Fintech AI Risk Template: Keeping PCI, AML, and Trading Data Out of AI Tools

Financial services teams are among the heaviest users of AI tools — and among the highest-risk from a regulatory standpoint. Finance, compliance, and trading teams use ChatGPT to analyse transactions, draft reports, and model portfolios. Card numbers, account details, and non-public financial information must never reach a third-party AI.

This guide covers the key data categories and how to configure Pretzel to protect them.

Key Data Categories for Financial Services

Payment Card Data (PCI-DSS Scope) Primary Account Numbers (PANs) — credit and debit card numbers — are the core of PCI-DSS scope. Any system that processes, stores, or transmits PANs is in scope. An AI prompt containing a card number is a transmission event.

Pretzel rule: Luhn-validated 16-digit card number pattern. Action: Block. No exceptions.

Bank Account and Routing Numbers IBAN codes, SWIFT/BIC codes, and US routing and account number combinations appear in finance team prompts when working with payment data.

Pretzel rule: IBAN regex pattern and US routing number pattern. Action: Block.

Material Non-Public Information (MNPI) For public companies and their advisors, trading on MNPI is securities fraud. Prompts discussing unreported earnings, pending M&A, or regulatory decisions can contain MNPI.

Pretzel rule: Keyword blocklist of deal codenames, earnings-period terms, and known pending transaction keywords. Scope to finance and corporate development teams. Action: Warn with required senior approval.

AML Watchlist Terms Customer names on sanctions lists, PEP (Politically Exposed Persons) designations, and AML case identifiers should not be pasted into public AI tools.

Pretzel rule: Keyword blocklist based on your AML case management system's identifier formats. Action: Block.

Regulatory Context

Financial regulatory frameworks (PCI-DSS, SOX, FINRA, MiFID II) all have data handling requirements that can be breached by unrestricted AI tool usage. A robust AI usage policy is increasingly expected by regulators during examinations.

Pretzel's audit log provides the evidence trail regulators look for: which employee, which AI site, which rule triggered, what action was taken.

Building This in Pretzel — No Fintech Template Yet

Pretzel doesn't ship a dedicated Fintech starter template. What you get out of the box: Luhn-validated credit card detection, on by default for every user, no setup required.

Everything else above — IBAN patterns, the AML keyword list, MNPI detection — isn't pre-built. Define these as custom rules in the Console, or describe what you need to the Console AI assistant in plain English; it proposes ready-to-approve rules for your review.