Most AI agent projects at financial institutions get through the demo without trouble. The demo works, the business sponsor is convinced, the budget exists and the vendor has already shown a voice conversation that sounds human. The trouble starts in the tenth meeting, when the project reaches the Risk team and someone asks the first question nobody prepared for: where is each conversation recorded, and who can read it?
This article covers what happens in that meeting, what Risk, Compliance and Information Security teams ask to see before approving a conversational agent, and how to arrive with the answers ready. At the end there is a checklist with the twelve questions a CISO asks, so that due diligence becomes the second meeting of the project instead of the tenth.
What is happening to AI projects in Latin American banking
Banks, fintechs and insurers in the region have spent two years testing conversational agents for collections, customer service, origination and onboarding. Most of those tests stay at pilot stage. The reasons that come up in conversations with operations teams repeat themselves: the project went through Innovation and through the business, and was never designed to go through Risk.
The Risk team has nothing against AI. Its job is to approve what it can audit and stop what it cannot. When an AI agent reaches that review without reconstructable records, without a clear answer about what happens to personal data and without a way to undo a change in production, only one outcome is possible: the project is frozen until further notice. In practice, “further notice” tends to mean six months.
The four blockers that freeze a project
In regulated institutions across Latin America, AI agent projects almost always stall for one of these four reasons, each with a concrete question behind it.
1. Audit: nobody can reconstruct what the agent said
A regulator or an internal auditor may ask, months later, exactly what the agent told a customer, on which channel, with which prompt version and why it made that decision. If the vendor only delivers a transcript with no version, no trace of the tools it called and no record of who accessed that conversation, the answer to Risk is incomplete.
What Risk asks to see: a record per conversation with an identifier, the agent version that handled it, the tools it queried, role-based access and retention defined by contract.
2. PII: personal data travels where it should not
In a collections or origination conversation, the customer says their Brazilian CPF or Mexican CURP, their account number and their balance. If that data reaches a third-party language model untreated or ends up written in logs, the institution faces a problem under Brazil’s LGPD, Mexico’s federal data protection law or whatever rule applies, plus a reputational one.
What Risk asks to see: where PII is detected and blocked (ideally at the edge, before it reaches the model), whether it is tokenized in the records, and which model providers receive which information.
3. Hallucination: the agent may say something it should not
In credit, insurance or healthcare, an invented answer carries regulatory consequences. If the only control over what the agent says is an instruction inside the prompt (“do not mention rates the customer has not contracted”), Risk cannot audit it, because a prompt can be bypassed with an injection.
What Risk asks to see: guardrails that run in code, before and after the model, with mandatory filters that cannot be switched off (prompt injection, data exfiltration, crisis signals) and a closed catalog of actions the agent can execute. Also topic focus: what the agent does when asked about something outside its domain.
4. Private network: “it cannot leave our network”
Many banking security policies state that customer data does not leave the institution’s perimeter, or that it can only live on dedicated infrastructure. Most conversational agent platforms run on shared cloud, and that is where the conversation ends.
What Risk asks to see: real deployment options (shared cloud with isolation per organization, dedicated cloud in the client’s own account, private network, or a hybrid model for voice) and the encryption architecture documented for the CISO’s review.
What a project that gets through Risk looks like
Projects that reach production in 1 to 3 weeks have one thing in common: the security review happened at the start, with the technical package on the table, rather than at the end as a surprise. In practice that means three decisions made before the pilot.
The second meeting is with Risk. After the business meeting (volume, current rates, cost per contact, pilot KPI), the next session includes the CISO or the Compliance team, with the architecture, the deployment model and the list of controls. The earlier an objection appears, the cheaper it is to resolve.
Controls live in the platform. Versioning for every agent with history and side-by-side comparison, gradual (canary) rollout for sensitive changes, instant rollback, regression QA per agent and deterministic guardrails. All of it can be shown on screen and audited line by line, which an instruction buried in a prompt cannot offer.
One engine, approved once. When the platform that runs collections is the same one that will later run origination or customer service, Risk’s approval carries over and the second use case starts from an approved base. At Coru this is how ADI Agents are built: origination, onboarding, transactions, collections and customer service on a single platform, with a single due diligence.
Numbers you can bring to that conversation
Risk teams care about platform data they can verify. These are the figures Coru can stand behind today, measured in production with financial clients in Latin America:
- Voice response in under 800 ms, from the SIP trunk to the first audio.
- First agent in production in 1 to 3 weeks; voice over the client’s own trunk in 2 to 5 days.
- 70 % of contacts resolved without human intervention, with handoff to an operator on demand.
- 53 % reduction in OpEx in collections operations.
ISO 27001 and PCI DSS certifications are in progress; the platform design takes their requirements as a reference, and the architecture and encryption documentation is shared during due diligence. Stating “in progress” plainly helps the conversation with Risk move forward.
The checklist: twelve questions a CISO asks before approving an AI agent
These questions come up, in one order or another, in almost every security review of a conversational agent in the region. Use them to prepare the meeting, to evaluate a vendor or to review a project that is already frozen.
Audit and data
- Where is each conversation recorded, and who can read it?
- What happens to a CPF, a CURP or an account number when the agent hears it?
- Does personal data travel to a third-party model? Does it stay in logs?
- Can every interaction be reconstructed: what the agent said, with which version, and why?
Behavior control
- What prevents the agent from saying something improper? Does that control sit in the prompt or in code?
- How is a prompt injection blocked?
- Can the agent execute actions outside a closed catalog?
- What does it do with a request outside its domain: invent, hand off or stop?
Production and deployment
- How is a change tested before it reaches 100 % of traffic?
- If the agent makes a mistake in production, how long does it take to return to the previous version?
- Can it be deployed in a dedicated cloud or inside the institution’s network, if policy requires it?
- Who can access what: roles, permissions and a record of every administrative action?
If three of these questions have no answer, the project will not get through the review. With documented answers to all twelve, due diligence becomes the shortest stage of the project.
Want to walk through these twelve questions with your Risk team? See how Coru handles security and guardrails or book a demo and bring your security checklist.
Frequently asked questions
Why do AI agent projects stall in a bank’s Risk team?
Because they arrive without what Risk needs to approve them: reconstructable records of every conversation, documented handling of personal data, controls on the agent’s behavior that sit outside the prompt, and a deployment model that fits the institution’s security policy.
What is the difference between a guardrail in the prompt and a guardrail in code?
A guardrail in the prompt is an instruction the model can ignore or that a prompt injection can bypass. A guardrail in code is a deterministic filter that runs before and after the model, does not depend on how the model interprets it, and can be audited.
Can an AI agent run without data leaving the bank’s network?
Yes, when the platform offers deployment in a dedicated cloud in the client’s own account, in a private network, or in a hybrid model where voice runs inside the perimeter. Not every platform offers this, so it belongs among the first questions to ask.
How long does it take an AI agent to reach production at a financial institution?
With the security review done at the start and the platform already approved, between 1 and 3 weeks. With voice over the institution’s own SIP trunk, the connection takes 2 to 5 days.
What happens if the agent makes a mistake in production?
On a platform with versioning and gradual rollout, a change is first released to a fraction of traffic while metrics are watched, and if anything degrades the previous version is restored immediately. That rollback capability is one of the controls Risk asks to see.
Coru® runs AI agents for banks, fintechs, insurers and BPOs in Latin America: ADI Agents for each stage of the credit cycle and ADI Platform to operate them over voice, WhatsApp and web, with guardrails in code, protected PII and deployment wherever policy requires. See the Collections Agent and Security and guardrails.