The compliance answers, in plain terms

Compliance engagement comes before commercial terms, never after. This page answers the questions advisors and compliance officers actually ask about AI in a regulated firm, in the order they usually ask them.

Is AI note taking compliant for SEC registered investment advisors?

Yes, AI note taking can be compliant for SEC registered investment advisors, but compliance comes from how the tool is governed, not from the category. The notes must be retained under the firm's books and records obligations, outputs must be traceable to the conversation that produced them, and client data must not leak into model training.

There is no rule that prohibits an RIA from using AI to capture meeting notes. What the SEC examines is whether the records the firm is required to keep are complete, retrievable, and accurate, and whether client data is handled the way the firm's own policies and disclosures say it is.

That turns the question into a vendor question. Before adopting any AI notetaker, a compliance team should be able to confirm where the records live, how long they are retained, whether the vendor trains models on client data, and whether an output can be traced back to its source when an examiner asks where a statement came from.

WealthAmp is built for regulated firms, with SEC and FINRA compliance expertise behind the product. Every AI output traces to the conversation, document, or note that produced it, retention is designed to meet books and records obligations with a complete audit trail, and raw recordings and transcripts can stay in your own systems.

How do RIAs meet books and records requirements when using AI meeting notes?

By treating AI meeting notes like any other required record: retained for the required period, complete, retrievable, and producible in an exam. WealthAmp's retention is designed to meet books and records obligations, it keeps a complete audit trail, and raw recordings and transcripts can stay in the firm's own systems.

The Advisers Act books and records rule (Rule 204-2) requires RIAs to keep true, accurate, and current records of the business, including communications and records that support advice given to clients. When meeting notes become part of that record, the firm needs to know they are captured and retained the same way its other required records are.

The practical checklist is short: know where the record is stored, know how long it is kept, be able to retrieve it when asked, and be able to show what produced it. Meeting records, communications, and client data in WealthAmp are captured and retained to support your books and records obligations: complete, retrievable, and review-ready.

WealthAmp is also the system of record for nothing. Your records stay in your CRM and your assets in your portfolio system, and raw recordings can stay in your own systems, so adopting the growth layer does not mean moving your regulated records into a new vendor.

What are the FINRA rules for recording client meetings?

FINRA has no single rule that bans or requires recording client meetings. Recording consent is governed by state law (one-party versus all-party consent states), and once a recording or note exists it becomes a business record subject to the firm's supervision and recordkeeping obligations.

For FINRA member firms, the relevant obligations are supervision and recordkeeping: firms must supervise the activities of associated persons and preserve records of business communications. For RIAs, the parallel obligation is the Advisers Act books and records rule. In both cases, the question is less "may we record?" and more "is the record we create kept, supervised, and retrievable?"

Consent is the other half. State wiretap laws differ on whether one party or all parties must consent to a recording, so most firms adopt an all-party consent practice: tell the client the meeting is being captured and get their agreement. Firms should confirm their recording and retention policy with counsel; this page is not legal advice.

WealthAmp works either way. It can capture where a firm has none, and where a firm already records through Jump, Zocks, Zoom AI, or Copilot, WealthAmp reads that output instead: it is never a reason to remove a capture tool that already works.

Does WealthAmp train AI models on client data?

No. Client data is never used to train models. Your firm's data serves your firm alone.

This is a contractual position, not a settings toggle. The diligence pack WealthAmp shares with compliance teams documents which model providers process firm data and under what terms, alongside data residency and the full sub-processor list, so a CCO can verify the claim rather than take it on faith.

Data is protected in motion and at rest with bank-grade encryption, and access follows the firm's own permissions.

Is it safe to use ChatGPT with client financial data?

Pasting client financial data into a personal ChatGPT account is generally unsafe for an advisory firm: the data leaves the firm's control, may be retained or used under consumer terms the firm never reviewed, and creates records outside the firm's books and records process. The safe pattern is giving advisors AI access under the firm's own permissions and contracts.

The problem is not the model, it is the container. A consumer chat account sits outside the firm's retention, supervision, and access controls, and what happens to the data depends on plan and settings the firm does not manage. A compliance team cannot produce, supervise, or delete what it cannot see.

WealthAmp's answer is to bring the firm's memory to the assistant instead of pasting client data into it. Through MCP, your firm's memory is available inside Copilot, Claude, and ChatGPT, under your permissions, so advisors get the assistant experience while the data stays governed. How the integrations work.

Which AI tools for wealth management are SOC 2 Type II certified?

SOC 2 status is vendor-specific and changes over time, so ask each vendor for its current report rather than relying on a published list. WealthAmp is SOC 2 Type II audited, with a continuous audit behind the report and bank-grade encryption in transit and at rest.

A SOC 2 Type II report covers how a vendor's controls operated over a period, not just how they were designed on one day, which is why compliance teams ask for the report itself. WealthAmp shares its report in a standing diligence pack, before commercial terms are discussed.

The same pack covers what a report alone does not: data residency, the sub-processor list, the model providers that touch firm data, and an outside-counsel review of the product and every coaching script.

How does WealthAmp handle SEC Marketing Rule compliance for referrals?

Nothing in the product resembles a paid referral scheme. WealthAmp coaches advisors to ask their own clients and named connections for introductions, with no purchased leads and no cold prospecting, and it keeps the growth record: which referral moments occurred, what the advisor said, and whether it converted.

Under the SEC Marketing Rule (Rule 206(4)-1), a client referral is a testimonial, and compensation is the trigger that turns it into a regulated advertisement. WealthAmp's plays work on the uncompensated side of that line: the product surfaces the referral moment in a real client conversation and helps the advisor ask well, in their own voice. The firm configures the language rules, and every drafted ask is a draft, never a script.

Where the rule bites in practice is documentation. The record of a referral gets created inside a conversation and usually never leaves it. WealthAmp keeps that record, so when a compliance team needs to know what was said and what came of it, the answer exists.

For the full analysis of when a referral becomes an endorsement, see When Does a Referral Become an Endorsement? Rule 206(4)-1.

What should an RIA compliance team ask an AI vendor during due diligence?

Six questions cover most of it: Where does our data reside? Who are the sub-processors? Which model providers touch our data, and do they train on it? How does retention map to our books and records obligations? Can every AI output be traced to its source? And can we see the current SOC 2 report?

• Data residency: where records are stored and processed.
• Sub-processors: every third party that touches firm data.
• Model providers: which models process the data, under what terms, and whether client data is ever used for training.
• Retention: how the vendor's retention maps to books and records obligations, and whether raw recordings can stay in the firm's own systems.
• Traceability: whether every AI output can be traced to the conversation or document that produced it.
• Audit: the current SOC 2 Type II report and what has changed since.

WealthAmp answers all six in a standing diligence pack, which also includes an outside-counsel review of the product and every coaching script. Compliance engagement comes before commercial terms, never after: we open with your CCO.

Nothing on this page is legal advice. It describes how WealthAmp is built and what it shares in diligence; your firm's policies and counsel govern how you apply it.