AI Automation for Financial Services: Where Advisors and Community Banks Should Start

Six changes matter for a small advisory firm or community bank. Dates and sources are below so your compliance consultant can check them.

1. The SEC withdrew the predictive data analytics proposal. On June 12, 2025 the Commission withdrew fourteen pending proposals, including S7-12-23, effective June 17, 2025. The withdrawal notice says the SEC "does not intend to issue final rules with respect to these proposals" and will "issue a new proposed rule" if it returns to the subject. Nothing has replaced it as of this update. Your fiduciary duty, the Marketing Rule, and the books-and-records rule still apply to every AI output.

2. SEC exam priorities for 2026 name Regulation S-P and AI representations. The Division of Examinations published its 2026 priorities on November 17, 2025 and said it "will also examine for compliance with new rules, such as the 2024 amendments to Regulation S-P." Law firm summaries of the full document (Katten, Simpson Thacher) report that examiners will review adviser statements about AI capabilities for accuracy and check for policies that supervise AI use.

3. FINRA's 2026 Annual Regulatory Oversight Report added a generative AI section. The report (December 2025, pages 24 to 27) says FINRA rules "continue to apply when firms use GenAI," cites Rule 3110 on supervision, lists "summarization and information extraction" as the top use case among member firms, and covers AI agents for the first time. Page 46 says a firm using GenAI for chatbot communications with investors must ensure "retention of those chat sessions." Page 30 tells firms to assess each vendor's use of GenAI and to add contract language that bars firm or customer data from being fed into a vendor's open-source GenAI tool.

4. Bank regulators rewrote model risk guidance and left generative AI out of it. OCC Bulletin 2026-13 (April 17, 2026) replaced the 2011 interagency guidance. The bulletin says "Generative AI and agentic AI models are novel and rapidly evolving" and "are not within the scope of this guidance," that the guidance "does not set forth enforceable standards," and that the agencies plan a request for information covering banks' AI use. OCC Bulletin 2025-26 (October 6, 2025) states that the guidance "does not, and should not be interpreted to, require community banks to perform annual model validation."

5. Proposed third-party risk management guidance is open for comment. On September 11, 2026 the FDIC, Federal Reserve, NCUA, and OCC proposed new third-party guidance and a companion guide for Fed-supervised community banks. Comments close 60 days after Federal Register publication. The agencies also issued a statement on how they will weigh community bank relationships with core providers in supervisory decisions. Any AI vendor that touches customer data falls under this framework once it is final.

6. Regulation S-P amendments are in force for every adviser. The SEC adopted the amendments on May 16, 2024. Per Seward and Kissel, smaller entities (advisers under $1.5 billion in AUM) had until June 3, 2026. Larger entities had until December 3, 2025. You must notify affected customers within 30 days of a qualifying incident, and your service providers must notify you within 72 hours. An AI notetaker or a RAG vendor holding client data is a service provider under your incident response program.

Texas added a state layer. The Texas Responsible Artificial Intelligence Governance Act took effect January 1, 2026. Per Ashurst Perkins Coie, its prohibitions (behavioral manipulation toward self-harm, intentional unlawful discrimination, and others) apply to any person who develops or deploys AI, while the duty to tell consumers they are talking to an AI falls on government agencies and health care providers. The Attorney General has exclusive enforcement, some violations carry a 60-day cure period, and penalties run $10,000 to $200,000 per violation. Nothing in this section is legal advice. Have counsel read the statute.

This is the question that stalls most advisory firms, so here is the framework compliance counsel use.

Skadden's analysis of Advisers Act Rule 204-2 and Exchange Act Rule 17a-4 turns on transmission. Content that sits inside an application is not a "sent or received" communication. The obligation attaches when someone sends it, by email, chat, portal, or report, and the subject matter falls inside the rule. For advisers, Rule 204-2(a)(7) covers written communications about four things: recommendations or advice, receipt or delivery of funds or securities, order placement or execution, and performance. For broker-dealers, Rule 17a-4(b)(4) covers communications relating to the business as such, which is broader.

FINRA went further for chatbots. The 2026 Oversight Report (page 46) says a firm using GenAI for chatbot communications with investors must supervise and retain those communications and the chat sessions themselves.

The industry is pushing back. On October 15, 2025 SIFMA petitioned SEC Chairman Atkins to exclude "AI-generated meeting transcripts and collaborative platform inputs" from retention and to set a uniform three-year period. I found no SEC action on that petition as of this update, so the current rules stand.

Three lines for your written supervisory procedures:

• Anything an AI drafts and you send to a client is a record. Archive it the same way you archive the email it rode in on.
• A meeting summary that contains a recommendation and gets emailed to the client is a record. A summary that stays inside the notetaker and never leaves is a closer call. Pick a tool that lets you set a retention policy and export, so the answer does not depend on the vendor's defaults.
• A client-facing chatbot transcript is a record. Log every session with a timestamp and the model version, which is also what FINRA's monitoring section asks for.

FINRA's survey found summarization is the top GenAI use case among member firms, and that matches what I see. A notetaker is cheap, vendor-hosted, and the retention question above is the only hard part.

Three vendors built for advisors, with list prices as of October 2026:

• Jump: Meet plan at $100 per advisor per month for the notetaker, meeting prep, follow-up emails, and CRM sync. Onboard (form completion, document intake) and Grow (meeting analytics, coaching) are $50 add-ons each. The compliance dashboard, custom attestations, and custom disclosures sit on the Enterprise tier, which is priced by quote. Annual billing saves up to 20 percent.
• Zocks: Essentials $67, Professional $117, Ultimate $184 per user per month on annual billing ($80, $140, $220 monthly). Zocks records no audio or video on any tier and stores data in the U.S. Audit logs, transcript archiving, configurable retention, and PII redaction start at Professional, so budget $117 if you want the compliance features.
• Zeplyn: Per WealthManagement.com (July 24, 2026), seats start at $120 per advisor per month for the Meeting Assistant, with the Agent Nexus upgrade (manager reports, AI role-play) from $195. Enterprise pricing is custom.

The tradeoffs. Zocks answers the recording question by never making one, which simplifies consent and retention but removes the audio if a client later disputes what was said. Jump has the widest integration list and the most mature CRM workflow, with compliance controls gated behind Enterprise. Zeplyn costs the most per seat and is the youngest of the three.

For a firm under ten advisors, buy one of these. Do not build a notetaker. The money goes further on the next two items.

Your compliance manual, Form ADV, written supervisory procedures, past deficiency letters, and the FINRA notices your consultant forwards are the documents your advisors search by hand. A RAG agent indexes that set and answers questions with the clause it pulled from, so the compliance officer verifies the source instead of re-running the search.

FINRA's 2026 report names the failure mode: hallucinations where "misrepresentation or incorrect interpretation of rules, regulations or policies" affects decisions. A citation-first design is the answer. If the agent cannot point to a clause, it says so instead of guessing. RAG agents versus FAQ chatbots explains the difference in plain terms.

The closest numbers I can share are from a regional law firm, a different industry with the same document problem. Across 50,000 documents, daily research time per attorney dropped from 3.2 hours to 38 minutes, validated against 200 real queries until accuracy passed 95 percent. A compliance library at a 5-advisor RIA is smaller and the questions repeat more, which makes the index easier to build and test.

Why build rather than buy here: the value sits in your documents and your firm's past interpretations, and no vendor ships those. Keep the index inside your own cloud account with role-based access, which also satisfies the vendor-data clause FINRA asks you to put in contracts.

Qualifying a prospect means checking accredited status, asset minimums, and stated risk tolerance before an advisor takes the call. AI lead generation applies your written criteria to every inquiry the same way and logs why each prospect was routed or declined.

The log is the point. Per the law firm summaries above, 2026 exams will check whether algorithms lead to advice consistent with an investor's profile. A qualification trail that shows the inputs, the rule applied, and the outcome is what you hand the examiner.

For scale, the only client numbers I will cite are from a B2B SaaS pipeline build: qualified pipeline grew 3.1x and cost per qualified lead fell from $340 to $129. Advisory inbound volume is lower and the criteria stricter, so expect the time savings before the volume gains.

The customer-facing AI options for a community bank in 2026 run through the core.

• Jack Henry expanded its Google Cloud agreement on June 25, 2026 to build an AI security platform and to deploy Gemini Enterprise Agent Platform for support and operations. The release says about 7,400 community banks and credit unions depend on Jack Henry, and cites early adopters reporting administrative time savings of up to 70 percent. That figure is Jack Henry's, from early adopters, with no published method.
• Fiserv launched agentOS on May 14, 2026 with OpenAI, an agent marketplace across its core and payments platforms. It was in beta with two institutions at launch and Fiserv said it expected wide availability by August 2026.
• Posh sells voice and digital assistants plus an employee knowledge assistant and says it serves more than 100 financial institutions. Posh publishes no pricing. Ask for the integration list for your core and digital banking platform before you ask for a quote.

For an advisory firm or a bank branch without a core-level option, a voice agent handles scheduling, statement requests, and hours-and-location calls, and routes anything about an account balance or a recommendation to a person. The numbers I can cite come from a regional healthcare network: no-shows fell from 18 percent to 4.9 percent and the agents answer 99.2 percent of calls within three rings. Scheduling is scheduling. The routing rule is what changes for a bank.

One caution from FINRA's agent section: do not let an agent execute a regulated action on its own. Scheduling an appointment is fine. Moving money or changing a beneficiary needs a human in the loop, and the report lists "human in the loop" oversight and action tracking as the controls it expects.

The SEC's Investment Adviser Marketing rule (adopted December 22, 2020, effective May 4, 2021) and FINRA Rule 2210 apply to a draft whether a person or a model wrote it. FINRA's Regulatory Notice 24-09 said so in June 2024, and the 2026 report repeats it.

Two specific traps:

• Claims about your own AI. The SEC fined Delphia $225,000 and Global Predictions $175,000 on March 18, 2024 for overstating what their AI did. FINRA's 2026 report asks that retail communications mentioning AI "accurately describe how these offerings incorporate AI technology" and balance benefits with risks. If your site says "AI-powered," be able to show what the AI does.
• Missing disclaimers and prohibited claims. A general-purpose writing tool does not know your firm's approved language. Content automation configured with your disclaimer blocks and prohibited-claim list produces drafts your reviewer passes more often. The review step stays.

Two review vendors for firms with volume: Hadrius (AI marketing review, employee attestations, exam packs, claims 500 or more client institutions) and Saifr (SaifrReview for marketing, owned by FMR LLC). Neither publishes pricing. For a solo advisor, a configured drafting workflow plus your existing compliance consultant costs less.

The order, for a firm of two to ten advisors or a bank under $1 billion in assets:

1. Buy a notetaker this month. $100 to $120 per advisor per month. Set the retention policy before the first client meeting and write one paragraph in your WSP about where summaries go.
2. Build the compliance lookup. This is the piece with the clearest audit trail and the one that touches every advisor. Budget six to eight weeks, longer than a standard RAG build because of the review and testing regulated data needs.
3. Add lead qualification once inbound volume justifies it. My rule of thumb is 20 or more qualified inquiries a month.
4. Add phone or chat last. For a bank, wait for your core provider's option and compare it against a standalone vendor on the integration list, not the demo.

Before any of it, do three things. Confirm your Regulation S-P incident response program covers each AI vendor as a service provider with the 72-hour clause in the contract. Add the FINRA vendor-data clause that bars your client data from a vendor's open-source model. Decide who reviews prompts and outputs each quarter and write that down.

Advisory firms in Georgetown and the wider Austin metro tend to add lead qualification sooner, because the inbound volume is there once the compliance foundation is in place.

JY Labs builds the compliance lookup and lead qualification pieces and configures the content workflow. Pricing is on the site. The first step is a $350 AI strategy session, credited in full toward a build, where we map your document set and your exam history to the order above. Book it here. If you want the broader argument for a part-time builder over a full-time AI hire at this firm size, read fractional AI operator versus in-house hire.