the contract rather than the marketing page.

• Zero-data-retention agreements with model vendors, so conversation content is processed ephemerally by the LLM providers underneath the platform.

• Automatic PII redaction before content reaches systems that do not need it, plus minimum-necessary handling for any health-adjacent data.

• Encryption and isolation: TLS 1.3 in transit, AES-256 at rest, tenant isolation, and production infrastructure with no public internet path.

• Residency, stated precisely. Ask where data is stored and, separately, where inference runs. Lorikeet, for example, offers US, AU, and EU storage residency; inference is not in-region. Any vendor's residency claim deserves that same two-part question.

Certifications wrap this layer: SOC 2 Type II, ISO 27001, HIPAA with a BAA where relevant, and GDPR. Treat them as the entry ticket. Every serious vendor holds SOC 2; none of the interesting differences between platforms show up there. Our GDPR requirements checklist and our comparison of GDPR-compliant AI support platforms cover the privacy side in detail.

A worked example: the missed-repayment conversation

Consider the hardest common case in consumer credit support: a customer writes in about a missed repayment. The five layers combine like this. The agent converses naturally about the situation, which is the part language models are genuinely good at. Vulnerability and financial-difficulty signals in the customer's messages act as guardrail triggers, tagged or escalated depending on configuration. If the conversation reaches a payment arrangement, the arrangement executes as a deterministic workflow, gated on identity verification, with amounts bounded by hard caps. Every step, from the retrieved policy to the tool call, lands in the audit trail. And before launch, this exact scenario ran hundreds of times in simulation, including adversarial variants where the simulated customer tries to talk the agent into waiving the debt entirely.

This is the shape of the deployment at Carmoola, an FCA-regulated UK car finance provider, where an agent named Katie reasons through missed-repayment and affordability conversations and 60% of support resolves end-to-end.

How we evaluated the platforms

With the framework set, the vendor question becomes tractable. We assessed eight platforms against five criteria, in priority order:

1. Named-regulation depth. Does the vendor publish guidance or controls mapped to specific regimes (FCA Consumer Duty, Reg E, UDAAP), or stop at a certificate list?

2. Compliance guardrails. Are there runtime controls on both incoming messages and outgoing drafts, and are they built in rather than assembled by the buyer?

3. Deterministic workflow support. Can regulated steps run outside the model, with scoped tools and hard caps?

4. Audit trail depth. Is every action and guardrail check replayable by a non-engineer?

5. Production proof in regulated support. Are there published customer stories in regulated deployments, with the customer standing behind the numbers?

Evidence came from vendor security and trust documentation, published customer stories, and vendors' own comparison guides. Deflection rate did not factor in, for the reasons covered above. Where a strength or weakness is stated below, it is sourced from published materials; we have not invented pricing or private benchmark numbers, and "not published" means exactly that rather than "does not exist." Definitions for terms used throughout are in our support glossary.

The 8 platforms at a glance

The 8 platforms in detail

1. Lorikeet

Best for: complex, regulated support where the agent must take real actions safely, particularly consumer fintech and healthtech.

Lorikeet describes itself as a platform that complex and regulated businesses use to give their customers a universal concierge, purpose-built for the hardest 20% of interactions, the moments where care is paramount and error has consequences. Its architecture maps directly onto the framework above. Structured, deterministic workflows carry sensitive calls such as one-time passcodes and payments, with the model seeing results and never internals. Workflow-scoped tool access and hard execution caps bound what any single conversation can do. Dual-sided runtime guardrails check incoming messages and outgoing drafts with configurable stringency, backed by a grounding guardrail against hallucination and canary tokens against system-prompt leaks. Voice, chat, and email run on the same workflow layer, and a coaching product covers the human side of the team.

On the trust side: SOC 2 Type II, ISO 27001:2022 (surveillance audit passed July 2026), HIPAA with signed BAAs, and independently attested GDPR alignment, with reports downloadable under NDA from the trust center. Data terms match the recommendations in this guide: no training on customer data, zero-data-retention agreements with all model vendors, automatic PII redaction, and tenant isolation on GCP with no public internet path to production. Pre-launch, deployments run bulk and adversarial simulations at the scale of hundreds and thousands of sessions, supplemented by third-party red-teaming and the public Own Goal challenge. And a detail worth weight in a comparison like this one: Gradient Labs' own published comparison concedes that Lorikeet publishes the most FS-specific guardrail guidance of any horizontal vendor, mapping controls to FCA Consumer Duty, CONC, Reg E, and UDAAP.

The published proof sits in exactly the regulated territory this guide covers: Carmoola, an FCA-regulated UK car finance provider, resolves 60% of support end-to-end, with its agent Katie handling missed-repayment and affordability conversations, the highest-stakes territory in consumer credit support. Outside finance, Eucalyptus lifted CSAT by 10 percentage points while absorbing 3x ticket volume with no headcount growth (more customer stories).

Limitations, stated plainly. Lorikeet holds no PCI certification; the design instead keeps card data off its infrastructure entirely, which suits most support use cases and rules out some payment-heavy ones. No uptime SLA is published. Storage residency (US, AU, EU) does not extend to in-region inference. Live guardrail interception applies to chat; on voice, QA runs as post-conversation review. Keyword guardrail rules are exact-match today. Pricing is per resolution, and integrations cover the common helpdesk and data stack.

2. Gradient Labs

Best for: financial-services-only firms that want frontline support and back-office work (collections, disputes, KYC) on one platform.

Gradient Labs is the most credible compliance-focused rival in this comparison, and its focus is its strength. The platform is built for financial services from the ground up, by founders who ran Monzo's data organization under FCA regulation, with an engineering team drawn largely from financial services. It publishes named coverage across FCA Consumer Duty, CONC, Breathing Space, FDCPA, Reg F, TCPA, and UDAAP, with 20+ FS guardrails described as running on every turn: one layer reads customers for complaint, vulnerability, and financial-difficulty signals, while another checks agent drafts for problems such as tipping-off and false promises. Production proof is published at named regulated firms, including an FCA-authorized lender running outbound collections calls at real volume. Pricing is per resolution with a deployment guarantee.

The trade-off mirrors the strength: the platform is finance-only by design. A company spanning fintech and healthtech, or one that wants a single vendor across several regulated verticals, sits outside its stated scope. Its published certification list (SOC 2 Type II, GDPR, zero-data-retention agreements with model providers) is also narrower than the stacks the enterprise vendors below carry.

3. Sierra

Best for: large enterprises with engineering resources building bespoke branded agents.

Sierra is an enterprise conversational AI platform with genuine capability and one of the broadest certificate stacks in this field: SOC 2 Type II, ISO 27001, ISO 42001, HIPAA, PCI DSS, GDPR, and FedRAMP. For a large institution that wants a heavily customized agent and has the technical resources to co-build one, it belongs on the shortlist. Its published positioning centers on large consumer brands rather than regulated finance: no FS-specific regulatory control set is documented, guardrails are general-purpose, and building and tuning the agent typically involves engineering effort on the customer side. Evaluate Sierra as a strong platform on which your team would construct the compliance framework this guide describes, rather than one that ships it as a default.

4. Decagon

Best for: enterprise support teams that prioritize deployment speed in less regulated categories.

Decagon has earned its reputation for plug-and-play speed at enterprise scale, and its published security posture covers the fundamentals: SOC 2 Type II, GDPR, HIPAA on enterprise contracts, AES-256 encryption, and zero-day retention terms with model providers. The gap for this guide's audience is positioning. Decagon's site carries no compliance or regulatory positioning for financial services, no published mappings to named regimes, and general-purpose guardrails. For an ecommerce or consumer-software team that wants capable automation quickly, it is a strong candidate. For a regulated deployment, the compliance framework in this guide would be yours to design, build, and evidence on top.

5. Intercom Fin

Best for: teams already on Intercom automating high-volume, low-complexity first-line questions.

Fin's strengths are real: aggressive per-resolution pricing, fast setup inside Intercom, and one of the deeper certification portfolios in this comparison, including ISO 42001 and AIUC-1 alongside SOC 2 Type II, ISO 27001, HIPAA, and GDPR. For FAQ-shaped volume it is hard to beat on cost per resolution. The considerations for financial services are architectural. Fin's model is deflection-first knowledge answering inside a helpdesk; no FS-specific regulatory controls are documented, and the multi-step deterministic workflow patterns this guide treats as Layer 1 are harder to express in that architecture. One published data point for calibration: Magic Eden's CSAT with Lorikeet ran roughly 30 percentage points above the Intercom Fin deployment it replaced, though that reflects a single deployment rather than a category benchmark.

6. Zendesk

Best for: teams standardized on Zendesk that want AI inside the same stack.

Zendesk brings incumbent-scale ecosystem depth: a mature ticketing suite, a large app marketplace, and one of the broadest certification stacks of any vendor here, including SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, FedRAMP, PCI DSS, and HIPAA via an add-on. It is registered on the UK's FSQS supplier qualification system, which speaks to procurement readiness rather than agent-level regulatory control. The AI agent layer itself carries general guardrails; named financial regulation enforced per turn is not part of the published offer. For a financial services team already running Zendesk, the pragmatic read is that the platform clears procurement comfortably while the agent-level compliance framework remains the buyer's to assemble.

7. Salesforce Agentforce

Best for: Salesforce-centric enterprises that want agents operating inside their CRM and data model.

Agentforce's argument is ecosystem gravity: agents operate directly on Salesforce data, inherit Salesforce's platform certifications and admin model, and sit next to the CRM records a financial institution already governs. For institutions deeply invested in Salesforce, that integration depth is a genuine advantage, and Salesforce documents platform-level trust controls, including its Einstein Trust Layer. What is not documented is FS-specific agent-level regulatory coverage: no published mappings to named regimes, and guardrail configuration runs through the Salesforce admin and partner model, which means compliance design becomes an implementation project inside your org rather than a product default. Budget for that project when comparing total cost.

8. Ada

Best for: high-volume B2C support automation in ecommerce, travel, and hospitality.

Ada is one of the longest-running vendors in this comparison, with roots in the pre-LLM generation of support automation and a rebuilt AI agent offering. Published certifications include SOC 2 Type II, SOC 3, HIPAA, PCI DSS, and GDPR, and its no-code builder and broad language coverage suit high-volume consumer operations. For financial services, the published record shows no FS-specific regulatory coverage and general-purpose guardrails, and its track record concentrates in ecommerce, travel, and hospitality rather than regulated finance. Teams with heavy volume and light regulatory exposure will get the most from it.

Six questions to ask every vendor

Whatever your shortlist looks like, put these questions to each vendor and ask for evidence rather than assurances:

1. Which regulated steps run deterministically, outside the model, and can you show me that boundary in the product?

2. Walk one message through the system end to end: what checks the incoming message, what checks the outgoing draft, and what gets logged when a check fires?

3. Pick a closed conversation from your demo environment and replay it: every retrieved document, tool call, guardrail event, and the reasoning between them.

4. What are your data-retention terms with each model provider, where is my data stored, and where does inference run?

5. How many adversarial simulations does a typical deployment run before launch, and can I add my own scenarios during a proof of concept?

6. Which named customer in a regulated industry publicly stands behind your production results?

Question three is the one most vendors fail. If the replay needs an engineer and a week, your compliance team will feel that cost on every complaint investigation.

Red flags that should end an evaluation

• Immunity claims. A vendor claiming its agent cannot be prompt-injected is describing a system that does not exist. Ask about blast radius instead.

• An audit trail that is really a transcript. A chat log records what was said without explaining why the agent acted or which controls fired.

• Guardrails as a configuration project. If your team assembles and maintains every control, coverage drifts the moment regulation or knowledge content changes.

• Deflection rate as the headline number. It counts silenced customers as successes, which is precisely the CFPB's doom-loop concern.

• Unsourced accuracy percentages. "99% accuracy" without a definition, a denominator, and third-party validation is a marketing number.

• A certificate list standing in for regulatory depth. SOC 2 attests to data handling. It says nothing about how the agent treats a hardship disclosure.

Verdict: which platform for which team

For complex, regulated support where the agent takes real actions, and especially for teams spanning fintech and healthtech, Lorikeet is the strongest fit in this comparison: deterministic workflow boundaries, dual-sided guardrails, replayable audit trails, simulation-first launches, and a published FCA-regulated proof point in Carmoola's 60% end-to-end resolution. The honest counterweights: no PCI certification, no published uptime SLA, and chat-only live guardrail interception.

Choose differently if your situation differs. A finance-only firm that wants collections, disputes, and KYC from one FS-specialist vendor should shortlist Gradient Labs first. A large enterprise with engineering capacity and a bespoke vision should evaluate Sierra. Teams on Intercom with FAQ-heavy volume will find Fin the cheapest path to first-line automation, and organizations standardized on Zendesk or Salesforce may reasonably trade agent-level compliance depth for ecosystem fit, provided they resource the compliance framework themselves. Decagon and Ada are strong picks outside heavily regulated categories.

If your support queue includes conversations about money that must survive an audit, start with the framework in this guide, test every vendor against it, and see how Lorikeet handles your hardest 20%. Our approach for the sector is documented on the financial services page, with adjacent coverage on the insurance page.