AI Agents in Financial Services: Onboarding, Support, Rules

In financial services, AI agents do their useful work in operations: collecting and checking onboarding documents, answering routine client questions, routing requests and preparing records for staff to approve. Regulators in the UK, the EU and the US have said their existing rules apply to that work exactly as they apply to any other tool, so the firm stays accountable for everything the agent says and does.

Adoption is already well past the pilot stage. In the Bank of England and FCA survey published in November 2024, 75% of the 118 responding firms were already using AI and a further 10% planned to within three years. In the United States, the Census Bureau's business survey puts the Finance and Insurance sector at 33.9% of businesses using AI in early May 2026, against a national rate of 19.8%.

The same UK survey shows how cautious that use still is. Respondents said 55% of their AI use cases involve some automated decision making, but only 2% are fully autonomous, a third of use cases are third party implementations, and data protection and privacy is the largest regulatory constraint they report. That is the shape a sensible agent deployment takes: it acts on its own for routine steps and hands every consequential decision to a person.

Client onboarding is mostly chasing and checking documents, which is why it suits an agent. Take a small wealth manager as an example. The agent asks a new client for a passport, a recent proof of address and a source of funds statement, checks that each file is readable and in date and that the name and address match across documents, copies the fields into the onboarding system and tells the client exactly what is missing. The compliance analyst then opens a complete file and makes the decision.

Keeping the decision with the analyst is not only good practice. The EU AI Act lists AI systems used to evaluate the creditworthiness of natural persons or establish their credit score as high risk in its Annex III, with an exception for systems used to detect financial fraud (Regulation (EU) 2024/1689). An agent that gathers the documents for a loan application is ordinary software; one that decides who gets the loan carries the high risk obligations, and a firm should know which of the two it is buying.

Document checks of this kind are the work GenovaFlow designs as custom agentic systems: read the document, compare it with the record, write the result back into the tools the team already uses, and report what a person needs to look at.

Most client messages are routine: a statement request, a card that has not arrived, a transfer that has not landed, a meeting with an adviser. An agent connected to the right systems can answer those on the phone, by chat or on WhatsApp at any hour, and the cost comparison in AI voice agent vs a human receptionist applies to a client service line too. For firms whose clients write in several languages, the setup is the one in multilingual WhatsApp agents.

What the agent says is regulated like anything else the firm says. FINRA's Regulatory Notice 24-09 reminds member firms that its rules "apply when member firms use AI, including Gen AI", and that the content standards of Rule 2210 on communications with the public apply whether a communication is generated by a human or a technology tool. The UK FCA has said it does not plan extra regulations for AI and will rely on existing frameworks, naming the Consumer Duty and the accountability of senior managers (AI and the FCA: our approach).

In the EU two more duties apply. ESMA's statement of 30 May 2024 tells investment firms that when they use AI, including for customer support, they must comply with MiFID II and their obligation to act in the best interest of the client (ESMA guidance on AI in investment services). Article 50 of the AI Act adds that people must be told they are interacting with an AI system unless that is obvious, so the agent should say what it is at the start. Complaints, signs of a vulnerable client and anything that sounds like a request for advice go to a person, using rules like the ones in when an AI agent should hand off to a human.

The earlier version of this post was about AI in trading, and the honest summary is short. The US Commodity Futures Trading Commission warns that AI technology cannot predict the future or sudden market changes, and that fraudsters use public interest in AI to sell trading bots promising returns of sometimes tens of thousands of percent. Its case study, Mirror Trading International, took more than $1.7 billion in bitcoin from at least 23,000 people with a guaranteed 10 percent a month, while very little money was actually traded.

Regulated firms do use AI around investment work, and ESMA lists support for investment advice and portfolio management among the uses MiFID II covers. That is exactly why an operations agent should never drift into it. If a client asks whether to buy, sell or hold, the agent's answer is a booking with a licensed adviser, not an opinion.

None of the regulators above asks for a special AI licence for this kind of work. They ask the firm to show that the agent works within the rules it already follows, which turns into a short list.

1. Each task the agent performs mapped to the rule that already covers it (communications, client best interest, anti money laundering checks), with a named senior manager accountable.
2. A clear statement at the start of every conversation that the client is talking to an AI system.
3. A written scope with no advice and no credit decisions, and every request that looks like one routed to a licensed person.
4. Every conversation, document check and action stored under your existing record keeping policy.
5. A list of the third parties behind the agent: the model, the cloud host and any data provider.
6. A pilot in which staff review every output before the agent is allowed to act on its own for routine steps.

GenovaFlow builds these as chat agents for client service and custom systems for document work, scoped with your compliance team from the first call. The same approach in other regulated fields is in AI agents in healthcare, the wider adoption picture is in how companies actually adopt AI, and the rest of the series is in the AI agents for business category.