Regulatory Guardrails in Investment Assistants: CVM, ANBIMA, and the LGPD Paradox

The other day, I discussed the taxonomy of memory (episodic, semantic, and procedural) and how each type requires a different infrastructure layer in a financial assistant.

Today, I want to discuss the problem that no storage layer solves on its own: what happens between the LLM generating a response and that response reaching the client.

That interval of milliseconds of processing is where an institution can commit a regulatory violation unintentionally, without malice, and with no possibility of reversing it after the message has been delivered.

The problem the legal archive does not solve#

You can have S3 WORM configured in Compliance Mode, a Data Warehouse with every audit table, and Redis Checkpointer saving every conversation turn. All of that is indispensable, but it serves to prove what happened after the fact.

If the LLM delivers the phrase "invest now, do not miss this opportunity" to the client, the log will record that a violation occurred. That does not prevent the infraction. CVM Resolution 30 does not accept "the model generated it on its own" as a defense.

What prevents it is a guardrail that intervenes before delivery:

critique_node is not a feature. It is an architectural obligation when the domain is investments.

Violations the LLM naturally commits#

The model will not generate these phrases on purpose. But it will generate them because it was trained on human text, and human text is full of sales language and opinions about portfolios.

Each violation has a specific legal origin. These are not merely arbitrary UX rules; they are obligations with a resolution number and an associated sanction.

The three-layer architecture inside critique_node#

Validation happens in a cascade, with increasing speed and depth:

The three-layer logic is not overhead; it is a cost proportional to risk. Violation 1 can be detected in milliseconds through regex. Violation 3 does not require blocking, only injection. Only violation 2 requires semantic reasoning, and that is where DSPy comes in.

The code implementing each violation#

The solution to violation 3 is not to block but to inject surgically. The LLM generated a valid response. It was simply incomplete:

The Circuit Breaker: when the semantic guardrail fails#

DSPy performs the deeper evaluation: it detects hallucinations by comparing the response with the actual context returned by the tools, assesses whether the model gave a suitability opinion without the necessary data, and rewrites when needed.

But DSPy depends on external infrastructure. What happens if it goes down? Pure fail-open—letting everything through—is the wrong answer for a financial assistant. The right answer is an explicit fallback:

The Circuit Breaker prevents a DSPy failure from turning into a cascade of timeouts that degrades latency for all responses, while keeping the regulatory barrier active through regex. It is resilience with compliance.

The disclaimers ANBIMA requires by response type#

There is no single disclaimer for everything. The obligation changes according to the content presented:

The LGPD vs. AML paradox (and an architectural way out)#

With guardrails and a legal archive in place, the final tension emerges: the LGPD (Art. 18) guarantees data subjects the right to request deletion of their data. Brazil's Central Bank requires financial operations to be retained for up to 10 years for AML/CFT purposes.

How do you implement DELETE in WORM storage?

The industry's answer is Crypto-Shredding (cryptographic destruction):

The file remains in S3, WORM has not been violated, and regulatory integrity is preserved. But without the key, the individual's data is mathematically destroyed. The workflow can still count aggregate transactions. The data subject's privacy has been respected.

It is a solution that simultaneously satisfies Art. 18 of the LGPD and BCB Circular 3,978.

The retention periods you need to configure before heading out to open waters:#

A detail that can go unnoticed and is very important: a guardrail triggered by a CVM violation also goes into the 10-year archive, not as evidence against the institution but as evidence in its favor. It demonstrates that the system detected and blocked the violation before delivery.

Summary#

Guardrails in investments are not output validation; they are automated regulatory control. The distinction matters because it changes how you design them: it is not about checking whether the response is good; it is about checking whether the response falls within the legal limits defined by the Central Bank and the CVM.

The architecture presented has three defense layers:

regex for obvious, immediate violations;
automatic injection for mandatory disclaimers;
DSPy for semantic violations beyond the reach of regex.

With a Circuit Breaker ensuring that the failure of one layer does not compromise the others.

And all of this needs to be recorded, because the legal archive that stores "guardrail triggered with violation 2 blocked" is just as important as the archive that stores the transaction. It is proof that the system was working.