Solutions · Financial services

AI voice agents for financial services.

Taking and initiating calls, with configured sources and actions. This page places the service mechanism alongside the rules that apply in financial services — without claiming a project we have not done.

Discuss your scenario

Starting point

What financial services look like before any software

In a financial services company in the Republic of Moldova, the first thing that happens at a new contact has nothing to do with money. It has to do with the question “who are you”. The law requires that the client’s identity be established and verified on the basis of identity documents and credible and independent sources, before the business relationship is initiated. The consequence for any digital channel is structural, not cosmetic: the conversation splits in two. One part can be held with anyone — conditions, required documents, procedure, schedule. The other part cannot begin before identification has been done, and the line between them must be in code, not in the instructions given to the operator.

The second thing that surprises those building software here is that, in this field, being useful does not mean explaining. When the precautionary measures cannot be met, the entity has the right not to explain to the client the reason for the refusal. And if a report has been sent to the Service for the Prevention and Combating of Money Laundering, disclosure of this fact to the client or to third parties is prohibited. An automated assistant built on the usual commercial reflex — “I am sorry, the request was rejected because…” — is not a friendlier assistant, it is a legal problem. This rule must exist as a technical limit of the system, not as advice in the prompt.

In practice, data are in several places at once: the record-keeping system where the business relationship is maintained, the paper file, an email inbox, a messenger through which the client sent a photo of the identity card, and a spreadsheet kept by someone in operations. The paper file is not conservatism: the law explicitly says that the data are kept for five years on paper and, thereafter, for up to five years in electronic format, and are destroyed upon expiry. Each transfer of the same identification data from one place to another is one more copy that falls under the same term and the same security obligation.

The third reality is the decision. Approval or rejection of a financing request produces legal effects for the person. When such a decision is taken exclusively automatically, the person has the right not to be subject to it, and where it is permitted — for example for the conclusion of a contract — the operator must ensure at least the right to human intervention, to express one’s point of view and to contest it. Practically: a model can prepare, can classify, can signal. The moment when its result becomes a decision must pass through a named person, and that passage must leave a trace.

Finally, who supervises. The National Bank of Moldova has, on its own page, separate supervision sections for banks, non-bank lending, insurance and the payment system, and publishes sanctions applied to non-bank lending organisations, savings and loan associations, currency exchange entities and credit history bureaux. For the money laundering prevention side, the authority is the Service for the Prevention and Combating of Money Laundering. For personal data, the National Centre for Personal Data Protection. These are three different authorities, with three different logics, and an IT system touches them all in the same flow.

The order of a call, with the branch that costs nothing

Regulile

What applies in financial services, with the article it comes from

Each rule below carries the normative act that imposes it. Verification does not require you to take our word for it.

Customer identification is an entry condition, not a form step

The precautionary measures apply before the initiation of business relationships and include identifying and verifying the customer’s identity on the basis of identity documents and of documents, data or information obtained from a credible and independent source, identifying the beneficial owner, understanding the purpose of the relationship and ongoing monitoring. If these requirements cannot be met, the entity is obliged not to carry out the transaction and not to establish the relationship. In a digital product this means that the “unidentified” state must block functions, not just display a message.

SourceLaw No. 308/2017 on the prevention and combating of money laundering and terrorist financing, art. 5 para. (1)–(3)

The refusal is not explained, and the report is not disclosed

When it cannot comply with the precautionary requirements, the reporting entity is entitled not to explain to the client the reason for the refusal. Separately, until the expiry of the retention periods, the entity, its employees and representatives are obliged not to disclose to clients or third parties the data about the transmission of information to the Service for the Prevention and Combating of Money Laundering or about the analyses carried out. Any automatically generated text that “helps the client understand” must go around these two rules, with predefined answers, not improvised ones.

SourceLaw No. 308/2017, art. 5 para. (3) and art. 12 para. (1)

The retention period is five years and is set in law, not chosen by the controller

Reporting entities keep for five years from the termination of the business relationship all data related to activities and transactions, and the data must be sufficient to allow the reconstruction of each transaction so that it can serve as evidence. Documents and information about customers and beneficial owners, including copies of identity documents, account records and business correspondence, are kept for the duration of the relationship and five years afterwards. The data are kept for five years on paper and, thereafter, for up to five years in electronic format, and are destroyed upon expiry.

SourceLaw No. 308/2017, art. 9 para. (1), (2), (6) and (7)

A request for erasure does not отменa a legal retention obligation

The right to erasure does not apply insofar as processing is necessary for compliance with a legal obligation that requires processing, or for the establishment, exercise or defence of a right in administrative, judicial or extrajudicial proceedings. In a financial system, this means that the “delete my data” button cannot be a `DELETE`: it must know what falls under the legal retention term and what does not, and the difference is established with the institution’s lawyers before implementation, not after the first request.

SourceLaw No. 195/2024 on the protection of personal data, art. 17 para. (1) and para. (3) lit. b) and e); Law No. 308/2017, art. 9

An automated decision about a person needs a person

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or affects them similarly to a significant extent. Where the decision is nevertheless permitted — necessary for the conclusion or performance of a contract, or based on explicit consent — the controller must implement at least the right to human intervention, to express their point of view, and to contest the decision. These three rights are translated into screens and audit trails, not into a policy paragraph.

SourceLegea nr. 195/2024, art. 22 alin. (1)–(3)

The national identification number has its own regime

The processing of a national identification number, including through the collection or disclosure of documents containing it, is carried out only in the lawfulness situations in art. 6 para. (1). Where the legal basis is legitimate interest, the law requires named safeguards: technical and organisational measures to minimise data and for security, retention periods established according to the nature of the data and the purpose, plus specific deletion or review periods, and the periodic training of the persons who process. A form that asks for the IDNP “to be sure” without a basis and without a term breaches exactly these safeguards.

SourceLaw No. 195/2024, art. 53 para. (1) and (2) lit. a)–c)

Mecanica

What AI voice agents actually do

The same capabilities that appear on the service page, where each has its own file and back-end line.

The session is requested from the platform, not from the voice provider

The page sends `POST /functions/v1/widget-voice-session` with the widget's public identifier and receives a signed URL back. It never has the agent identifier or any key. The wrong variant — `startSession({ agentId })` directly in HTML — completely bypasses the platform's session, credit and log layer, and exposes the agent to anyone who opens the page source. It is the first check we make on any implementation we take over.

The microphone is requested before the session, so a refusal costs nothing

The order is fixed and it matters: request the microphone with `getUserMedia({audio:true})`, and only if the person accepts request the session. If the visitor refuses, no signed URL is issued and no minute is consumed. The microphone request is made inside the button press, before any wait that could outlast the gesture — otherwise the browser ignores the request.

The agent can be interrupted, and this is adjusted with numbers

On OpenAI Realtime: semantic speech detection, threshold 0.5, 300 ms cushion, 500 ms of silence, interruption enabled by default. On ElevenLabs: the `interruption` event is passed to the controller to stop playback. On top of that, per-agent `turn_timeout` decides after how much silence the agent considers it is their turn — 15 seconds by default, tightened to 12 on a sales agent. And a client-reported “I can’t interrupt it” often has another cause than the thresholds: responses that are too long. We address that in the prompt and in the token limit, not in speech detection.

Call tools during the conversation

The agent is not trapped in what it knows. It can call server functions while speaking — to read availability, write an appointment, send an SMS, or query a catalogue. Tools are declared per agent, with typed parameters and their own execution timeout, so a slow tool does not block the conversation.

Handing off to a human is part of the scenario, not an exception

In messaging, handover to a colleague has its own state on the thread — `handoff_status`, handover time, reason, who is assigned, resolution notes — implemented in a dedicated 619-line module. On the phone, the transfer is handled by the switch: blind transfer via `##` and assisted transfer via `*2`, with the call landing in a dialplan context written for that purpose. These are two different mechanisms because they are two different channels; we write both into the scenario.

The engine and the voice are chosen explicitly, not implicitly

Four supplier positions: `elevenlabs`, `openai-realtime`, `gemini-live` and `auto`. For speech synthesis in languages other than English, the default is `eleven_flash_v2_5` — 32 languages, around 75 ms; the higher-quality version, `eleven_turbo_v2_5`, is around 250 ms. On OpenAI Realtime there are ten voices and engines up to `gpt-realtime-2.1`. The choice is a field in the agent configuration, not an assumption on our part.

The service, in detail

The data

What every system in the industry addresses

The classes of data held by financial services, with the basis for retention where the law provides it.

Customer identification data: Name, identity document and copies of it, national identification number, contact details — everything that serves to establish who the person is. They are collected because the law requires identification and verification of identity, not because it is convenient to have them. For that reason they have no place in a general messaging channel: they go directly into the system that keeps them under term.Keep: For the active duration of the business relationship and five years after its termination; five years on paper and, thereafter, up to five years in electronic format, after which they are destroyed.SourceLaw No. 308/2017, art. 5 para. (2) lit. a), art. 9 para. (2) and (6)
Beneficial owner data: Who actually controls the legal entity client. The law requires identification of the beneficial owner and risk-based measures to verify their identity, including reasonable measures to understand the ownership structure and control structure. It is a separate class because the people behind a company are not clients and, nevertheless, their personal data end up in the dossier.Keep: The same term as the client dossier: the duration of the relationship plus five years; five years on paper, then up to five years electronically.SourceLaw No. 308/2017, art. 5 para. (2) lit. b), art. 9 para. (2) and (6)
Payment data and transaction records: Amounts, calendar dates, counterparties, accounts, descriptions of operations. These are not "identification data" — they do not say who the person is — but they do say what they did, and the law requires the records to be sufficient to reconstruct each activity or transaction, so that they can serve as evidence in proceedings. In practice: a system that summarises and discards detail does not meet the requirement; one that keeps everything, without a retention period, violates it from the other side.Keep: Five years from the end of the business relationship or from the date of occasional transactions; at the Service’s or supervisory authorities’ request, the period may be extended, but by no more than five years.SourceLaw No. 308/2017, art. 9 para. (1) and (2)
Business correspondence and the application file: The messages, the request, the uploaded documents, the internal notes that justify a decision. The law names them explicitly: the archive of accounts and primary documents, business correspondence, the results of analyses and research carried out regarding the identification of complex and unusual transactions. The consequence for a chat channel or an automated agent is that the transcript is not ephemeral: if it is part of the business relationship, it enters the same archive and under the same term.Keep: The duration of the business relationship plus five years, with the same support rule (paper, then electronic) and destruction on expiry.SourceLaw No. 308/2017, art. 9 para. (2) and (6)
Technical access and audit log: Who logged in, what they saw, what they changed, from which address. The IP address is personal data, so the log is processing in itself. For the part that documents an activity or a transaction, the legal five-year period applies; for the rest, the principle of storage limitation applies — data are kept in a form that permits identification of the person only for as long as necessary for the purpose. I have not found any act that sets a general term for the technical logs of a financial entity in the Republic of Moldova: the term is set by the controller on a reasoned basis and is recorded in the processing activities register.Keep: Unverified as a general term established by law. It is determined by the operator, with justification, and is declared in the record of processing activities (Law no. 195/2024, art. 30 para. (1) lett. f)); for logs documenting transactions, the five years from Law no. 308/2017, art. 9 para. (1) apply.SourceLaw No. 195/2024, art. 5 para. (1) lit. e) and art. 30 para. (1) lit. f); Law No. 308/2017, art. 9 para. (1)
Reports to the authority: The special forms submitted to the Service for Prevention and Combating Money Laundering and everything that documents the fact that they were submitted. This class has a particularity that changes the architecture: its existence cannot be disclosed to the client or third parties. In a system with client-visible history, the trace of reporting must be in a separate area, with separate rights, not merely hidden at interface level.Keep: The service keeps the documents and information obtained under the law for five years. For the entity, the prohibition on disclosure lasts until the expiry of the terms under art. 9 para. (1) and (2).SourceLaw No. 308/2017, art. 9 para. (5) and art. 12 para. (1)

Limbajul

The words people there use

An agent that says “programming” where the industry says otherwise is immediately heard as foreign. That is why vocabulary goes into configuration, not into the glossary at the end.

Reporting entity: The category of organisations to which the anti-money laundering law imposes obligations — not just banks. The term matters because it changes the question from ‘what kind of company are you’ to ‘are you on the list in Article 4 or not’, and the rest of the requirements depend on that answer.
Customer due diligence measures: The local translation of what is called in English ‘customer due diligence’. It does not mean ‘prudence’; it means a concrete set: identification and verification, identification of the beneficial owner, understanding the purpose of the relationship, ongoing monitoring. The law has three levels: simplified, normal, enhanced.
Beneficial owner: The natural person who in practice controls a legal-entity client. It is a compliance concept, not an accounting one, and it is the source of most bottlenecks in client onboarding: the company is easy to identify, the people behind it are not.
Business relationship and occasional transaction: Two different regimes. The business relationship is continuous and triggers ongoing monitoring; the occasional transaction is one-off and triggers due diligence above certain monetary thresholds set by law. A digital product that does not distinguish this will ask for either too much or too little.
Politically exposed person: A client who, by virtue of the office held, falls under an enhanced due diligence regime. The list of important public functions at national level that determine this status is approved by order of the Service for the Prevention and Combating of Money Laundering — so it is a list that changes and must be treated as an updatable reference date, not as text in code.
Special form: The means by which activities or transactions falling within the scope of the law are reported to the Service. The method of completion and submission is set out in a methodology published by the Service. For an IT system, it is relevant that reporting has a prescribed format, not a free one.
IDNP: The state identification number of the natural person. In everyday speech it is the ‘personal code’, but in the text of the law on data protection it is the ‘national identification number’ and has its own article, with its own safeguards. An agent that asks for IDNP without knowing the legal basis asks for it unlawfully.
Identification data versus payment data: The first category says who the person is — name, identity document, IDNP. The second says what they did — amounts, dates, counterparties, accounts. They are mixed in the same file, but have different purposes, serve different evidence, and, in practice, should have different access rights. Anyone who treats them as a single ‘client data’ field loses exactly the separation that makes the system defensible.

Where it breaks down

What goes wrong when financial services are digitised in a hurry

The polite assistant that explains refusal

The reflex borrowed from online commerce — tell the client why it did not work, so they do not leave upset — is exactly the behaviour the law restricts here. The mechanism by which it fails: the model receives the instruction “be helpful and transparent”, receives the technical reason for the rejection in context, and reformulates it nicely. Nothing in that chain is a model error; it is an architecture error. The fix is for the reason never to reach the context from which the reply to the client is generated.

Identification made in the wrong channel

The photo of the ID card sent through a messenger app, to make it faster, produces a copy of an identity document in a system that has no retention period, no access log, and is not yours. That copy still falls under the obligation of retention and security, because the data remain the client’s regardless of where they ended up. Systems that work well in this area treat document upload as an operation with its own gate, not as an attachment.

The delete button that does not know what it is not allowed to delete

The right to erasure exists and must be honoured within the deadline. But it does not apply where processing is necessary for compliance with a legal obligation or for the defence of a right in proceedings. In a financial system, a naive implementation makes one of two mistakes: either it deletes what had to be kept for five years, or it rejects any request outright and misses the legal response deadline. Both are avoided through a data map made in advance, where each table has the legal basis and the retention period written down.

The confidence score confused with a decision

A model that returns a probability returns its opinion about itself, not a measurement of correctness. When that number reaches a screen next to the word “approved”, people begin to treat it as a decision, and the system becomes, in effect, one that decides automatically about a person — with all the obligations that come with that. The difference is preserved by design: the model’s output goes into a worklist, not into a result field.

The log without a retention period

Logs are easy to write and easy to forget completely. Two years later they contain IP addresses, session identifiers and fragments of client data, in a volume that nobody ever assessed. The principle of storage limitation requires that data be kept in a form that permits identification only for as long as necessary for the purpose, and the record of processing activities requires, where possible, the envisaged time limits for erasure. A retention period written down once, as a scheduled task, solves both requirements; a retention period written only in a policy solves neither.

Questions

What someone in financial services asks before buying software

Can an automated agent tell the client why their request was rejected?

No, and this is not a matter of tone. When the precautionary measures cannot be met, the entity is entitled not to explain the reason for the refusal to the client, and if a report was sent to the Service, disclosure of that fact is prohibited. In practice, this means a closed set of refusal responses, written by the institution’s lawyers, which the system can choose — not a model that formulates freely.

Can a system approve a request by itself?

The law gives the person the right not to be subject to a decision based solely on automated processing that produces legal effects. Where an automated decision is permitted, the controller must ensure at least human intervention, the expression of the person’s point of view, and contestation. We build the mechanics through which the request moves, is documented and leaves a trace; the thresholds, rules and approval belong to the authorised institution.

Do you provide financial advice or product recommendations for the client?

No. We do not provide financial or investment advice and we do not build systems that give it on your behalf. This is not a limitation that we will lift in a future version: it is an activity with its own regime, which is not part of what we do. What we can build is the route by which a question reaches the authorised person in your institution, with the data already structured.

How long do I need to be able to show a conversation carried out in the digital channel?

It depends on whether it forms part of the business relationship. The law explicitly names business correspondence among the documents kept for the duration of the relationship and for five years after. So the right question before choosing a chat channel is not “what SLA does it have”, but “can I extract from it, four years from now, the exact exchange of messages with client X, in a form that stands up as evidence”.

Do we need an impact assessment before starting anything automated on requests?

An impact assessment is required especially in the case of a systematic and comprehensive evaluation of personal aspects, based on automated processing, including profiling, which underlies decisions with legal effects on the person. An automated funding request triage flow fits that description exactly. The Centre approves and publishes the list of types of operations subject to the requirement, so the list must be checked at the project stage, not assumed.

Do we need a data protection officer?

The obligation arises when the main activities consist of regular and systematic large-scale monitoring of data subjects, or large-scale processing of special categories of data or data on criminal convictions. For a private financial entity, the answer is not automatically “yes” — it depends on what you actually do and on what scale. If the officer is appointed, their contact details are published and communicated to the Centre.

We do not have 250 employees. Do we escape the record of processing activities?

Almost certainly not. The exemption for under 250 employees falls away if the processing is likely to generate a risk to rights and freedoms, if the processing is not occasional, or if it includes special categories of data or data on criminal convictions. A financial activity with permanent clients is not occasional, so the exception does not apply. The record requires, among other things, the envisaged time limits for erasure of different categories of data — that is, exactly the discussion we would have anyway at the design stage.

Where do the data go if we use a language model?

That is set out in writing before the first line of code is written: which fields are allowed to leave your network, to which supplier, on which legal basis and for how long. The practical rule we apply is that identification data and the national identification number do not leave; what does leave, if anything leaves, is the minimum necessary for the requested task. If the answer to this question cannot be given before hand, the project does not start — it is the one point that cannot be fixed later.

Who can inspect us on this side?

Three different authorities, in three different logics. The National Bank of Moldova, which on its own website has separate supervision sections for banks, non-bank lending, insurance and the payment system, and which publishes sanctions applied to non-bank lending organisations, savings and loan associations, currency exchange entities and credit history offices. The Service for Prevention and Combating of Money Laundering, for the prevention side. And the National Centre for Personal Data Protection, for personal data. A single request flow touches all three.

What we cannot claimWe do not provide financial or investment advice, in any form, and we do not build systems that provide it on the client’s behalf — this is not a temporary limitation, it is not our activity. We are not a reporting entity and we do not assume the compliance obligations of the institution: we do not assess applicants, we do not set thresholds, we do not decide who is a politically exposed person. We do not hold any licence, authorisation or notification from the National Bank of Moldova and we do not appear in any of its registers. We do not have payment card data security certification and we do not declare compliance with any industry standard that we cannot show with a document. We have not published our own results in this industry and we cannot cite client names. And if we are asked for a market figure — growth, volume, share — the answer is that we do not have a verified one for the Republic of Moldova and we do not invent it.

The service, in detail What we actually built All scenarios

The service, appliedWe have not yet delivered exactly this combination. What you read above is the mechanism of our service, verifiable on its page, set alongside the rules that govern servicii financiare — each with the article it comes from. What we have actually built sits on the service page and in the portfolio.

Sources 11 sources · verified on 2026-09-07

What would you want to work better?

Tell us about your process. Together we decide what is worth building, what we can connect, and how we check the result.

Let's talk