Key facts
- Anthropic released Claude for Financial Advisors on September 14, 2026, as an openly licensed plugin for Claude Cowork with eight skills and a connector list of twelve partner systems, and recommends its Enterprise plan for registered advisers because that plan includes the audit logs that support recordkeeping.
- The plugin's public repository describes the skills as plain instructions in Markdown and JSON, states that the plugin holds no client data, and labels itself a reference implementation that is not actively maintained or monitored.
- The repository's security note says some guardrails are structural, and that the rest, including advisor approval before any write to a client system, are enforced by the model following them, not by the runtime.
- The pre-meeting skill instructs the model to pre-select the most likely household when several records match a name and to require the advisor's confirmation, because pulling the wrong client's data into a prep document is a privacy incident.
- As of September 19, 2026, the repository listed the Charles Schwab connector as coming soon and not yet available; Schwab's press release of September 14 announced Schwab as the first and currently only RIA custodian integrating with Claude through Claude for Financial Advisors, and described the connection in future tense.
The most useful sentence in the launch of Claude for Financial Advisors was not in the press release. It was in the README of the public repository that ships the plugin, under a heading called Security considerations. It says that the skills and agents are instructions, not code. A few guardrails are structural. The rest, it says, are "enforced by the model following them, not by the runtime."
That is an unusually honest thing for a vendor to publish, and it is the right place to start reading. It tells a firm exactly what it received on September 14: a carefully written first draft of its AI operating procedures. The draft is good. It is also a draft, and the firm is the author of what comes next.
What actually arrived
Strip away the partner logos and the plugin is a folder of text files. Eight skills, each a Markdown document telling the model how to run first-time setup, prepare for a meeting, turn a transcript into a CRM note, pre-check client-facing material against the Marketing Rule, intake a prospect, review drift, brief on alternatives, or cross-check an estate plan against account titling. A set of narrow helper agents, each doing one job: reading one system, parsing one document, comparing two lists it was handed. A list of connector addresses that point at systems the partners run, not Anthropic.
The plugin stores no client data. When an advisor runs a skill, the model asks a connector for what it needs, works with what comes back, and drafts. Every write to a client system is supposed to pause for approval. Client-facing messages are drafted rather than sent: the skills route them through the compliance check and stop before anything leaves the session. The repository says all of this plainly, and it also says the project is a reference implementation, not maintained, not monitored, not accepting contributions.
None of that is a criticism. A reference implementation is what a firm should want from a model vendor: a readable, forkable statement of how the vendor thinks the work should be done, which the firm can then make its own. The skills are better than most prompt libraries in circulation. They label every figure as read from a system or computed by the model. They route arithmetic to a calculator rather than the model's head. When two sources disagree on a material fact, they stop and surface it as a blocking question instead of presenting both. When a household name returns several records, they show the candidates and require the advisor to confirm.
The question is what stands behind each of those sentences on the day the model does not follow one.
Where the approval lives
Take the household check, since the skill itself calls the failure mode a privacy incident. The pre-meeting skill tells the model to query the CRM by name, confirm identity before pulling anything, and, when several records match, to pre-select the clearly better match, such as the one with the most recent activity, as the default. The advisor still has to confirm. The skill says never to skip that step.
Every firm that has run a portfolio system knows why this matters. Families legitimately have more than one record: a reporting household that rolls up the kids and the trusts, and separate accounts underneath so each can be traded, billed, and rebalanced. The old application put a screen in front of the advisor that made them pick. The prompt now has to find the right record, and the record with the most recent activity is often the trading account, not the reporting household.
The instruction is sensible. It is also an instruction. Nothing in the runtime prevents the workflow from proceeding on a name match if the model, on one occasion out of many, treats the pre-selected default as confirmation. The same is true of the approval before a CRM write, of the rule that connector-reading agents never call a write or send tool, and of the calculator. The README lists all three as enforced by the model, not the runtime.
There are three places a control can live. It can live in the runtime, where the software cannot proceed without it. It can live in a setting the firm chose: a read-only connector scope, an allowlist of systems, a disabled send tool, an audit log switched on. Or it can live in text. A firm adopting this plugin as shipped has most of its controls in the third place. That is a normal place to start and a poor place to be examined in, because Rule 206(4)-7 asks for policies reasonably designed to prevent violation of the Advisers Act and its rules, and a policy whose enforcement is a sentence the model is asked to follow will draw the question of what the firm relied on and why that reliance was reasonable.
What the firm still has to write
Three decisions are not in the folder, and no vendor can make them for the firm.
The first is the fallback. Each skill pulls from whichever connectors are live and falls back to paste or upload when a system is not connected. As of this writing the Schwab connector, the one that drew most of the launch coverage, is listed in the repository as coming soon and not yet available. A firm whose custodian is Schwab, or is not Schwab at all, will be offered the fallback often. Pasting a custodial statement into the tool is a decision about where client information goes, under which plan and which terms, and it is the firm's decision to make, with Regulation S-P safeguarding obligations attached to it. It should be made once, in writing, before the first meeting prep, not in the moment before the meeting.
The second is the record. Anthropic recommends the Enterprise plan for registered advisers because it carries the audit logs that support recordkeeping. Enterprise is listed at twenty dollars per seat per month plus usage at API rates, billed annually, and audit logs and the compliance API are among the controls that appear at that tier and not below it. So a firm on a lower plan has, as its record of what the system saw, what it produced, and who approved it, whatever the firm files itself.
That last sentence is true at every tier, which is the part worth sitting with. A vendor's log is evidence about the vendor's system: who signed in, which conversation was created, which file was uploaded. The client file is the firm's memory. Buying the tier does not produce the second thing, and the next article in this series looks at what the log actually contains.
The third is ownership of the text. If the controls are instructions, the instructions are policy, and policy is the firm's to version and review. The repository is forkable by design. A firm that runs the skills as shipped is running a vendor's procedures under its own name, and a vendor's update to those procedures is a change to the firm's policy that nobody at the firm approved. The fix is ordinary: fork the skills, name the person who approves changes, and treat an edit to a skill the way the firm treats an edit to a written supervisory procedure.
What to do this week
Pick one workflow, the one the firm would run first, and for each control ask which of the three places it lives in: the runtime, a setting the firm chose, or text. Write the answers down. The ones that turn out to be text are the firm's to-do list, in order of where the consequences land: writes to client systems, anything that reaches a client, where client documents go when a connector is missing, and whether the firm's own record would show any of it afterward.
Most firms will find they cannot place every control, and that is worth noticing rather than working around. If nobody at the firm can say whether the household check is held by the software or by a sentence in a skill, that is a question for the vendor, and a better one than most security questionnaires contain.
The plugin arrived as a well-written draft of how an advisory firm should let a model near client work. The firms that get the most out of it will be the ones that finish writing it, and can show that they did.
Questions
What did Anthropic actually ship in Claude for Financial Advisors?
An openly licensed plugin for Claude Cowork containing eight skills written as Markdown instructions, a set of narrow helper agents, and a connector list of twelve partner systems that the partners themselves run. The plugin holds no client data. The repository describes itself as a reference implementation that is not maintained or monitored, and Anthropic recommends its Enterprise plan for advisers because that plan includes the audit logs that support recordkeeping.
What does it mean that guardrails are enforced by the model, not the runtime?
A runtime control stops the software from proceeding without it. A model-enforced control is a sentence the model is asked to follow, such as pausing before a CRM write or confirming a household before pulling data. The README says a few controls are structural and the rest are model-enforced. They hold when the model follows the text and do not hold on the occasion it does not.
Is the plugin unsafe to use?
No. The skills are carefully written and better than most prompt libraries, and a firm using them is better placed than one using a general chatbot with no procedures at all. The point is that the plugin is a first draft of the firm's procedures, not a finished control environment. The firm has to decide the fallback for missing connectors, keep its own record, and own the text.
Which decisions does the firm have to make before running it on client work?
Whether pasting or uploading client documents into the tool is an approved path when a connector is missing, and under which plan and terms. Where the firm's own record of inputs, outputs, and approvals will live, in a system the firm controls. And who at the firm owns the skill text, approves changes to it, and reviews vendor updates before they take effect.
Advisor Insights provides general professional information, not individualized investment, legal, cybersecurity, or compliance advice. Descriptions of Claude for Financial Advisors are drawn from Anthropic's public repository and announcement as of September 19, 2026, and may change. Whether a given control is required, and what a reasonably designed policy looks like under Rule 206(4)-7, is specific to each firm and its approved systems. U.S. context, current as of September 2026.
Primary sources
General information from ValaisOS LLC, not legal, compliance, tax, or investment advice. Confirm requirements for your firm with counsel. See Terms of Use.