Skip to main content

Financial Compliance

The financial-compliance policy runs in the output phase. It does these actions:

  1. It blocks a response that contains a configured blocked_patterns substring.
  2. It adds disclaimer text before a response that looks like financial advice.

This policy is a deterministic phrase and disclaimer rule. It does not determine financial accuracy, suitability, or regulatory compliance.

Configuration​

pack:
  name: financial-compliance
  version: 1.0.0
  enabled: true

policies:
  chain:
    - financial-compliance

policy:
  financial-compliance:
    blocked_patterns:
      - you should buy
      - you should sell
      - guaranteed return
      - strong buy
      - strong sell
    required_disclaimers:
      - This is not financial advice.
      - Consult a qualified financial advisor before making investment decisions.

Fields​

FieldTypeDescriptionDefault
blocked_patternsstring[]Case-insensitive substrings that cause a block when found in the output.[]
required_disclaimersstring[]Disclaimer lines with a newline between them. The gateway adds them before output that looks like advice.[]

Behavior notes​

  • The policy uses plain substring checks for blocked_patterns. It does not use regex evaluation.
  • If required_disclaimers is empty and the response looks like advice, the default disclaimer is This is not financial advice.
  • The gateway adds the disclaimer at the start of the response.
  • The gateway adds disclaimers according to built-in advice heuristics such as buy , sell , you should invest, guaranteed returns, target price, strong buy, and strong sell.

Use cases​

Block strong recommendations​

policy:
  financial-compliance:
    blocked_patterns:
      - you should buy
      - target price
      - guaranteed return
    required_disclaimers:
      - This is not financial advice.

Disclaimer-only mode​

policy:
  financial-compliance:
    required_disclaimers:
      - This is not financial advice.
      - Review any financial decisions with a licensed advisor.

How it works​

  1. After the upstream model returns a response, the policy lowercases the output text.
  2. If the response contains an entry in blocked_patterns as a substring, the response is blocked.
  3. If no pattern matches, the gateway checks its built-in financial-advice heuristics.
  4. If the response looks like advice, the gateway checks its start for the disclaimer text.
  5. If the text is missing, the gateway adds the disclaimers before the output.

Best practices​

  • List each phrase that you want to block. The policy reads regex syntax as literal text.
  • Use short, unambiguous disclaimer text because it is prepended verbatim.
  • Use narrow blocked_patterns to prevent blocks on generic educational content.
  • Pair with mnpi-filter or pii-detector when disclosure or data-protection controls are also necessary.
  • Use stream: false when this output control is necessary. The active SSE path does not run this evaluator.

Next steps​