Financial Services

The AI Knowledge Base for Finance That Cites Every Source

The hard part of financial knowledge work is rarely a lack of information. Internal policies and operating procedures, regulatory documents and self-regulatory rules, product disclosures and contracts, research reports and due-diligence files sit in shared drives, inboxes and separate systems. The same compliance question can get different answers at two branches. New hires learn by asking around, approvers still open a dozen documents to sign one deal, and examiners expect every conclusion to point back to the original text.

RatioMax indexes that material in one permission-aware knowledge base that runs inside your network. Hybrid retrieval plus ReRank finds the relevant passage, and every answer carries a clickable citation to it. Space isolation and four-level RBAC narrow access to a single knowledge base, while audit logs and cross-service tracing keep a record of how each answer was produced. Models can run locally on intranet hardware, so data stays in your environment. What the system returns is checkable evidence; risk judgement and approval signatures stay with people.

Where it breaks

  1. Policy versions pile up

    Regulatory documents, self-regulatory rules and internal policies change often, and superseded versions linger in shared drives, email threads and chat history. Business lines are unsure which version applies, and nobody can say on what date a new version took effect until an exam or audit forces the question.

  2. Same question, different answers

    The same compliance question gets different explanations from head office, branches and different business lines, and most of those explanations live in calls and chat with no record. When a customer complaint or a supervisory inquiry arrives, the difference has to be settled against the original policy text.

  3. Research buried in shared drives

    Research reports, industry data and historical deal materials sit on laptops and in loosely named shared-drive folders with little metadata. Work that was already done is hard for the next person to find, so effort is repeated and institutional memory walks out the door with departing staff.

  4. Approvals mean opening a dozen files

    A single credit approval means opening the application, financial statements, due-diligence working papers, prior approval opinions and post-lending review records, with key figures spread across the loan system, scanned images and personal notes. Approvers compare them by hand, which is slow, and afterwards it is hard to say which document a given opinion rested on.

How RatioMax responds

  • Deploy entirely inside your network

    Four core services run as a Docker Compose stack on a single node or as a Kubernetes deployment in your own data centre, each scaling independently, and any knowledge base can bind a private object-storage bucket. Documents, vectors and answer records stay inside the intranet; users only reach an internal hostname.

    Platform capability: Private intranet deployment

  • Every answer links back to the source

    Retrieval combines vector search with keyword matching and then applies a ReRank pass, so exact clause numbers and product codes are not lost to semantic similarity alone. Each answer lists the passages it used and links straight to them; when the evidence is thin the system says so instead of inventing a source.

    Platform capability: Citation traceability

  • Scope access by entity and business line

    Space isolation plus four-level RBAC lets you narrow access down to a single knowledge base, so head office, branches, business lines and project teams each see only their own material. Every search and answer is written to a per-space audit log, and OIDC single sign-on keeps accounts aligned with your directory as people change roles or leave.

    Platform capability: Space-level RBAC and audit

  • See what changed when a policy is revised

    Documents keep version snapshots on ingestion, the chunk editor supports line-level diffs and rollback to any earlier version, and custom metadata can record scope, effective date and retirement status. Cited passages are bound to a specific version, so after a policy is reissued you can still reconstruct which version a past answer relied on.

    Platform capability: Version snapshots and rollback

Deployment scenarios

  • Policy and compliance Q&A

    Relationship managers, counter staff and branch compliance officers ask in plain language and get the clause text with its version attached. When the corpus does not cover a question, the system says so rather than producing a conclusion without a source.

  • Structuring credit approval files

    Applications, financial statements, due-diligence working papers and earlier approval opinions live in one space. The data-analysis agent turns a question into a query (NL2SQL) to aggregate key figures, and the approver checks each cited passage before signing.

  • Reusing research and due-diligence work

    Wiki mode turns scattered reports, meeting notes and working papers into cross-linked pages and a knowledge graph. Past conclusions are filed by sector, issuer and date, so the next report starts from existing material rather than a blank page.

  • Reconstructing answers for an examination

    When examiners ask what a conclusion rested on, the audit log locates the original question and replays the retrieval results, cited passages and model call trace from that moment. Preparing the file becomes an export, not an archive hunt.

Terms and knowledge entities

Suitability management
Before selling a product, a firm checks whether the client's risk tolerance matches the product's risk rating and documents that assessment, typically alongside investor classification, risk disclosure and recorded sales conversations.
Recorded sales sessions
Audio and video recording of the sales or signing session, capturing product explanation, risk disclosure and client confirmation as the original record for later disputes and examinations.
AML customer due diligence
Identifying clients, understanding the source and purpose of funds and assessing money-laundering and terrorist-financing risk when a relationship starts, then refreshing that picture for as long as the relationship lasts.
Credit approval
The review a bank performs before granting credit or a facility, covering the borrower's standing, repayment capacity, collateral and intended use, ending in a decision taken within delegated authority.
Post-lending management
Ongoing monitoring after a loan is drawn, covering the borrower's operations, financials, collateral and use of funds, including periodic reviews, risk-classification changes and early-warning handling.
Related-party transaction
A transfer of resources or obligations between a company and a related party, which must be identified, approved through the required process and disclosed under the applicable rules.
Internal control manual
An internal document setting out control objectives, process steps, responsibilities, control activities and testing methods; it is the reference for operating controls and for audit assessment.
Regulatory reporting
Submitting data and reports to a regulator in the prescribed format, frequency and definition, covering statement data, statistical information and ad hoc reports whose sources must be verifiable.
Data residency
Processing and storing data only inside an environment the institution owns or designates, with nothing sent outside it; a common requirement in financial-sector private deployment and data-security reviews.

These definitions are also exposed structurally so search engines and AI engines can read and cite the domain concepts accurately.

Industry questions

Our repository has to sit in the bank's own data centre. Can it run fully offline on the intranet?
Yes. Production knowledge bases in financial firms are rarely internet-facing, so deployment has to fit the existing operations model. The platform ships as a single-node Docker Compose stack or a Kubernetes deployment, the four core services scale independently, and each knowledge base can bind an internal object-storage bucket. Models can be open-weight ones running on intranet hardware, or external APIs where policy allows. Apart from the models and data sources you configure explicitly, nothing needs outbound access.
If we point it at an external model API, do our policies and client files leave the building?
It depends where the model sits. Parsing, chunking, embedding and retrieval run inside your network; the configured model is called only when an answer has to be generated. Swap in a locally hosted open-weight model and the whole chain stays on the intranet, with no material leaving the domain — the arrangement due-diligence and security reviews usually want written down, together with an auditable record of model calls.
Can an answer point to the exact clause in the policy, rather than a plausible-sounding summary?
Checkability is the whole point of compliance Q&A. Retrieval combines vector search with keyword matching and a ReRank pass to hit the right passage, and each citation in the answer links to the original text with the document and version noted. If nothing in the corpus supports the question, the system says it found no basis instead of filling the gap with inference, so a reviewer can verify line by line.
After a policy is revised, how do we know staff are getting the version that is actually in force?
The usual approach is to record effective date, retirement status and scope as metadata, and to keep a version snapshot on ingestion. Custom metadata filters let a search exclude superseded material while the old version stays available for reconstruction; the chunk editor supports line-level diffs and rollback, and a past answer can be traced back to the version it used.
How do we keep head office, branches and separate business lines from seeing each other's material?
Financial material is layered by nature: group-wide policies, branch-specific procedures, deal working papers confined to a project team. Space isolation plus four-level RBAC narrows permission to a single knowledge base. With OIDC single sign-on, access follows the directory when people change roles, and every search and answer goes to a per-space audit log that records who asked what, when, and which passage they saw.
Can it use our existing single sign-on and directory accounts, or does it need a separate account store?
No separate store is needed; the knowledge base attaches to the identity system you already run. OIDC single sign-on connects to the bank's central authentication, roles and space permissions are configured on the platform side, and disabling an account at the directory removes access. On the API side, two-tier keys let retrieval be embedded in existing systems without sharing personal credentials.
Can we run our own domestically hosted models in the private environment, for example DeepSeek or Qwen?
Yes. Models are connected through an OpenAI-compatible interface, so open-weight models served locally by Ollama or another inference stack can be attached, alongside hosted DeepSeek, Qwen, Zhipu, Hunyuan and MiniMax endpoints; different knowledge bases can point at different models. Changing the model does not touch documents, chunks or permissions, and past answers remain replayable against the model call they actually used.
Can the model's compliance conclusion be used directly as an approval basis, or where does human sign-off start?
Not directly. Model risk management expects automated output to be explainable and traceable, with a person holding authority making the final call. The platform is positioned for retrieval, comparison and drafting: it surfaces cited passages, differences and open items, while approval opinions and risk conclusions are written and signed by people. Who asked what, when, and which passages were cited is logged for later review, not to replace review.

Other industries