ChatGPT for Financial Services: The Compliance Questions Nobody Is Asking

Your compliance team approved ChatGPT for “productivity use” six months ago. Nobody asked what happens when a wealth advisor pastes a client’s portfolio into the prompt window. Nobody asked where that conversation goes, who owns it, or whether your audit trail just evaporated.

The Shadow Rollout Already Happened

Most financial institutions didn’t deploy ChatGPT. Employees did. They’re using it to draft client emails, summarize earnings reports, generate marketing copy, and troubleshoot code. Some are doing it on company devices. Some are doing it on personal accounts. Almost none of them are logging what they’re putting in.

This isn’t a hypothetical. I’ve sat in enough boardrooms to know the pattern. IT says the firewall is fine. Marketing says they’re just using it for brainstorming. Compliance says they’ll “monitor it.” Meanwhile, the actual use cases are happening in dozens of departments, on dozens of accounts, with zero visibility.

The question isn’t whether your people are using ChatGPT. The question is whether you know what they’re putting into it. And whether you can prove it six months from now when the regulator asks.

The Compliance Gaps Regulators Will Exploit

Here’s what your compliance officer should be asking right now. Where is the data going? ChatGPT’s terms of service have changed multiple times regarding data retention and model training. Do you know which version of the terms your employees agreed to? Do you know whether the conversations are being stored, anonymized, or used to improve OpenAI’s models?

Who owns the output? If an advisor uses ChatGPT to draft a financial plan, is that a firm communication subject to FINRA review? If a compliance analyst uses it to summarize a regulatory filing, does that summary count as legal advice? If a developer uses it to write code that touches customer data, who is liable when that code fails?

Can you reconstruct the audit trail? Most financial services firms are required to retain communications for three to seven years. If an employee had a ChatGPT conversation about a client account in March, can you produce that conversation in discovery? Can you prove it didn’t happen?

What Your Vendor Questionnaire Is Missing

If you’re evaluating ChatGPT Enterprise or a similar tool, your vendor questionnaire probably asks about encryption, uptime, and SOC 2 compliance. Those are table stakes. Here’s what most firms aren’t asking.

Does the vendor log prompts and responses at the user level? Can you export them in a format your e-discovery platform can ingest? If an employee deletes their account, does the conversation history persist in your enterprise tenant? If the vendor gets acquired, subpoenaed, or hacked, what happens to your data?

What happens when the model hallucinates? If ChatGPT generates a plausible-sounding but incorrect tax strategy and your advisor forwards it to a client, who is responsible? The advisor? The firm? The technology vendor? Your E&O carrier is going to ask.

These aren’t gotcha questions. They’re the questions your examiners will ask in 18 months when the first enforcement actions start landing.

What This Means for Your Organization

Start with a usage audit. You can’t govern what you can’t see. Survey your employees. Check your firewall logs. Find out where ChatGPT is being used, by whom, and for what. Then decide which use cases you’re going to permit, prohibit, or require additional controls around.

Build a decision tree. Not every use case carries the same risk. Drafting an internal memo is different from summarizing a client’s tax return. Define what’s permissible, what requires pre-approval, and what’s off-limits. Make it specific enough that your people can follow it without calling compliance every time.

Document everything. If you’re allowing ChatGPT use, document the business justification, the risk assessment, the controls, and the training. If you’re prohibiting it, document that too. The worst position in an exam is “we didn’t think about it.”

Joel Comm is a New York Times bestselling author, internet pioneer, and AI keynote speaker. He has spoken for Microsoft, IBM, Cisco, the United Nations, and Harvard Business School. Learn more at joelcomm.com.