The Norwich & Peterborough building society has been told to repay £28,000 to a couple to whom it sold a policy from troubled investment firm Keydata.
The ruling has been made by the Financial Ombudsman Service (FOS).
Keydata went into administration last year and most of the £450m invested by 30,000 investors is now at risk.
The N&P sold Keydata policies to about 3,500 of its customers and has denied any liability for their losses.
However, the FOS has decided that the N&P should reimburse the two clients - an elderly couple from Suffolk - who were advised by the society to put £28,000 into four Keydata policies in 2007.
The FOS ruling says the N&P wrongly advised the couple to invest more than 40% of their savings in the investments - second-hand life insurance policies from the US - that were too risky for their circumstances.
"The fund's underlying mixture of assets exposes [the clients'] capital to a greater degree of risk than they were likely to be willing to accept," the FOS adjudicator said.
"I do not believe that [the clients] would have invested in this product, had they been fully aware of the risks."
The FOS ruling is a preliminary one.
The N&P's chief executive Matthew Bullock said he expected a final decision in September, after his society had gone back to the FOS to argue that the policies had not been as inherently risky as the adjudicator had suggested.
"There are other similar bonds which are remarkably stable," he said.
"But no-one need have any worries that the N&P will stand by its responsibilites, we will do whatever is finally decided," he added.
However, the FOS decision opens up the possibility that many of the other N&P customers who were advised to put their savings in Keydata policies may demand similar compensation, at great expense to the society.
Gareth Fatchett, a lawyer with the firm Regulatory Legal, said he represented 250 other N&P clients whose cases would shortly be lodged with the FOS.
He said he expected a similar outcome for them.
"We expect every single one to go our way," he said, "they were retired, low-risk, investors."
Keydata was put into administration by the Financial Services Authority (FSA) in the summer of 2009 after the authorities decided it had become insolvent.
It rapidly emerged that it was at the centre of a huge fraud, which is still being investigated by the Serious Fraud Office and the Financial Services Authority.
Just over £100m belonging to about 5,500 investors had been stolen by the owner of SLS, a Luxembourg investment firm which had provided the initial policies sold by Keydata.
Then the remaining £350m, invested in policies provided by another Luxembourg firm called Lifemark, became trapped when that country's authorities put it into provisional administration.
The 23,000 investors in Lifemark policies still do not know when they will be able to get any of their money back or if their policies even have any remaining value at all.
Most of the Keydata investors in SLS have received some compensation from the UK's Financial Services Compensation Scheme (FSCS) for their losses.
But the investors in the Lifemark funds have been told to wait until September, by when the FSCS says it will be in a position to decide if it can offer them compensation too.
So far, some of them have received limited compensation only, in the form of having income tax bills paid because their policies were wrongly described by Keydata as being tax-free Isas (individual savings accounts).