How to Set DLP Rules for Account Numbers and SSNs in AI Prompts

Why do account numbers and SSNs in AI prompts matter under Reg S-P?

SSNs and account numbers are the data Regulation S-P treats as most sensitive, so they are the first thing your DLP rules for AI prompts should catch. A Social Security number, or an account number combined with information that could open the account, is "sensitive customer information," and unauthorized access to it can start the rule's 30-day customer notice clock.

The 2024 amendments to Regulation S-P require written policies and procedures to protect customer information, plus an incident response program. The SEC's small entity compliance guide describes sensitive customer information as information that could create a reasonably likely risk of substantial harm or inconvenience if compromised. Its examples include a Social Security number, and a user name or account number combined with something like a security code. Where sensitive customer information was or is reasonably likely to have been accessed or used without authorization, the guide says notice is generally due as soon as practicable and no later than 30 days after the firm becomes aware of it.

Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026. Both dates have passed, so exam questions now focus on whether safeguards work. A data loss prevention (DLP) rule that stops an SSN from leaving in an AI prompt is one of the clearest pieces of evidence a CCO can show.

What should DLP rules for AI prompts detect?

Start with three things: Social Security numbers, bank and routing numbers, and your custodians' account numbers. The first two have built-in detectors in most DLP tools. The third usually needs a custom pattern.

Microsoft Purview ships sensitive information types for each of the first two. The U.S. Social Security number type matches nine digits, formatted or unformatted, and requires a keyword such as "SSN" or "social security number" within 300 characters. The U.S. bank account number type matches 6 to 17 digits with no checksum and requires a keyword such as "checking account" or "bank account number" nearby.

That keyword requirement matters. A prompt that says "Summarize activity in acct 12345678 for the Smith household" may not trip the built-in bank account type, because the keyword list is built around bank, checking, savings and debit accounts. Brokerage and custodial account numbers often need their own rule.

How do you build a custom pattern for custodian account numbers?

Create a custom sensitive information type that matches the account number formats your custodians actually use, paired with the words your staff use around them. Test it against real examples before you turn on blocking.

• Pull a sample of account numbers from each custodian you use and note the length, any letter prefix, and any separators.
• Write a pattern for each format and add supporting keywords, such as the custodian's name, "acct," "account" and "household."
• Set the proximity window so the keyword must appear near the number, which keeps phone numbers and invoice numbers from matching.
• If your client list is stable and you have Purview licensing that supports it, consider an exact data match type, which matches against a hashed table of your real account numbers instead of a pattern.

Keep a short record of each pattern, who approved it and what it was tested against. That record is part of your written procedures.

Where should DLP rules apply in Microsoft 365 and the browser?

Apply them in two places: the AI tools you approved, and the AI tools you did not. Each needs a different control.

For Microsoft 365 Copilot, Purview offers a DLP location that inspects prompts. Microsoft's default policy for Copilot interactions detects about 90 sensitive information types, including U.S. SSN, U.S. bank account number and ABA routing number. It starts in simulation mode, which logs and alerts without blocking, and you must switch it to enforce mode to block the prompt.

For public and unapproved AI sites, Purview can enforce through Edge for Business. Microsoft's walkthrough for blocking sensitive data to unmanaged AI apps applies to Edge profiles on Windows devices managed by Intune and can block sensitive text sent to supported AI apps as well as file uploads to them. Microsoft notes that not every AI app is supported and that blocking can also stop users from opening other browsers on those devices, so plan the rollout. Microsoft describes this capability as billed through pay-as-you-go or per-user Purview licensing, so confirm licensing before you design around it.

If you have not yet decided which AI tools are approved, start with our article on turning an AI policy into Conditional Access and DLP rules. Labels do a different job: they tell AI tools which files to leave alone, covered in how to label client files for AI tools.

Should the rule block, warn or audit?

Run every new rule in audit or simulation mode for two to four weeks, review the matches, then move to block for SSNs and to block with override for account numbers. Tune before you enforce, or staff will learn to work around the tool.

• SSNs: there is rarely a good reason to put a client's SSN in an AI prompt. Block, with no override, for both approved and unapproved tools.
• Bank and routing numbers: block for unapproved tools. For approved tools, block with override and a required business reason, so operations staff can still work and every exception is logged.
• Custodian account numbers: start with block with override in approved tools and block in unapproved tools. Revisit after a month of data.

Send alerts to a named reviewer, usually the CCO or a delegate. Each alert is a possible incident under your Reg S-P incident response program, and someone has to decide whether it is one.

What evidence should you keep for an exam?

Keep the policy configuration, the test results, the alert history and what you did about each alert. That set shows the control exists, that it works, and what happens when it fires.

• A screenshot or export of each DLP policy, its mode and its scope.
• The test log for each custom pattern, with sample matches and misses.
• Monthly alert counts by rule, with false positives noted.
• The disposition of each blocked or overridden event, including any escalation to incident response.
• The written procedure that explains all of the above in plain terms.

What should you do this quarter?

• List the AI tools staff use, approved and not, and the devices they use them on.
• Confirm your Microsoft 365 and Purview licensing covers the DLP locations you need.
• Turn on the default Copilot prompt policy in simulation mode and review the first month of alerts.
• Build and test a custom pattern for each custodian's account number format.
• Deploy an Edge for Business policy for unmanaged AI apps on managed Windows devices.
• Move rules to block or block with override once false positives are under control.
• Write the procedure and file the first month of evidence where your exam binder lives.

How can s90 help?

s90 builds and tunes DLP rules for AI prompts as part of our AI guardrails work for advisers and broker-dealers. We set up the patterns, run them in audit mode with you, and hand you the configuration exports and monthly alert reports an examiner will ask for. If you want to see what your current setup would catch today, we can run that test with you.