Skip to main content
Menu
Wealth Management Technology

How to run AI vendor due diligence in wealth management

AI vendor review checklist with four checks: assurance report, client data flow, AI actions, and evidence and exit, on a soft pastel gradient.

Start an AI vendor review with the SOC 2 report, then add the questions AI raises about data, model providers, agent actions and audit evidence.

AI vendor due diligence in wealth management is the security and supervisory review a firm runs before an AI-enabled platform can read client data or act for the firm. Start with the evidence you already request, such as a SOC 2 Type II report, then add the four questions AI raises. Which model provider processes client data? Is that data used to train models? What can the AI do without a person approving it? Can your compliance team retrieve a record of every AI action?

Why AI changes the vendor review

An AI-enabled platform can pass client data to a model provider, generate text that reaches clients and take actions inside your systems. Each of those adds a party, an output or a permission that a standard vendor questionnaire may not cover.

In its 2026 Annual Regulatory Oversight Report, FINRA lists effective practices for third-party risk that include:

  • assessing a vendor's use of generative AI in its products or services
  • adding contract language that prohibits firm or customer sensitive information from being ingested into a vendor's open-source generative AI tool
  • keeping an inventory of the firm data types each vendor accesses or stores
  • assessing the risk of fourth-party vendors handling firm data
  • returning or destroying firm data when a contract ends, and revoking the vendor's access

For SEC-registered advisers and broker-dealers, the 2024 amendments to Regulation S-P require written policies and procedures for overseeing service providers. Service providers must notify the firm no later than 72 hours after becoming aware of a breach affecting a customer information system they maintain. Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026. The SEC's fiscal year 2026 examination priorities say examiners will review oversight of third-party vendors under Regulations S-P and S-ID, along with the controls firms use to identify and mitigate new risks associated with AI.

The SEC withdrew its proposed outsourcing rule for advisers in June 2025, but the obligations above still apply. FINRA Regulatory Notice 24-09 also reminds member firms that its rules apply to generative AI whether a firm builds a tool or uses a third party's.

Step 1: Read the SOC 2 Type II report for scope

Under the AICPA's Trust Services Criteria, a type 2 SOC 2 examination covers the suitability of design and the operating effectiveness of controls throughout a specified period, and the report describes the auditor's tests and their results. A type 1 report contains no opinion on operating effectiveness.

Then check four parts of the report:

  1. The period. Confirm it is recent enough for your review.
  2. The system description. Check that the AI features you plan to use sit inside the examined system.
  3. Subservice organizations. The AICPA SOC 2 guide illustrates reports in which a subservice organization's controls are carved out and addressed through complementary subservice organization controls. If the model host is carved out, you need separate evidence for it.
  4. Complementary user entity controls. These are controls the report expects your firm to operate, so assign each one an owner.

In September 2026 the AICPA published technical Q&A section 9561, which addresses the effect of a service organization's use of AI on SOC 1 and SOC 2 examinations. The AICPA has also published guidance on the risks of quick-turn SOC engagements, so note which CPA firm performed it.

Step 2: Map where client data goes

Ask the vendor to trace one AI request from prompt to response:

  • which large language model is used, and who hosts it
  • where the data is processed and stored
  • whether the vendor or model provider uses prompts, outputs or client data to train models
  • how long prompts and outputs are kept, and whether your firm can retrieve them
  • how the vendor tells you when a model or subprocessor changes

Record the answers in your vendor inventory, including fourth parties and the contract terms on training use and data return. FINRA's generative AI section of the same report also suggests storing prompt and output logs and tracking which model version was used and when. Ask whether the vendor's logs make that possible.

Step 3: Test what the AI can do

Read access exposes data. Action access can change records, open cases or start a transfer. The OWASP Top 10 for LLM Applications calls the second risk excessive agency and traces it to three root causes: excessive functionality, excessive permissions and excessive autonomy. OWASP's mitigations include running actions in the user's security context, requiring approval for high-impact actions and enforcing authorization in downstream systems.

OWASP's prompt injection entry explains that instructions hidden in content a model processes, such as a client email or an uploaded PDF, can change its behavior, and says it is unclear whether fool-proof prevention methods exist. Limiting what the AI can do also limits what a manipulated instruction can do.

In a product demo, run three tests:

  1. Sign in as a user with limited access and ask the AI about a client outside that user's book.
  2. Ask the AI to take an action the user is not allowed to take.
  3. Ask the AI to start a high-impact step, such as a transfer, and confirm it stops for approval.

FINRA's 2026 report lists matching agent risks, including agents acting without human validation and approval or beyond the user's intended scope and authority. Run the same tests on any outside AI tool your firm connects to the platform. Our guide to MCP permissions in wealth management covers how to separate read access from action authority.

Step 4: Confirm the evidence trail and the exit

Confirm that AI actions and human actions are written to the same audit log, that each entry shows who gave the instruction and what changed, and that your compliance team can search and export the log.

Then check the incident and exit terms:

  • Notification terms. Regulation S-P gives the firm no more than 30 days after becoming aware of unauthorized access to sensitive customer information to notify affected individuals, so the vendor's 72-hour notice matters.
  • Incident testing. FINRA lists involving vendors in incident response plan testing as an effective practice.
  • Exit. Agree how firm data is returned or destroyed and access revoked when the contract ends.

A one-page checklist

Area Ask for Follow up if
Assurance A current SOC 2 Type II report AI features or the model host sit outside the examined system
Data flow Model, host, processing location and retention Client data can train models, or the vendor cannot name its subprocessors
Actions A demo with a limited-access user The AI can see or do more than the person using it
Approvals Approval routing for high-impact steps Transfers or account changes can complete without a reviewer
Records An audit log export that includes AI actions AI activity is logged separately or cannot be exported
Incidents and exit Notification, testing and data-return terms The contract does not cover the 72-hour notice or data return

How OneVest supports an AI security review

OneVest publishes answers to several of these questions:

  • Assurance. OneVest is SOC 2 Type II compliant, and firms can request the confidential report through the OneVest Trust Center.
  • Data flow. According to AI at OneVest, AI in the platform is powered by large language models through Vertex, hosted by Google, while the platform handles data access and action execution. Data is processed in the US or Canada based on the firm's location. OneVest does not train models on client data or share client data to support model training.
  • Actions. AI carries out supported actions on a team member's chat instruction, such as creating tasks, logging activity notes and opening cases, then confirms what it did. It can only do what the person using it is allowed to do, and organization-level settings can narrow that further. MCP connections use tokens with specific scopes.
  • Approvals. Approval routing for custodial account opening and money movement keeps a person in the loop. A case stays locked until the designated reviewer signs off. These workflows are part of OneVest Operate.
  • Access and records. Viewer, Member and Admin roles come with API-enforced permissions and team-scoped books of business. Actions by people and by AI are tracked in the audit log, with timestamped approvals.
  • Sensitive data. OneVest's published Supervision controls describe masking sensitive personal identifiers and server-side encryption at rest.

Teams and role-based access, SSO with SAML and OIDC, and SOC 2 compliance appear in every package on the Compare packages page, and OneVest Enterprise adds a security review and contractual commitments. Hosting, subprocessors and business continuity are discussed with OneVest's team. Confirm which controls apply to your package and configuration.

Start with the features you will turn on first

List the AI features your firm plans to use in its first rollout and run the four steps against them. Repeat the review when the vendor adds an AI capability or changes its model provider. To walk through these controls with OneVest's team, book a demo.

Book a demo

Sources