How to Audit Your Bank or Fintech’s AI Visibility in 30 Minutes

By Yamm Labs · Updated October 2026 · 13 min read

The Monday review is nearly over when the head of digital pastes a ChatGPT answer into the meeting chat. Someone had asked which personal loan apps suit salaried borrowers in Pune. The answer named two rival lenders, cited a comparison site and quoted your processing fee from a page you retired last year. Nobody in the room can say whether that is one bad answer or a pattern. You can find out before lunch. A first AI visibility audit needs a browser, eight prompts, a spreadsheet and about half an hour.

What do you need before you start an AI visibility audit?

You need three inputs, two people on call and no approvals. The audit asks public engines public questions, so nothing goes out under your brand and nothing needs pre-clearance. The fixes it produces will need approval later, which is why the people matter.

AI visibility means that when a buyer asks an AI engine a question your product answers, the engine names you, cites your page and states your facts correctly. GEO (generative engine optimisation) and AEO (answer engine optimisation) are the work that improves it. An AI visibility audit is the measurement that comes first.

1. A product shortlist. Pick the three products that bring in the most applications, for example a personal loan, a savings account and a credit card.
2. A fact sheet for those three products as of today: the interest rate or rate range, the annual percentage rate (APR) where you lend, the main fees, and the exact risk line or disclaimer your compliance team approved. Get it from the product owner and not from the website, because the website may be the thing that is wrong.
3. A blank log. Use a spreadsheet with one row per prompt per engine, and columns for brand named, position in the answer, competitors named, URL cited, fact quoted and fact correct.

The two people are the product owner, who can confirm a fact on chat in a minute, and someone from web operations or IT who can tell you who controls your robots.txt file. Book fifteen minutes with your bank’s compliance reviewer for the next day, so they see a finished findings list.

Phase 1 (minutes 0 to 5): eight buyer prompts beat a keyword list

Engines answer questions, so the audit starts with questions written the way a buyer types them. A keyword such as “personal loan India” typed into an AI engine produces a vague paragraph that tells you little about where you stand.

1. Write three category prompts with no brand in them. These show whether you are named while the buyer is still undecided. Examples: “Which banks offer a zero-balance savings account for freelancers?” and “Which credit card is best for fuel spends on a salary of ₹6 lakh a year?”
2. Write one comparison prompt that puts you against your closest rival, with both names typed in. Ask which is cheaper or which has lower charges.
3. Write two fact prompts about your own product, such as “What is the processing fee on your personal loan?” with your brand name in it. These test whether the engine quotes your current numbers.
4. Write one trust prompt, such as whether your app is safe to link a bank account to, and one rule prompt, such as whether you give a key facts statement before the loan is signed. Trust and rule questions are where a regulated brand loses a buyer to one wrong sentence.
5. Add the city or income band your business depends on to at least three of the prompts. Answers can change when a city appears, so test the segment you sell to.

Eight prompts is enough for a first AI visibility audit. A longer list adds noise faster than signal until you have a baseline.

Phase 2 (minutes 5 to 17): run every prompt in three engines while logged out

Use three engines, because buyers use more than one and each draws on different sources. A practical Indian set is ChatGPT, Gemini and Google Search with AI Overviews or AI Mode. Our own baseline, the Day 1 entry of the Yamm Labs AI visibility log, used those three, logged out, from an Indian connection, because some other engines asked for a sign-in. Eight prompts in three engines gives 24 answers, about thirty seconds each.

1. Open a private browser window and stay signed out. Your team’s history is full of your own brand, and personalised answers will flatter you.
2. Paste each prompt into each engine and fill the log row before you read the next answer. Note whether you are named, in what position, who else is named and which URLs the engine cites.
3. Copy every number the engine states about you, word for word, into the fact quoted column. Do not judge it yet.
4. Run two of the prompts a second time. If the brands change between runs, mark that prompt unstable and do not treat one absence as a verdict.
5. Flag every answer that cites a third party, such as an aggregator or a news article, for a fact about your product. Those citations decide who you call in phase 4.

Answers change with time, location and model version, so date every row. The log is only useful if next month’s run can be compared line by line.

SIGNALNewsletter by Yamm Labs

The next piece, straight to your inbox.

New writing on BFSI brands, B2B and influencer marketing, and AI search.

Email *

Subscribe

Subscription form is not available at the moment

One click to unsubscribe. Privacy policy

Phase 3 (minutes 17 to 22): engines can only cite pages their crawlers may read

An engine that cannot fetch your product page will quote whoever it can fetch. Five minutes with robots.txt and one product page tells you whether that is happening to your fintech or bank.

1. Open the robots.txt file at the root of your domain. Look for rules that name OAI-SearchBot, GPTBot or Google-Extended, and for any blanket rule that blocks all agents.
2. Read each rule against what the agent does. OpenAI’s crawler documentation says sites that opt out of OAI-SearchBot will not be shown in ChatGPT search answers, while GPTBot controls whether content may be used to train its models. Google’s crawler documentation says Google-Extended governs use in Gemini training and grounding and does not affect inclusion in Google Search. A bank can refuse training use and still allow search use, but a blanket block written for one purpose stops both.
3. Open your top product page with JavaScript switched off, or view the page source. Check that the rate, the fees and the risk line appear as text. If they sit inside a banner image, a PDF or a calculator that loads later, an engine may not read them at all.
4. Run the page through a structured-data testing tool. For a loan, the schema.org vocabulary has a LoanOrCredit type under FinancialProduct, with an annualPercentageRate property that includes fees and a separate interestRate property.
5. Write down who owns robots.txt. In a bank it often sits with IT security, which changes how long the fix will take.

If this phase finds a block on the search agents, nothing you write will be cited by that engine until the block is lifted.

Phase 4 (minutes 22 to 27): a wrong rate in an AI answer usually starts on your own pages

Compare every quoted fact in the log with the fact sheet from the product owner. Mark each one correct, out of date or wrong. Then find where the engine got it, because the fix depends on the source.

1. If the cited page is yours and current, the engine misread it. Check whether the number sits next to other numbers, such as a promotional rate beside the standard range, and whether the page says the date the rate applies from.
2. If the cited page is yours and out of date, you have found an old URL that still answers questions. Update it or redirect it to the current page. Two live rate pages will keep producing two answers.
3. If the cited page belongs to an aggregator, a distributor or a news site, list it for your partnerships or PR lead. You cannot edit it, but you can ask for a correction and give the engine a better page of your own to cite.
4. Check the risk line. If an engine describes a mutual fund scheme or an insurance plan with no risk line, or under the wrong company name, note which page it used.

This is the phase where Indian rules shape the page, and where the decisions get concrete.

• Lenders: publish the APR on the same basis as the key facts statement. RBI’s rules on the Key Facts Statement (KFS), issued in April 2024, require lenders to give retail and MSME term-loan borrowers a KFS, including the APR, before the loan contract is executed. In the April 2024 circular, RBI defines the APR as the annual cost of credit, covering interest and all other charges. If your product page shows only a headline interest rate, an engine has no APR of yours to quote and may take one from a comparison site. Our decision for lending pages: state the APR range in text beside the interest rate, add an as-of date, and mark it up as annualPercentageRate.
• Mutual funds: keep the standard warning in the page text. SEBI requires the standard mutual fund warning in scheme advertisements, and under a 2008 circular audio-visual ads must display and voice it for five seconds. That rule is written for advertisements. On a scheme web page our decision is about placement: the warning goes in readable text inside the summary paragraph an engine is most likely to lift, and a footer copy alone is not enough.
• Insurers: put the registered name next to the brand name. IRDAI’s 2024 policyholder-protection regulations require every insurer’s advertisement to show its registered name with its trade name or logo prominently. A plan page with the short brand in the header and the registered name only in the footer gives an engine two entities. Our decision: registered name and trade name together in the first paragraph, and in the legalName and name fields of the page’s Organization schema. The same regulations require the insurer’s written approval before a distribution channel issues an advertisement, so your partner team should hold the record for any distributor promotion an engine cites.

Phase 5 (minutes 27 to 30): score the audit so every gap has an owner

Score each answer 0, 1 or 2. A 2 means the engine named you and either cited your current page or stated your facts correctly. A 1 means you were named but with a wrong fact, an old page or a third-party citation. A 0 means you were absent.

AI visibility score = total points ÷ (prompts × engines × 2) × 100

Take a hypothetical lender that runs eight prompts in three engines. That is 24 answers and a maximum of 48 points. If it scores 2 on six answers, 1 on ten and 0 on eight, it has 22 points and a score of about 46. The split matters more than the headline number. Ten answers that named the brand with a wrong fact or a borrowed citation can usually be fixed in weeks. Eight absences in category prompts are a longer content job.

1. Sort the log by score and group the 1s by cause: wrong fact, old URL or third-party citation.
2. Give each group one owner and one artefact, such as a page edit, a redirect, a robots.txt change or a correction request.
3. Save the log with the date in the file name. It is now your baseline.

The table is the whole audit on one screen. Times are typical practice, and no regulator or engine publishes them.

How long does an AI visibility audit take, and who signs off?

The first pass takes about thirty minutes once the fact sheet is ready, as typical practice and not a published standard. The fact sheet is the slow part: getting a current rate, a fee table and the approved risk line out of a product team can take a day, so ask the day before.

The AI visibility audit itself needs no sign-off, because it changes nothing. Each fix has its own approver. Page copy goes to compliance under your normal pre-approval process. Schema changes and redirects go to the web team with a change ticket. A robots.txt change goes to whoever owns site security, and in a bank that review can outlast the copy changes, so plan around it.

A monthly rerun takes around twenty minutes, because the log and the fact sheet already exist.

How do you know the audit worked?

The audit worked if next month’s log can be compared with this month’s and shows movement you can trace to a specific fix. Four signals are worth watching.

• Fact prompts quote your current rate, fee or APR, and cite your own page.
• Third-party citations for facts about your product fall, and your URL replaces them.
• Your brand appears in category prompts for the segment you named, in at least one engine.
• Prompts you marked unstable settle down and return the same brands across two runs.

No one can promise a placement in an AI answer. What you control is whether engines can read a current page that carries your name and your approved facts. That is the real test of any fintech GEO plan: did the citations move to pages you own?

What should you do when a step fails?

Most failures in a first audit come from the prompt or the people, and few come from the engines.

• The engine gives a generic answer with no brands. Add a city, an income band or a product feature to the prompt. If it still names no one, the prompt is too broad to measure, so replace it.
• The answer changes on every run. Keep the prompt, mark it unstable and judge it across three monthly runs. One absence in an unstable prompt tells you very little.
• You are absent from every category prompt. Check phase 3 first. If crawlers can read the pages, the gap is content: no page of yours answers the question the buyer asked. That is a GEO content plan, and it takes months.
• IT security will not change robots.txt. Ask for the narrower change: allow the search agents and keep the training agents blocked. OpenAI and Google document these as separate controls.
• Compliance will not approve rates in page text. Ask what format they will approve. A rate table with an as-of date and a reference to the source document is usually easier to approve than a promotional banner, because it reads as a disclosure.

What should you tell your compliance team about the audit?

Your bank’s compliance reviewer will ask what you found and what you want to change. This can go into an email as written.

“We checked how eight buyer questions about our loan, savings and card products are answered by three AI engines. Some answers quoted out-of-date fees from a retired page, or cited a comparison site in place of ours. We propose the attached line changes to current product pages, each with its approved source document. No new claims are added; existing approved facts move into readable text with an as-of date. We will recheck the same questions next month and keep the log.”

This is general guidance, not legal advice; your compliance team decides.

When is a thirty-minute AI visibility audit the wrong tool?

The half-hour version is a smoke test for one team and three products. It is the wrong tool in three situations.

• You have just renamed the brand or merged with another entity. Engines will mix the old and new names for a while, and the audit will mostly measure that lag.
• Your bank runs dozens of products across retail and business banking. Thirty minutes covers three, so you need a prompt set per business line.
• You want to know whether AI answers drive applications. The audit measures presence and accuracy; attribution needs analytics work on referral traffic.

If the audit shows gaps across several business lines, the next step is a structured programme with a fixed prompt set, a fact register and monthly reruns. That is the scope of our AI visibility work for BFSI brands. For the terms and trade-offs behind it, see AI search optimisation: 100 questions answered.

An engine can only quote the rate your page states in plain text, so the fix for a wrong AI answer usually starts on your own product page.

People also ask

What is an AI visibility audit?

It is a check of whether AI engines such as ChatGPT, Gemini and Google’s AI Overviews name your brand, cite your pages and state your facts correctly when buyers ask about your category. For a bank or fintech it adds one more test: whether regulated facts such as the APR, fees and the risk line are quoted as currently approved.

How often should a bank rerun an AI visibility audit?

Monthly with the same prompt list is typical practice, plus an extra run after any rate change, product relaunch or rename. Fixed prompts make one month’s log comparable with the next.

Should a bank block GPTBot in robots.txt?

That is a policy decision about model training for the bank’s IT security and legal teams. OpenAI’s documentation treats GPTBot as the training crawler and OAI-SearchBot as the one that decides appearance in ChatGPT search answers, so a bank can block one and allow the other.

Can an agency guarantee my fintech appears in ChatGPT answers?

No. Engines choose their own sources and answers change between runs. An agency can make your fintech’s pages readable and current, fix how your entity is named, and measure whether citations move to pages you own.