Convert a bank statement to CSV without inventing transactions

What you will achieve now

A decision or test applied to “Convert a bank statement to CSV without inventing, losing, or altering transactions.”

• 1 Understand the criterion
• 2 Do a small practice
• 3 Save evidence

A short note with what you did, what went well, what failed, and what you would review next.

• Write the output contract before requesting the conversion.
• Detect invented, lost, duplicated, or altered rows.
• Normalize dates without swapping day and month.
• Reconcile amounts in cents and block an incorrect import.

Twenty rows do not have to be the same twenty rows

An input can contain 20 transactions and the output also 20. That does not prove integrity: the model can drop one row and invent another. The count matches while the set changes. That is why each transaction needs a stable source identifier that is preserved exactly once.

Opening the CSV and “looking fine” is not enough either. A flipped sign turns an expense into income; 12/06/2026 can be wrongly turned into December 6; a new category can break the import; and an unbalanced total can sit off-screen.

The acceptance contract

Lab: an elegant proposal with eight failures

The lab contains 20 fictional transactions and a deliberately defective AI proposal. It keeps 20 rows, but drops MOV-DEMO-007 and invents MOV-DEMO-999. It also flips a sign, creates a category, misreads a date, and breaks reconciliation.

Open the MIT lab for statement-to-CSV

• Read datos/esquema.json and datos/catalogo.json .
• Run npm run evaluar:propuesta . It should exit with code 1.
• Fix a copy without opening solucion/importacion.csv yet.
• Rerun the evaluator until you get zero errors and a difference of zero cents.
• Run npm run verificar to check all invariants.

Prompt with a contract, not with wishes

Transforma únicamente los movimientos proporcionados.
No añadas, elimines, combines ni dividas filas.

ESQUEMA EXACTO
movimiento_id,fecha_iso,descripcion,categoria,tipo,importe

REGLAS
- conserva movimiento_id sin modificar y exactamente una vez
- la fecha de entrada es DD/MM/YYYY; devuelve YYYY-MM-DD
- conserva la descripción sin resumir ni completar
- categoria debe pertenecer al catálogo adjunto
- tipo: ingreso si importe > 0; gasto si importe < 0
- conserva importe y signo con dos decimales
- no añadas columnas, comentarios, totales ni texto fuera del CSV

ANTES DE TERMINAR
- cuenta IDs únicos de entrada y salida
- informa por separado de cualquier fila que no puedas transformar
- calcula la suma en céntimos y exige diferencia 0

La salida es una propuesta. No afirmes que está lista para importar.

The safe six-stage flow

• Copy: keep the original file unchanged.
• Minimize: use the previous tutorial to remove accounts, names, and unnecessary details.
• Transform: produce a proposal under a closed schema.
• Validate: check types, catalog, IDs, and potentially executable content.
• Reconcile: compare rows, the ID set, and the total in cents.
• Approve: a person reviews the sample, exceptions, and destination before importing.

If the evaluator fails, the process stops. Do not “fix” a difference by changing the total: find the row, sign, date, or transformation responsible.

CSV does not mean absence of risk

RFC 4180 documents a common format—header, fields, quotes, and line breaks—but it also warns that implementations differ and that a CSV can share private data. In addition, some spreadsheets treat certain text as formulas. Treat the file as untrusted input, validate the content, and never execute a model output directly.

OWASP calls improper output handling the practice of using an LLM output without validating it or handling it for the destination context. Here the destination is an importer or a spreadsheet: schema and reconciliation are mandatory controls, not optional improvements.

Cost and tool choice

• The lab requires no account, API, Excel, or subscription.
• A paid chat can reduce manual work, but it does not remove review or usage cost.
• For stable rules, a deterministic script is usually cheaper and more reproducible than an LLM.
• Reserve AI for variable formats or ambiguous classification; always validate its output.
• Do not upload real statements without authorization, minimization, and a review of the product and plan.

Primary sources

• RFC Editor · RFC 4180, common CSV format
• Python · reading and writing CSV
• OWASP · validating and handling LLM outputs
• Aulafy · minimize data before using AI

Checked on July 27, 2026. The method is provider-independent; review the format required by your real importer.

If you have saved the evidence for this lesson, continue with “First secure MCP.” If not, repeat the check before moving on.

Learn with a verifiable reference

Aulafy separates stable concepts from data that change—versions, prices, models, and commands. Check the course card for the review date, verified scope, and primary sources.

“Editorial review” means structure, claims, and sources have been reviewed. It does not mean every command has been executed: when a technical test exists, it will be labeled as such.