Bilingual AI Voice IVR on Amazon Connect for a Regulated US Fintech Lender

Rather than replacing the client's existing IVR, we enhanced it with a secure conversational AI layer that intelligently routes customer requests. Amazon Lex V2 identifies caller intent, directing FAQ requests to an Amazon Bedrock knowledge base while routing transactional operations through AWS Lambda and the client's core banking APIs. This hard architectural boundary ensures sensitive customer data never reaches the LLM. Contact Lens provides real-time analytics and compliance monitoring, while the governance console enables controlled content updates with full auditability and one-click rollback.

We added a conversational AI layer directly to the existing Amazon Connect instance using Amazon Lex V2 for bilingual intent recognition in English and Spanish. Callers now hear: "Say what you need, or press a number from the menu." Both inputs are handled simultaneously in a single Connect block. Lex classifies the caller's intent and routes them to the correct flow. A confidence threshold gate ensures that uncertain matches fall back to the DTMF menu rather than guessing. This is the right tradeoff for a regulated environment: a missed intent that falls to DTMF is a minor inconvenience; a misrouted action in a financial IVR is a compliance incident.

The most important architectural decision in the project was where to draw the line between AI-generated and compliance-reviewed responses. We placed Amazon Bedrock with a curated Knowledge Base exclusively in the FAQ lane: branch hours, current rates, product descriptions, and routing numbers. Bedrock answers only from documents the lender's compliance team has reviewed and approved. If an answer is not found in those documents, the system returns a safe fallback and offers an agent transfer. It never synthesises an answer. Every transactional flow, including balance reads, card operations, payments, and dispute intake, runs through AWS Lambda calling the Program API directly. The LLM never sees account data, card numbers, or authentication credentials. This boundary is enforced architecturally, not by prompt instruction. You cannot accidentally cross it because the two paths never intersect.

The client’s strict compliance challenges drove us to implement automated technical controls across PCI DSS, Regulation E, and UDAAP. For PCI DSS, AWS Lambda automatically pauses call recordings before sensitive data entry and resumes after confirmation. This control is rigorously verified by regression tests in every build. To address Regulation E, Lambda instantly logs a timestamp and generates a ticket upon IVR intent detection, ensuring the 10-day statutory clock starts at first contact while providing agents with pre-populated screen pops. Finally, the governance console enforces UDAAP compliance by technically blocking any customer-facing wording from reaching production without written approval.

The client's core banking operations run on third party Program API, providing real-time REST endpoints for balance reads, transaction history, card activation, card freeze and unfreeze, lost and stolen card processing, payments, and statement requests. Lambda functions call a third party system directly over HTTPS with credentials retrieved from AWS Secrets Manager at runtime. No credentials are hardcoded anywhere in the codebase.

We built a browser-based admin console deployed in the client's own AWS tenancy, authenticated via SSO, that gives operations and compliance staff direct control over IVR content without requiring engineering involvement or a code release. Changes follow a five-stage workflow: draft, internal review, compliance approval, canary deployment, and full rollout. No change can reach production without a written compliance officer approval record attached to it. That record is immutable once created and stored in an append-only audit log backed by AWS CloudTrail and S3. Rollback is a single-click action that restores the previous live version across all three service layers in under five minutes, with no code change and no engineering involvement required.

Amazon Connect Contact Lens provides real-time transcription, sentiment detection, and post-call analytics across every call. We built a weekly accuracy dashboard drawing from Contact Lens intent logs, Lambda fulfillment success flags, and post-call CSAT scores. Any week where the wrong action rate exceeds 0.5% triggers an automatic investigation and a mandatory NLU retraining review within five business days. This gave the lender something they had never had: genuine visibility into what their IVR was doing and whether it was doing it correctly.