Prepare the narrative for a recurring audit or exam request

What to skip in banks and financial services firms

• ×Customer records and identifiers do not go into a chat window, in any account. That means account and card numbers, full Social Security and taxpayer numbers, dates of birth, online banking credentials, signature cards, core exports, wire instructions, loan files carrying borrower income and asset documents, and credit reports and scores. Two reasons, and they are separate. First, this is nonpublic personal information: Regulation P limits disclosure of it to nonaffiliated third parties and limits reuse, and the security standards your regulator enforces expect a written program and real diligence over any third party that touches customer information, which is exactly what the interagency third party risk guidance the OCC, Federal Reserve, and FDIC issued in June 2023 covers for banks of every size, community banks included. Credit unions get the same questions from NCUA. Second, a consumer report was pulled for a permissible purpose under FCRA, which allows a report to be furnished for listed purposes and no others, and pasting a tri merge into a chat is a use nobody documented. Work at the policy and summary level, paste the language and not the file, and settle the account and vendor question with whoever owns compliance before anything live moves.
• ×Nothing that touches a credit decision. Not approving, denying, pricing, risk grading, granting an exception, working out debt to income or a coverage ratio that feeds the decision, and above all not drafting the specific reasons on an adverse action notice. Regulation B requires the statement of reasons to be specific, to indicate the principal reasons, and to relate to and accurately describe the factors actually considered, and CFPB Circular 2022-03 says plainly that a creditor may not use a model when doing so means it cannot give specific and accurate reasons, and that not understanding your own method is not a defense. A paragraph that reads like a reason but was not the reason is a violation with your institution's name on it, with fair lending exposure underneath. Anthropic's Usage Policy points the same way: loan approvals and determining eligibility or creditworthiness are named high risk, and home loans are named again under housing. The decision, the reasons, and the notice belong to your lender, your credit committee, and your written credit policy.
• ×Suspicious activity reporting, and anything that would reach a customer as advice. A SAR, and any information that would reveal the existence of a SAR, is confidential under 31 CFR 1020.320(e), and no bank and no director, officer, employee, or agent of a bank may disclose it, so the narrative does not get drafted, polished, or rehearsed in a chat window, and neither does the alert that led to it. Examination reports and examiner correspondence stay out for a related reason: they are your regulator's records, not yours to hand to a third party. On the advisory side, Claude holds no registration and no license. No recommendation, no allocation, no security selection, no suitability or best interest conclusion, and nothing that reads to a client as investment advice. If your firm is a registered investment adviser or a broker dealer, your advertising, review, and recordkeeping obligations attach to whatever goes out, and a chat transcript is not part of your retention system.