Fintech AI Risk Template: Keeping PCI, AML, and Trading Data Out of AI Tools

Financial services teams are among the heaviest users of AI tools — and among the highest-risk from a regulatory standpoint. Finance, compliance, and trading teams use ChatGPT to analyse transactions, draft reports, and model portfolios. Card numbers, account details, and non-public financial information must never reach a third-party AI.

This guide covers the key data categories and how to configure Pretzel to protect them.

Key Data Categories for Financial Services

Payment Card Data (PCI-DSS Scope) Primary Account Numbers (PANs) — credit and debit card numbers — are the core of PCI-DSS scope. Any system that processes, stores, or transmits PANs is in scope. An AI prompt containing a card number is a transmission event.

Pretzel rule: Luhn-validated 16-digit card number pattern. Action: Block. No exceptions.

Bank Account and Routing Numbers IBAN codes, SWIFT/BIC codes, and US routing and account number combinations appear in finance team prompts when working with payment data.

Pretzel rule: IBAN regex pattern and US routing number pattern. Action: Block.

Material Non-Public Information (MNPI) For public companies and their advisors, trading on MNPI is securities fraud. Prompts discussing unreported earnings, pending M&A, or regulatory decisions can contain MNPI.

Pretzel rule: Keyword blocklist of deal codenames, earnings-period terms, and known pending transaction keywords. Scope to finance and corporate development teams. Action: Warn with required senior approval.

AML Watchlist Terms Customer names on sanctions lists, PEP (Politically Exposed Persons) designations, and AML case identifiers should not be pasted into public AI tools.

Pretzel rule: Keyword blocklist based on your AML case management system's identifier formats. Action: Block.

Regulatory Context

Financial regulatory frameworks (PCI-DSS, SOX, FINRA, MiFID II) all have data handling requirements that can be breached by unrestricted AI tool usage. A robust AI usage policy is increasingly expected by regulators during examinations.

Pretzel's audit log provides the evidence trail regulators look for: which employee, which AI site, which rule triggered, what action was taken.

Activate the Fintech Template

The Pretzel Fintech template covers PAN detection, IBAN patterns, and a starter AML keyword set. Activate it from the Console and customise the MNPI keyword list for your organisation's current deals.