Short answer
AI internal policy retrieval is a workflow where staff at a financial firm ask plain-language questions and get answers quoted from the firm’s own approved policies, such as the fair conduct programme, credit policy, AML/CFT programme and delegations, with document, clause, version and effective date. In New Zealand the FMA expects fair conduct programmes in writing, often across many documents, so findability matters. Compliance still interprets.
- Answers quote internal policy only, never general knowledge of the law.
- Point-in-time retrieval shows which version applied on a past date, for complaints and reviews.
- Restricted procedures stay restricted; the index respects document permissions.
- RBNZ and the FMA expect boards to know where AI is used and who is accountable.
What policy retrieval is for in a financial firm
AI internal policy retrieval answers questions like “What is my approval limit for an unsecured personal loan?” or “What do we have to tell a customer before changing their repayment date?” by quoting the firm’s own policy, with the document, clause, version and effective date. Financial firms carry more policy than most: the fair conduct programme, credit and collections policies, the AML/CFT programme, complaints handling, product governance, delegations, privacy and IT.
The FMA says a fair conduct programme must be in writing, may comprise a number of documents rather than one, and that it expects institutions to be able to identify every policy, process, system and control that forms it. Under CoFI, registered banks, licensed insurers and licensed non-bank deposit takers must treat consumers fairly. Staff can only follow policies they can find.
What the assistant answers, and what it refers on
| Question | Assistant does | Refers to |
|---|---|---|
| “What does our hardship policy say about payment deferrals?” | Quotes the clause with version | Nobody, unless the case is unusual |
| “What applied when this customer complained about a 2025 decision?” | Quotes the version in force on that date | Complaints lead for interpretation |
| “Is this transaction suspicious?” | Refuses; quotes the escalation procedure | AML/CFT compliance officer |
| “Does the law require us to do this?” | Quotes internal policy only | Compliance |
| “Can I approve this exception?” | Quotes the delegation | The delegated approver |
How the workflow runs
- Inputs
- The policy register (owner, approval date, effective dates, review date), every approved version of each policy and procedure, the fair conduct programme map, and staff questions.
- Systems
- The document management system as source of truth, a private index with version and permission metadata, single sign-on, a model API, and an audit log.
- Steps
- Ingest approved versions only; split by clause with effective-date ranges; check the asker’s permissions; screen the question for customer identifiers; retrieve for the current date or the date asked; answer by quoting, with citation; refuse when nothing matches or interpretation is needed; log question, version and answer.
- Human review
- Compliance reviews a weekly sample and every answer marked wrong. Policy owners approve what is indexed and re-run the test set after each policy change.
- Outputs
- Cited answers, referrals to named roles, an audit trail, and a monthly report of gaps and conflicting clauses.
- Measures
- Accuracy on a fixed test set of real questions, answers marked wrong, refusals, questions still reaching compliance inboxes, and time from policy approval to indexed.
- Risks
- Draft or superseded versions, law paraphrased from general knowledge, restricted procedures exposed, and customer data in questions.
NZ supervisory expectations to plan for
On 15 October 2026, the Reserve Bank and the FMA set out supervisory expectations on cyber risk from frontier AI, saying boards and senior management need to know where AI is used in the business, the risks it brings, and who is accountable. Put this tool on your AI register with an owner. For AML/CFT, DIA’s guidance for financial institutions includes programme guidance updated in 2026; keep internal procedures for suspicious activity restricted to the people who need them, and make sure the index enforces that.
Processing location is a procurement question. None of the major model providers offered inference inside New Zealand as at October 2026, but AWS says Bedrock’s AU cross-Region inference keeps Claude inference within Australia and New Zealand.
Illustrative example: a 120-staff non-bank lender
Illustrative example, synthetic numbers: a lender with 340 policy documents receives about 400 policy questions a month from frontline and operations staff. Assumptions: a compliance analyst spends 12 minutes per question today; after launch, 55% are answered by the assistant with a citation and need no follow-up; sampling takes compliance 4 hours a month.
- Compliance time: 220 x 12 minutes = 44 hours, less 4 hours of sampling, so about 40 hours a month back.
- Model fees: 400 questions at 20,000 input and 500 output tokens on Claude Sonnet 5.5, at US$2 and US$10 per million tokens (Anthropic, as listed on 19 October 2026), is about US$18 a month.
What stays with people
Compliance interprets policy and law. Credit officers make credit decisions under their delegations. The AML/CFT compliance officer decides on suspicious activity. Policy owners decide what policies say. The assistant never approves an exception or tells staff a breach is acceptable.
Where policy retrieval goes wrong
- Drafts in the index. A consultation draft answers as if approved. Index from the register’s approved status only.
- General knowledge leaks. The model “helpfully” adds what it thinks the law says. Require quotation and block uncited sentences.
- Stale index. A policy changes on Monday and the assistant quotes the old one on Tuesday. Re-index on approval, not on a schedule.
- Untested accuracy. Build and rerun a test set; see RAG retrieval evaluation.
This is a RAG development build; data residency for AI systems covers the location choices. Related workflows are management reporting commentary and client onboarding document checks. See the financial services overview.
Sources
- Fair Conduct Programme, Financial Markets Authority, accessed 19 October 2026
- CoFI legislation, Financial Markets Authority, accessed 19 October 2026
- AML/CFT guidance for financial institutions and casinos, Department of Internal Affairs, accessed 19 October 2026
- RBNZ and FMA outline supervisory expectations on cyber and AI risks, Reserve Bank of New Zealand, 15 October 2026
- Run generative AI inference with Amazon Bedrock in Asia Pacific (New Zealand), AWS, accessed 19 October 2026
- Claude API pricing, Anthropic, accessed 19 October 2026
Written by the Levy Street team in Wellington. Last updated 19 October 2026.