Banks blocked ChatGPT over leaks; recordkeeping set the longer limit
When large banks restricted ChatGPT, the stated worry was confidential data leaving the firm. That problem yielded to contracts within a year. The obligations to keep and supervise records, and to explain decisions, set the slower pace of adoption.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
Around February 22, 2023, news reports said JPMorgan Chase had restricted employees from using ChatGPT, describing the move as part of normal controls on third-party software rather than a response to any incident. Within days, further reports said Bank of America, Citigroup, Deutsche Bank, Goldman Sachs and Wells Fargo had also limited staff access. OpenAI had released ChatGPT less than three months earlier, and its consumer user base had grown faster than almost any application before it. Employees across industries were already pasting text into it to draft emails, summarize documents and write code. Banks were among the first large employers to restrict it publicly. Most said they were evaluating how the technology could be used safely.
The restrictions were widely read as banks being cautious about a new technology. They were cautious, but for reasons specific to regulated financial firms. Those reasons fall into three categories, each with a different owner and a different path to resolution: data leaving the firm, records the firm must keep, and decisions the firm must be able to explain. A blanket block was a reasonable holding position for all three. Only the first could be solved quickly.
Data leaving the firm
The most discussed concern was confidentiality. An employee who pastes a client email, a draft deal memo or proprietary code into a public chatbot hands that information to a third party under consumer terms. At the time, consumer ChatGPT conversations could be used to improve OpenAI’s models unless a user opted out. The bank had no contract covering retention, access or deletion.
This category had the clearest fix, and it belonged to the chief information security officer and procurement. Enterprise agreements could commit the provider to no training on customer data, defined retention and security controls. Data loss prevention tools and secure web gateways could detect sensitive content headed to unapproved sites and block it. Private deployments through a cloud provider could keep prompts inside the firm’s own tenancy. Large banks pursued all three routes within months. The restriction also had a cost: blocking a useful tool on managed devices pushes some activity to personal phones, which is worse on every dimension. Pairing the block with an approved alternative was what made it hold.
Vendor risk teams had their own share of this category. A generative AI provider was a new kind of critical vendor. It processed whatever employees typed, it relied on cloud subprocessors, and its terms changed often. Standard due diligence questionnaires did not ask about training use of customer data, model versioning or how long abuse-monitoring logs were kept. Adding the questions was quick. Getting contractual answers from providers still writing their enterprise terms was not.
Records the firm must keep
The second category was less discussed and harder. Broker-dealers must preserve business communications under SEC Rule 17a-4 and supervise them under FINRA rules. Registered investment advisers have their own recordkeeping duties under the Advisers Act. Banks retain many record types for regulatory and legal reasons.
Regulators had just shown how seriously they took this. In September 2022 the SEC charged 16 broker-dealers and advisers over employees’ use of personal messaging apps for business, with combined SEC penalties of more than $1.1 billion. The CFTC brought parallel cases. Those cases were about channels outside the firm’s archive. An unapproved chatbot was another such channel.
Generative AI posed questions the rules were not written for. If a banker uses a chatbot to draft a client email, is the prompt a business record? Is the discarded draft? If an analyst relies on a model’s summary of research, what must be retained to reconstruct the basis for a recommendation? In early 2023 no firm could answer these with confidence. An unapproved tool, used outside the archiving stack, could create records the firm had no way to capture.
Resolving this category belonged to compliance and records management, not security. It required decisions about which AI uses produce communications, integration of prompt and output logs into retained, searchable and supervised systems, and lexicon or sampling reviews adapted to AI-drafted text. It also required training front-office staff on where AI-drafted client communication sits in the supervisory process. Each of those took longer than signing an enterprise contract.
A workable test for each proposed use is whether the output could reach a customer, a counterparty or a regulator. If it could, the prompt and the output belong in the archive, on the same retention schedule as the final communication.
Decisions the firm must explain
The third category concerned outputs used in decisions. Banks operate under supervisory model risk guidance, SR 11-7 at the Federal Reserve and its OCC counterpart. It expects models used in decisions to be inventoried, validated and monitored. Lenders must give specific reasons for adverse credit actions under the Equal Credit Opportunity Act and Regulation B. Advisers owe clients a fiduciary duty that includes a reasonable basis for advice.
A general-purpose chatbot fits awkwardly into that framework. Its outputs vary from one run to the next. Its training data is unknown to the user. Its errors can be fluent and confident. None of that bars use in decision support. It does mean the model risk function has to decide which uses count as models, what testing is proportionate, and where a human must review before an output affects a customer. Drafting an internal memo and screening a credit application sit at opposite ends of that range. Treating them the same, in either direction, is the common mistake.
There is a second-order effect as well. Staff who rely on AI summaries may stop reading source documents, which weakens the human review the framework assumes. Review procedures should check that reviewers engaged with the underlying material, not only with the summary.
The three categories also explain the sequencing banks followed. Internal knowledge search, coding assistance and document summarization came first, because they raised the confidentiality question but little of the other two. Client-facing and decision-facing uses came later and more slowly, because they touched all three. A firm that tracks its AI use cases against these categories can see which control owner is the bottleneck for each one.
With hindsight
The block did not last long. Within about a year many large banks had rolled out internal assistants on enterprise agreements or private deployments, starting with knowledge search, summarization and coding help. Confidentiality was largely solved by contract and architecture. Recordkeeping and model governance took longer. FINRA’s Regulatory Notice 24-09, in June 2024, reminded member firms that existing rules, including supervision and recordkeeping, apply to generative AI. Off-channel enforcement continued: in August 2024 the SEC charged 26 more firms, with combined penalties of about $393 million. No dedicated AI recordkeeping rule appeared. Firms built their own answers, logging prompts and outputs into retained systems and extending model risk frameworks to language models. By 2026 the same three categories apply to AI agents that take actions, where the explainability burden is heavier.