FDE Case File 01: An AI Compliance Assistant for a Bank Whose Data Can't Leave the Building
In this article (13 sections)
- 1. The brief
- 2. Why this is harder than a chatbot demo
- The data has to stay home
- Rules supersede rules
- Not everyone may read everything
- "I don't know" is a feature
- Documents can attack
- No internet, no shortcuts
- 3. How it's built
- 4. How anyone knows it works
- 5. Why this is a Forward Deployed Engineer's job
- 6. How NeuraPath prepares you to build this
- Sources
Related programme: the FDE for Freshers course (6–7 months; EMI from ₹8,000/month · full fee shared on your counselling call). See also open Forward Deployed Engineer jobs in India, updated daily.
In short: a bank's compliance team wants an assistant that answers questions from RBI directions and its own policies in seconds, quotes the exact paragraph, and says "I don't know" when it isn't sure. The model is the easy part. The hard part is everything around it: the data has to stay inside the bank, rules supersede each other, not everyone may read every document, and a confident wrong answer is worse than none. The working design keeps the whole system in the bank's own environment, filters by permission and date before the model sees anything, forces every answer to cite or refuse, and runs an evaluation gate before every release. Making all of that fit one client's systems is exactly what a Forward Deployed Engineer does.
This is the first of our FDE case files. Each one takes a single, realistic engagement and walks through it the way it actually unfolds: what the client asked for, why the obvious approach fails, what gets built, and how anyone knows it works. The client here is illustrative, a composite of the kind of bank this work is done for. The regulations and products we mention are real, and each one links to its source.
Want to build systems like this? Our FDE programme teaches the full path, from discovery to a deployment you can defend.
Get the FDE programme brochure1. The brief
Picture the compliance desk of a mid-sized Indian bank. Branches, product teams and operations send it questions all day. Can this customer be onboarded through video KYC? Has the master direction on this topic been amended since we wrote our policy? Which circular do we cite in this audit response?
The answers live in a few thousand pages: RBI master directions, circulars and FAQs, plus the bank's own policies, past audit observations and board-approved procedures. Today the system is a shared drive, Ctrl+F, and two senior people everyone queues behind.
The Chief Compliance Officer's request fits in one sentence: "Give my team the answer in seconds, with the exact paragraph it came from, and nothing leaves our network." Every hard part of this project hides in that sentence.
2. Why this is harder than a chatbot demo
A demo that answers questions from a folder of PDFs takes an afternoon. A system a bank will let its compliance team rely on takes weeks, and almost none of that time goes into the model.
The data has to stay home
For payment-system data, RBI's rule is explicit: it "shall be stored in systems located only in India," and if a transaction is processed abroad, the data must come back within one business day or 24 hours (RBI FAQ). Beyond payments, the DPDP Act allows most transfers abroad, but section 16(2) keeps any stricter sector rule in force (Act). RBI's 2023 IT-outsourcing directions also require that the regulator can inspect any provider and reach the data it holds (RBI). Put together with a bank's own risk appetite, the practical answer for a first AI system is often simple: keep it inside. (This is engineering context, not legal advice. Every bank's legal and security teams draw their own line.)
Rules supersede rules
Regulations are amended, consolidated and withdrawn. A paragraph from 2019 and the 2025 change that replaced it look equally confident to a search engine. If the assistant quotes the old one, it is worse than useless, because it is wrong with a citation.
Not everyone may read everything
Internal audit findings and board papers have permissions on the shared drive. Those permissions have to hold inside the AI too, or the assistant becomes a way around them. OWASP lists "Sensitive Information Disclosure" second in its 2025 risks for LLM applications (OWASP).
"I don't know" is a feature
In most chat products, a fluent answer is the goal. In compliance, a fluent wrong answer is a regulatory risk with your bank's name on it. The system has to show its evidence or decline, and that rule must be enforced by design, not by hoping the model behaves.
Documents can attack
A file can carry hidden text written for the model rather than the reader: "ignore your instructions and…". Prompt injection is number one on the OWASP 2025 list, and weaknesses in vector stores are on it too. Anything that goes into the index has to be treated as untrusted input.
No internet, no shortcuts
Inside a locked-down network there is no calling a hosted API, no downloading a model on the fly, no third-party monitoring service. Model weights, updates, logs and even the testing tools have to run on hardware the bank owns, within a GPU budget it has already approved.
3. How it's built
Here is the architecture we would put in front of the client. Each layer is described twice: once in plain words, once in the terms an engineer would use.
| Layer | In plain words | Under the hood |
|---|---|---|
| 1. Ingest & tag | Like a librarian filing every paragraph with its date, what it replaced and who may read it | PDF and OCR parsing, clause-level chunking, metadata for circular number, issue date, supersession and access group |
| 2. Index | Two ways to find things: by exact words and by meaning | Hybrid search: keyword (BM25) for circular numbers and defined terms, vector embeddings for meaning |
| 3. Retrieve | Only show the model what this person may see, and only rules still in force | Permission and validity filters applied before ranking, then a re-ranker picks the best few passages |
| 4. Model | The writer, kept inside the building | An open-weight model served on the bank's GPUs; the design is model-agnostic, so it can be swapped |
| 5. Answer | Show the source, or say you don't know | Mandatory citations to paragraph, circular and date; low or conflicting evidence routes to a human |
The safety rails run under all five: personal-data redaction before indexing, an injection scan on every document, an audit log of every question and answer, and an evaluation gate on every change.
Which model? Open-weight models now cover more ground than they did a year ago. Sarvam's 30B model, released under the Apache 2.0 licence, was trained for 22 Indian languages (model card). Where a bank's policy allows a managed service that stays in the country, the options have widened too: on 29 September 2026, AWS announced that Claude Opus 5, Sonnet 5 and Haiku 4.5 can run on Amazon Bedrock with inference kept to its Mumbai and Hyderabad regions (AWS). We design so the choice is a configuration change, because it will change again.
Where does it run? Inside the bank's own data centre or its own cloud account, deployed with infrastructure-as-code so the whole system can be rebuilt, reviewed and audited from a repository rather than from someone's memory.
4. How anyone knows it works
Before go-live, the compliance team and the engineer sit down and write a few hundred real questions with their correct answers and source paragraphs. That set becomes the gate every future change has to pass.
| Measure | What it asks | Why the bank cares |
|---|---|---|
| Recall@k | Did the right paragraph appear in the top few results? | If retrieval misses it, no model can answer correctly |
| Faithfulness | Is every sentence in the answer supported by the quoted source? | Catches the confident invention compliance cannot afford |
| Refusal accuracy | Does it decline when the evidence is missing or contradictory? | "I don't know" has to happen at the right moments |
| Permission leaks | Can a user without access get a restricted document's content? | The audit committee will ask this first |
| Latency and cost | How long per answer, and what it costs to run | Decides whether the team actually uses it |
Targets are agreed with the client during discovery, not copied from a benchmark. The scores run on every change, and a drop blocks the release.
5. Why this is a Forward Deployed Engineer's job
Look back at the six hard parts. Only one of them is about the model. The rest are about a specific client: their regulations, their permissions, their documents, their network, their definition of "correct". That is the job description of a Forward Deployed Engineer in one project.
- Discovery: sitting with the compliance team to learn which questions matter and what a correct answer looks like to them.
- Negotiation with security: agreeing with the CISO what may run where, and writing the threat model they will sign.
- Integration: connecting to a document system and an identity directory you did not build and cannot change.
- Deployment: shipping into infrastructure the client owns, with no internet and their change-control process.
- Handover: a runbook, trained users, and an evaluation suite the bank can keep running after you leave.
Demand for this kind of work in regulated finance is not going away. In August 2025, an RBI committee published its FREE-AI framework for the financial sector: seven principles, six pillars and 26 recommendations, covering governance, audit and incident reporting, and calling for indigenous financial AI models (RBI). Banks that adopt AI will need engineers who can build systems a regulator can inspect.
6. How NeuraPath prepares you to build this
Our Forward Deployed Engineer programme is built around one long client engagement, and two of its phases map directly onto this case file:
- Phase 4, Discover, Model & Retrieve: you finish with an accepted scope document and a permission-aware knowledge service over a client's policy documents, with an ingestion manifest, a lineage map and a retrieval benchmark.
- Phase 6, Evaluate, Secure & Operate: you finish with an evaluation suite built from real traces, a CI gate that blocks a planted regression, a threat model with an adversarial test pack, and a Kubernetes deployment from infrastructure-as-code with service levels and a cost model.
You build against a fictional client with synthetic data, you run local models on your own machine, and you defend your work in front of practitioners who ship this kind of system for a living. The bank assistant in this case file is one of the flagship builds we are developing for learners to extend, using only public RBI documents and synthetic data.
See the full programme: seven phases, 30 modules, and three skills-based ways in, from fresher to working engineer.
Get the FDE programme brochureSources
- RBI, Storage of Payment System Data (circular 6 Apr 2018; FAQ)
- Digital Personal Data Protection Act 2023, section 16
- PIB: DPDP Rules 2025 notified, 14 Nov 2025
- RBI Master Direction on Outsourcing of IT Services, 10 Apr 2023
- RBI press release: FREE-AI committee report, 13 Aug 2025
- OWASP Top 10 for LLM Applications, 2025
- AWS: Claude on Amazon Bedrock with India cross-Region inference, 29 Sep 2026
- Sarvam-30B model card (Apache 2.0), Hugging Face
All sources read on 8 October 2026. The bank in this article is an illustrative composite, not a client. Nothing here is legal or regulatory advice.
Frequently asked questions
Can Indian banks use cloud AI services like ChatGPT or Claude?
It depends on the data and the bank's policy. RBI requires payment-system data to be stored only in India, the DPDP Act keeps stricter sector rules in force, and RBI's IT-outsourcing directions require regulator access to providers. Many banks therefore start with systems that run inside their own network, or with managed services that keep processing in India.
What is an air-gapped RAG system?
It is a retrieval-augmented generation system, an AI that answers by first finding relevant documents, that runs entirely inside a network with no connection to the internet. The model, the search index, the logs and the testing tools all run on the organisation's own hardware.
How do you stop an AI compliance assistant from giving wrong answers?
By design rather than by hope: retrieve only documents the user may see and that are still in force, require every answer to cite its source paragraph, decline when the evidence is weak or conflicting, and test every change against a set of real questions with known answers.
Do I need years of experience to build systems like this?
You need software foundations first, then retrieval, evaluation and security skills, then the client-facing craft. Our FDE programme starts from foundations and has skills-based entry points for people who already write code or already ship services.
Pankit Kumar has 10 years in Data Science & AI, building and shipping production systems in regulated pharma and clinical environments. He is a freelance trainer at Boston Institute of Analytics, AnalytixLabs and Scaler, and has taught this material to thousands of working professionals.
This article is part of our FDE for Freshers programme — 6–7 months. Build your engineering foundations, then take AI from discovery to delivery.
Explore FDE for Freshers