Large Language Models in Finance

Agents optimized independently can learn strategies that soften competition or align behavior through the environment. In finance, analogous mechanisms could appear in pricing, liquidity provision, collateral terms, or execution. Monitoring must therefore examine outcome patterns and incentives, not only source-code similarity or explicit messages.

A valid evaluation must freeze not only the price history but also the prompt, retrieval store, tools, memory, model version, and researcher workflow at each forecast origin.

Two things distinguish it from a generic one, and both are controls rather than models. The availability filter D ≤ t admits only documents that existed at the decision time t , which is what stops a backtest from reading tomorrow’s filing. The claim-level verifier checks each material claim A i against its retrieved evidence bundle E i before the answer is released, which is what stops a fluent answer from being an unsupported one.

a sentence that reaches the memo without one is not a stylistic lapse but a broken audit trail.

Prediction and agency should not be conflated. A credit model can estimate the probability that a borrower breaches a covenant. An agentic credit workflow must additionally determine which documents are authoritative, retrieve the relevant covenant language, reconcile contradictory data, simulate possible interventions, check approval limits, request human authorization when required, execute an admissible action, and preserve an audit trail. Increasing the parameter count of the predictor does not, by itself, supply persistent memory, permissions, transaction semantics, or institutional accountability.

Large Language Models in finance are best understood as part of a pipeline rather than as a point solution. Raw documents, time series, and market feeds are curated, normalized, and embedded; retrieval layers keep knowledge current; generation is constrained by financial identities, accounting rules, and risk limits; policies are aligned and evaluated; and decisions are executed within a framework of governance and oversight.

MCP is an interoperability protocol, not a complete governance framework. A regulated institution must therefore place a separate financial control envelope around MCP-based tool use. This envelope includes identity, least-privilege authorization, typed tool contracts, point-in-time evidence checks, deterministic numerical recomputation, approval gates, idempotent execution, and tamper-evident audit records.

Capturing all of these dimensions in a single scalar reward is challenging; in practice, institutions often train separate reward models for different preference dimensions and combine their signals.

For generative systems, quality is vector-valued. A financial LLM is not judged only by a semantic metric such as ROUGE, BLEU, cosine similarity, or pairwise preference. It is judged by a tuple: (3) covering task usefulness, evidence faithfulness, numerical consistency, calibration, policy compliance, latency, and cost.

The technically and institutionally mature objective is bounded autonomy : the agent can plan, retrieve, calculate, and propose actions inside a formally defined action set, while external shields enforce limits and humans retain authority over material decisions.

The architecture has four layers, illustrated in Figure 11.1 . Evidence and assurance flow upward from infrastructure and behavior to risk and accountability, while policy, limits, permissions, and escalation rules flow downward. The layers are interdependent rather than sequential maturity levels.

The central purpose of governance is not to prevent the use of LLMs. It is to make valuable uses repeatable while keeping failure within tolerable bounds.

a financial fine-tuning experiment is not defined by a model name and a training set. It is defined by a decision date, a permissible information set, a task loss, a calibration protocol, and an approval boundary.

This principle prevents a common category error. A model that says it will respect a mandate has not yet respected the mandate. A model that produces a prudent explanation has not yet produced an admissible order. A model that refuses a risky request in a benchmark has not thereby proved that a future tool call cannot violate an entitlement or capital limit. The audit object is the action process together with the evidence and controls surrounding it, not the rhetorical quality of the model’s answer.

Production systems should separate language generation from numerical computation. Let the LLM propose hypotheses, retrieve context, or explain model outputs, but let audited numerical code compute returns, volatilities, correlations, drawdowns, and portfolio weights. A forecast report should include confidence intervals, calibration diagnostics, and explicit uncertainty. If the model cannot cite the data and computation behind a number, the number should not enter the investment process.