The compliance-safe RAG pattern for UK wealth managers.

Every wealth manager in the UK is currently either running a RAG pilot or about to. Most of them are running naive RAG — a vector database seeded from a folder of PDFs, an LLM asked to answer questions grounded in the retrieved chunks, and a chat interface built by someone who has done this three times before. It works in a demo. It fails in a compliance review.

The failure mode is not the model. It is the retrieval. Naive RAG cannot tell a superseded document from a current one, cannot distinguish jurisdictions, cannot enforce that a personal-recommendation output only draws from suitability-qualified sources, and cannot produce the audit trail an FCA supervisor wants. Fixing these is not exotic. It just has to be done deliberately, and most in-house teams building their first RAG did not know the constraints.

This note is the compliance-safe RAG pattern we ship for UK wealth managers. Every part of it is designed against a specific failure mode observed in a real compliance review.

Source versioning is the foundation

Every document in the retrieval substrate is versioned. Every chunk carries the version, the effective-from date, the effective-to date if it has been superseded, the jurisdiction, the product line, and the source type (regulator guidance, internal policy, product terms, marketing, historical research). Retrieval filters on all of these before the model sees anything.

This is the single most common gap in naive RAG. A firm ingests its policy library, an updated version arrives, the old version is not removed, and six weeks later the AI is confidently citing a rule that changed. In a Consumer Duty review this is a specific finding that has ended AI pilots we have been called in to salvage.

Retrieval is filtered before the model, not after

The default RAG shape retrieves the top-k chunks and lets the model figure out relevance. In a compliance-sensitive setting that is the wrong shape. Retrieval must be filtered by jurisdiction, effective date, product line and user role before the model gets a single chunk. The model should never have the option of citing an out-of-scope source, because it should never see one.

This changes the retrieval pipeline meaningfully. It adds latency budget for the filter step, requires clean metadata on every chunk, and forces the ingestion pipeline to enforce that metadata rather than treat it as optional. That is exactly the discipline that separates compliance-safe RAG from a demo.

The suitability boundary

The line between factual information and personal recommendation is where wealth-management AI most often breaks compliance. A client asks a question. The AI answers. The answer, technically, is a personal recommendation because it applies to this client’s circumstances — which means the firm has just given advice through an unlicensed channel.

The compliance-safe pattern separates the two paths at the policy layer. Any query with a personal-circumstance marker is routed to a different retrieval scope and a different generation prompt, one that is constrained to describe options and their trade-offs without endorsing any of them. Personal recommendations, when they are appropriate, are produced by adviser-facing flows with human sign-off, not by client-facing chat.

The evidence-ready output requirement

Every output the system produces has to be reconstructable in an audit. Practically, that means every response carries:

• The exact passages retrieved.
• The version of each source at the time of the query.
• The policy-layer version that was in force.
• The model provider and model version that generated the response.
• Any human reviewer if the output was reviewed before delivery.
• The full input, the full output, and any intermediate reasoning steps.

The evals layer, wealth-management specific

The evals rubric for a wealth-management RAG deployment adds two categories to the standard set. Suitability drift — did the response cross from information into recommendation. And vulnerability sensitivity — did the client signal financial hardship, cognitive impairment or coercion, and did the system respond appropriately.

Both of these are heavily represented in FCA supervision priorities. Having them as first-class metrics in the eval dashboard, with sampled human review of edge cases, is a substantial defensibility improvement over any system without them.

What this costs to build

A compliance-safe RAG deployment for a UK wealth manager is typically a twelve-to-sixteen-week engagement costing £180k–£380k depending on library size, jurisdiction count and the scope of the customer-facing surface. Ongoing operating cost is £120k–£200k annually.

Compared to a naive RAG that will fail the first serious compliance review, that is not the expensive option. It is the only sustainable option. Naive RAG is cheaper only until the day the CCO asks a question it cannot answer, at which point the cost of the rebuild dominates everything that came before.