Microsoft Copilot in Financial Services: MNPI, SOC 2, FINRA

Last updated November 4, 2026 by Errin O'Connor, Founder & Chief AI Architect, EPC Group

Financial services Copilot governance starts with one workflow and the information it reaches, not a certificate. Controls: permissions, sensitivity labels and DLP for MNPI, information barriers in Teams, SharePoint and OneDrive (not email), Restricted Content Discovery for sites under review, Communication Compliance, and retention under SEC Rule 17a-4 (WORM or the audit-trail alternative since January 3, 2023). FINRA Regulatory Notice 24-09: the rules are technology neutral; Rule 3110 supervision and Rule 2210 content standards apply. EPC Group Financial Services Copilot: SOC 2 Readiness, MNPI Design, Foundation Hardening and Rollout, each a fixed fee set at scoping.

Key Facts

Start from one workflow and the MNPI it can reach; an audit report on the platform is not evidence for the workflow
MNPI protection: sensitivity labels + DLP (including the Copilot location) + information barriers + Restricted Content Discovery
Information barriers cover Teams, SharePoint and OneDrive, not email
SEC 17a-4(f) since January 3, 2023: WORM storage or a time-stamped audit trail; Copilot for Microsoft 365 is on Microsoft's in-scope list
FINRA Regulatory Notice 24-09 (June 27, 2024): technology-neutral rules; Rule 3110 supervision and Rule 2210 apply
EPC Group Financial Services Copilot: fixed-fee services set at scoping, plus Copilot licenses

Start with one workflow and test the controls, not the certificate

An audit report on Microsoft's controls shows that the platform was examined. It does not show that a firm's own Copilot use meets its obligations. That is shown one workflow at a time, with tests the compliance owner can rerun.

Step	What is decided	The control and its limit
1. Define the use case	One workflow, its users, the content it reaches, and whether any output goes to customers	Customer-facing output falls under the Rule 2210 content standards; internal use sits inside the Rule 3110 supervisory system (FINRA Regulatory Notice 24-09)
2. Identify sensitive information	Where MNPI lives (deal sites, Teams channels, mailboxes) and who may see it	Copilot only surfaces content a user can at least view; information barriers restrict Teams, SharePoint and OneDrive but cannot restrict email
3. Test the controls	Scenario tests with named test accounts on each side of every barrier, rerun after each policy change	Restricted Content Discovery keeps chosen SharePoint sites out of Copilot and organization-wide search without changing permissions; it does not cover OneDrive and is meant as a temporary control
4. Document approval and monitoring	Who approved the workflow, which records are kept and how they are reviewed	Rule 17a-4(f) accepts WORM storage or a time-stamped audit trail; Microsoft lists Copilot for Microsoft 365 as in scope, and Cohasset Associates assessed Microsoft 365 against the rule (2024)

The sample scenario-test sheet (CSV) lists eight step-3 tests, from a public-side analyst asking Copilot for a deal model to a records search of Copilot interactions. Its rows are synthetic examples, not client data.

Primary sources

Learn about Information Barriers — Microsoft Learn, updated 2026-03-30
Restrict discovery of SharePoint sites and content — Microsoft Learn, updated 2026-10-11
Data, Privacy, and Security for Microsoft Copilot — Microsoft Learn, updated 2026-07-09
SEC Rule 17a-4, SEC Rule 18a-6, FINRA 4511 and CFTC 1.31 — Microsoft Learn, updated 2025-06-06
Regulatory Notice 24-09: generative AI and large language models — FINRA, June 27, 2024

Financial Services Copilot FAQ

Can financial services firms use Microsoft Copilot?

Yes, with controls set for each workflow. Before rollout: (1) permissions cleaned up, because Copilot only surfaces content a user can at least view. (2) MNPI located and labeled, with DLP and, where groups must stay apart, information barriers. (3) Communication Compliance and supervision for FINRA and SEC oversight. (4) Retention set for books-and-records obligations, including Copilot interactions where they are records (SEC Rule 17a-4 for broker-dealers, Rule 204-2 for investment advisers). (5) Audit search confirmed for the pilot group. An audit report on the platform's controls does not by itself show that a firm's own Copilot use meets these obligations; scenario tests on the firm's workflows do. Financial services Copilot rollout typically takes 20-32 weeks, fixed fee quoted after discovery.

What is MNPI protection in Copilot?

Material non-public information (MNPI) is information about an issuer or its securities that has not been made public and that a reasonable investor would consider important. Protection for Copilot comes in layers: (1) Sensitivity labels: MNPI content is labeled and encrypted, and Copilot honors the usage rights a label grants each user. (2) Classification: custom sensitive information types or trainable classifiers tuned to the firm's deal code names and filings calendar. (3) DLP: blocks MNPI from unauthorized recipients and channels, and a DLP policy for the Microsoft 365 Copilot location keeps labeled items out of Copilot answers. (4) Information barriers: segments that cannot find, chat with, share with or open each other's sites in Teams, SharePoint and OneDrive. (5) Restricted Content Discovery: keeps chosen SharePoint sites out of Copilot and organization-wide search while permissions are reviewed, without changing who can open them.

What are information barriers?

Information barriers (IB) are Microsoft Purview policies that restrict two-way communication and collaboration between defined groups in Microsoft Teams, SharePoint and OneDrive: restricted users cannot find, chat with, call, add or share with each other, or open and search each other's sites. IB supports only two-way restrictions and cannot restrict email, so mailboxes need Exchange mail flow rules (Microsoft Learn, Learn about Information Barriers, updated 2026-03-30). Financial services segments: (1) M&A and deal teams vs public-side employees. (2) Research analysts vs investment bankers. (3) Trading vs corporate finance vs equity research. (4) Wealth management household separation. (5) Restricted-list holders vs general employees. Because Copilot only surfaces content a user can at least view, SharePoint and OneDrive access that IB blocks stays outside that user's Copilot answers; test it with accounts on each side. Confirm IB licensing for your plan in Microsoft's service description.

What is SEC 17a-4 retention?

SEC Rule 17a-4(f), as amended effective January 3, 2023, lets broker-dealers keep electronic records for each record type's retention period either with a complete time-stamped audit trail (the audit-trail alternative) or in non-rewriteable, non-erasable (WORM) format. Microsoft lists Copilot for Microsoft 365, Exchange Online, Teams, SharePoint Online, OneDrive, Loop and Viva Engage among services with features that can be configured to comply, and Cohasset Associates assessed Microsoft 365 and Azure against Rule 17a-4(f)(2), Rule 18a-6(e)(2), FINRA Rule 4511(c) and CFTC 1.31 (2024). Preservation Lock supports the WORM option; Purview Data Lifecycle Management, eDiscovery (Premium) and Audit (Premium) support the audit-trail alternative. The firm still designates an executive officer or third party for the required undertaking; Microsoft provides the separate SEC undertaking letter through a support request (Microsoft Learn, SEC Rule 17a-4 offering page, updated 2025-06-06). Whether a given Copilot prompt or response is a required record depends on its content and the firm's books-and-records analysis.

How does FINRA view AI + Copilot?

FINRA Regulatory Notice 24-09 (June 27, 2024) reminds member firms that FINRA's rules are technology neutral and apply when firms use generative AI in the course of their business. It names two rules: Rule 3110 requires a reasonably designed supervisory system tailored to the business, and the content standards of Rule 2210 (communications with the public) apply to AI-generated communications. For Copilot, internal use sits inside the supervisory system, and any output that reaches customers goes through the firm's communications review before it is sent.

What is the SOC 2 impact of Copilot?

SOC 2 is an attestation report on a service organization's controls, not a certification that a product is compliant. It matters for Copilot in two ways: Microsoft publishes audit reports on its own controls, and a firm whose own SOC 2 scope includes systems where staff use Copilot must show its controls over that use. Auditors work against the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy. Firms adding Copilot to SOC 2 scope document: (1) Copilot licensing and purpose. (2) A data flow map of the customer data Copilot can reach. (3) Access controls and permissions. (4) Audit and retention configuration. (5) Change management for agents, prompts and configuration. (6) Incident response for AI-related issues.

How does EPC Group approach financial services Copilot?

EPC Group Financial Services Copilot methodology: (1) SOC 2 + FINRA Readiness Assessment (4 weeks): 12-gap review plus financial-services-specific controls. (2) MNPI + Information Barriers Design (6 weeks): sensitivity label taxonomy, classifiers and information barrier segments. (3) Foundation Hardening (10 weeks): MNPI labels and DLP, information barriers, Communication Compliance and retention deployed. (4) Copilot Pilot (4 weeks): a pilot with segmented cohorts (research, banking, corporate) and scenario tests on each side of every barrier. (5) Full Rollout + Governance (20-32 weeks). Each phase is a fixed fee quoted after a scoping call; year-1 total is the services plus Copilot licenses.

Related EPC Group Services

SOC 2 + FINRA Copilot Readiness Assessment

4-week fixed fee: 12-gap + financial-services-specific audit. Call (888) 381-9725.

Business Hours

Monday-Friday, 8 AM - 7 PM CT

Quick Response Guarantee

We respond to all inquiries within one business day