I started this analysis because I seem to be having the same conversation everywhere at the moment. It comes up on Fintech Daydreaming and other podcasts repeatedly, at work, at conferences and in discussions with banks, technology providers and consultants. Depending on who is talking, Agentic AI is either about to change banking completely, or it is another technology cycle where the sensible response is to keep improving today’s channels and wait for the hype to settle.
After going through the research, I do not think either position is particularly helpful. And maybe I was also helping to fuel the panic?
The main thing I had right is that Agentic AI in banking is not one transformation moving along one adoption curve. There are at least three. Agentic Engineering is already beginning to change how banks build and modernise technology. Agentic Operations is moving into real, controlled banking workflows. Customer-facing Agentic Banking could eventually have the largest strategic impact because it changes who owns the interface, the context and potentially the financial decision itself, but it is also the least settled because trust, delegated authority, liability and security become much harder once an agent can actually move money.
There is enough evidence for banks to act now, but not enough evidence to justify panic. The no-regret investments are visible and include better data, clean and machine-consumable interfaces, modern identity, granular permissions, policy controls, observability, auditability and stronger engineering platforms. Banks should experiment with increasing agent autonomy, but the evidence today argues for a fairly simple design principle. Give agents considerable freedom to reason, and be much more conservative about their authority to execute.
One thing is for sure, the bank app is not about to disappear. What may disappear over time is its monopoly on the relationship. And that is a rather different strategic problem.
Why I went looking for the evidence
like I already said, we seem to be talking about Agentic AI everywhere at the moment.
Some people have a fairly dramatic version of the future. The mobile banking app starts to become less relevant because customers increasingly interact through personal agents. Those agents understand our financial position, compare providers, search for better products, move money, manage payments and perhaps eventually orchestrate much of our financial life without us having to think very much about which bank actually sits underneath it all.
Back in 2018-ish (can not identify the exact year), Temenos came out with a futuristic view on banking powered by digital personal assistants and agentic capabilities titled “The Bank of Me“. I always found the video unsettling, but many view this as the ideal future that we are fast approaching.
McKinsey, argues that within three to five years an AI agent could become the channel of choice for banking interactions. BCG estimates that AI has the potential to increase bank profitability by 30% and reduce costs by 30% to 40% by 2030. Accenture has modelled up to US$289 billion in potential pre-tax profit from scaled AI adoption across the world’s 200 largest banks over three years. IBM’s 2026 banking outlook found 57% of surveyed executives expecting tokenised settlement rails to significantly strengthen agentic AI and autonomous transactions. These are substantial numbers, and it is not difficult to understand why bank boards are paying attention.
At the same time others are pointing out that banking has heard versions of this story before. The death of branches. The end of cash. Big Tech replacing banks. Blockchain replacing half the financial system. Some of those technologies became very important, but not necessarily in the way or on the timeline originally predicted. Banking also comes with some awkward constraints that a futuristic personal assistant demo does not. Regulated money, financial loss, fraud, suitability, identity, operational resilience and a customer who may be rather less relaxed when an autonomous agent gets a mortgage decision wrong than when it books the wrong restaurant. Europe already places financial institutions inside DORA’s operational-resilience regime, while the AI Act moved into a substantially more active enforcement phase on 2 August 2026.
I have my own bias here as well. I have been arguing for years that banking is moving towards platforms, embedded finance and increasingly fragmented customer relationships. My recent Revolut analysis and post was partly about exactly that, the customer can retain a mortgage and salary relationship with one institution while payments, savings, FX, investments and daily engagement quietly move somewhere else.
Agentic banking fits rather nicely into that view of the world.
That is why I wanted to go through what is actually happening across the industry and see whether the available evidence genuinely supports the story we are telling ourselves, or not.
I went through the material from McKinsey, BCG, Accenture and IBM, but tried not to treat consulting forecasts as the only facts, after all I did work as a consultant at IBM for close to 30 years and can at times adopt the consultant view of the future. I looked at what NatWest, DBS, BBVA and Revolut are actually doing. I looked at the work Visa and Mastercard are doing around agent-initiated payments and proof of consumer intent. I looked at consumer research, European regulation, NIST’s work on agent security and the rather public Hugging Face incident from July.
I started with the question, “is there a reason for banks to panic about Agentic AI?”
The simple answer that I concluded with was that “I don’t think there is”
But I also came away convinced that “wait and see” is a poor strategy, because some parts of this transformation are already much more real than the consumer-facing discussion suggests.
And that begins with separating three things we keep bundling together in our discussions.
Three changes are hiding behind one label
One problem with the current discussion about Agentic AI is that almost anything involving an LLM and a workflow risks being seen as the same thing.
A chatbot that explains my last transaction is not the same thing as an agent authorised to execute one. A developer asking AI to generate a Java method is not doing the same thing as an engineering agent that can analyse requirements, inspect a codebase, understand dependencies, generate implementation and tests, run those tests and iterate against the results. And neither is the same thing as me telling a personal financial agent to optimise my savings and giving it permission to move my money.
The more research I have done, the more useful I find it to separate the discussion into three different shifts.
Agentic Engineering is about how the bank builds and changes itself within. Requirements, architecture, coding, testing, documentation, legacy modernisation, deployment and eventually parts of operations and remediation. IBM now explicitly uses the term agentic engineering for an engineering model in which people orchestrate and oversee agents through the software-development process, while McKinsey describes more advanced organisations redesigning software delivery so that agents work across stages rather than merely assisting an individual developer.
Agentic Operations is about how work gets done inside the bank. Credit preparation, customer servicing, fraud, compliance, finance, KYC, relationship management and operational workflows increasingly become combinations of humans, agents, models, deterministic rules and existing banking systems. DBS’s current deployment around corporate banking is a good example: specialised agents carry out more than 70 tasks around credit analysis, with bankers and risk managers remaining part of the process rather than disappearing from it.
Then there is Agentic Banking where agents increasingly acting on behalf of customers, interpreting intent, comparing financial providers and eventually being allowed to execute within delegated authority. That is the part most likely to alter banking distribution and the meaning of a “primary bank”, but it is also where consumer trust, permissions, payment authorisation, liability and security all become much more difficult. McKinsey’s consumer research, Mastercard’s work on verifiable intent and the first controlled Visa/BBVA and Visa/Revolut transactions show pieces of that future emerging, but not yet the broad autonomous financial agent imagined in some presentations.
Once we separated those three, quite a lot of the apparent disagreement across the industry started making more sense. Someone saying Agentic AI is “already here” can be perfectly correct if they are talking about engineering or a bounded internal workflow. Someone saying autonomous agentic banking remains years away can also be correct if they mean a general-purpose consumer agent independently managing financial relationships across multiple institutions.
This is my current working horizon. I would treat it as a way of thinking about the next decade rather than a prediction that something magical happens on 1 January 2029.
The reason I put Agentic Engineering first is because after doing the research and thinking, it appears to have fewer obstacles between today’s capability and meaningful deployment.
The engineering shift is moving faster than I expected
Only a few weeks ago I wrote AI Is Bringing the Builder’s Bias Back – Could This Become Your Bank’s Next Headache?, where I argued that AI was making software so much quicker and cheaper to create that banks could easily swing too far back towards building everything themselves. We spent decades learning that the cost of software does not end when the first version goes live, and being able to generate a lot of code very quickly does not make the long-term responsibility for operating, securing and maintaining it disappear.
I still think that warning stands. What I would change today is how narrowly I framed the economics. I was largely thinking about AI making development cheaper. Agentic Engineering potentially compresses much more of the lifecycle, discovery, dependency analysis, architecture, development, testing, documentation and parts of modernisation itself. If that continues, some capabilities that made little economic sense to build internally five years ago may genuinely become rational to own.
That does not suddenly make “build” the right answer to everything, particularly when software vendors have access to exactly the same capabilities and can spread those gains across many customers. But I probably underestimated how quickly Agentic Engineering could start moving the cost curve underneath the build, buy or consume decision itself.
There are already signs that this is starting to influence actual sourcing decisions within the larger banks.
McKinsey’s August 2026 State of AI survey found that 40% of respondents from organisations with more than US$1 billion in annual revenue said their organisations were scaling AI agents, up from 27% the previous year. Around 31% of those larger organisations were scaling coding agents. The data points that caught my attention, was that 32% of respondents said their organisation had already chosen not to buy one or more software products or features because it believed it could build them internally using agentic coding tools.
That is almost a living demonstration of the builder’s-bias argument.
But coding is only part of it.
McKinsey describes leading organisations beginning to run a development flow in which requirements can be enriched, architecture dependencies validated, code generated, tests created and executed, and exceptions pushed back to people for review. It says multiple companies involved in this work have reported three- to five-fold productivity improvements. Those are leading-case observations from McKinsey’s work, not a bank-wide benchmark that anybody should drop into a business case, but they suggest the economics of software delivery really are beginning to change.
NatWest gives us a nice banking example. It says more than 12,000 of its coders are using AI and around 35% of the bank’s code is now written with AI assistance. More importantly for this discussion, NatWest says it is rolling out “agentic-led engineering” after trials in RBSI and Financial Crime where it reported tenfold productivity improvements. Again, that tenfold number comes from NatWest and refers to selected trials. It does not mean NatWest has made its whole engineering organisation ten times more productive. But this is clearly becoming something more substantial than developers occasionally asking a coding assistant for help.
Where I think this becomes particularly interesting for banks is when we look at legacy modernisation and legacy analysis.
Writing replacement code has never been the only difficult part of replacing a banking system. Often the harder problem is working out what the old system really does. Which applications depend on it? Which behaviours are documented? Which ones exist because somebody added a condition to a programme in 1998? What happens to the obscure transaction that only occurs 400 times a year? How do you prove the replacement behaves identically before you start deliberately changing the business behaviour?
Agents are becoming useful precisely because they can work across large bodies of code and documentation, inspect dependencies, generate tests, compare implementations and iterate continuously. McKinsey explicitly identifies brownfield rebuilds and legacy modernisation among the promising targets for agentic software delivery.
I can therefore see a credible progression from today’s coding assistants towards something much closer to an AI-enabled modernisation factory that will discover the estate, infer behaviour, map dependencies, create equivalence tests, propose a target design, generate components, run tests, identify discrepancies and keep iterating.
That does not mean we are suddenly going to replace a 30-year-old core banking estate in a weekend.
In fact, Agentic Engineering may expose something banks already know but occasionally prefer not to discuss. If software itself becomes dramatically quicker to produce, the bottlenecks move elsewhere. The requirement still needs to make sense. The target architecture still needs to be clear. The environment still needs to be available. The test data still needs to be usable. Security and risk decisions still need to happen. McKinsey makes much the same point, that if functions such as risk, legal, procurement and testing do not change with the delivery model, a faster inner development loop does not necessarily produce faster enterprise change.
If it takes three months to approve an interface, generating that interface in twenty minutes only solves a very small part of the problem.
There is another consequence for the build-versus-buy argument. Agentic Engineering genuinely changes the economics of building, so I no longer think it is enough to say AI makes development faster but leaves the sourcing decision fundamentally unchanged. Some capabilities that were economically irrational to build five years ago may become perfectly rational when discovery, development, testing and maintenance are increasingly automated.
But if the agents create the software, you have still built it.
You still own the architecture. You still own the security. You still have to operate it. You still have to understand what happens when a regulatory requirement changes. And at two o’clock in the morning, “the agents wrote it” is unlikely to be an acceptable incident-management strategy.
Software vendors also have access to the same tools. If they can spread their domain knowledge, regulatory change, integrations, testing and operations across 50 banks while using the same Agentic Engineering techniques, buying can remain economically attractive. Agentic AI does not make build, buy or consume obsolete. It changes the numbers underneath the decision.
Perhaps it also raises the bar for vendors. If the main reason I bought your software was that writing that amount of code myself would have been difficult and expensive, you may have a problem. If what I am really buying is accumulated domain knowledge, continuous regulatory adaptation, network effects, ecosystem connectivity, resilience and shared economics, the argument looks rather different.
Maybe this is the foundations for the second edition of my book Rip Out the Core!
Operations are becoming agentic as well, but usually inside boundaries
DBS provides one of the clearest examples of what Agentic Operations looks like in practice. Its corporate-banking system uses specialised agents to perform more than 70 tasks around preparing credit analysis, with the intention of freeing bankers and risk managers to focus more time on judgement, client engagement and risk. DBS describes the design explicitly as augmenting human expertise rather than removing it.
Its customer-facing work is moving in a similar direction, although still inside a controlled environment. DBS said in July that its GenAI-enabled assistants were available to more than 10 million customers across Singapore, Hong Kong and Taiwan. Its corporate assistant, Joy, has moved from explaining how to complete tasks towards fulfilling selected requests in the conversation itself. Importantly, DBS says these agentic functions are activated only after customers have logged into its banking channels and that the AI acts on instructions initiated by authenticated customers.
I think that last part tells us something important about the immediate direction.
A lot of credible banking deployments are not giving a general-purpose model free access to accounts and hoping for the best. They are defining a job, exposing selected tools, controlling data access, constraining the action space and retaining deterministic controls or humans around consequential decisions.
That may sound less revolutionary than the idea of an autonomous digital workforce.
It is also a much more plausible way of getting through a bank’s risk process.
The customer layer is where the story gets much harder
The part I originally wanted to understand was the customer side, because that is where Agentic AI starts colliding with the themes of embedded finance and multihoming that I have been writing about for some time.
Imagine I have €25,000 sitting in cash.
Today, if I want to optimise it, I probably have to look at a few banks, compare savings rates, understand the conditions, open something, transfer the money and remember to look again when the attractive rate disappears.
Now imagine I tell an agent:
“Keep €5,000 immediately available. I don’t want investment risk. Make sure the rest earns a competitive return and keep checking it”
That instruction is much closer to the problem I actually want solved.
I did not ask for a savings account.
I asked for an outcome.
If the agent can understand that outcome, compare my existing providers with alternatives and eventually execute within boundaries I have agreed, something important changes in the banking relationship. The bank may still provide the account, hold the deposit and do all the regulated work underneath, but it may no longer own the moment in which I decide which institution gets the money.
That is why I think the relationship with multihoming is important.
Banking is already fragmented. A customer can keep the mortgage at one bank, have salary paid there as well, use Revolut or another fintech for day-to-day spending and travel, invest somewhere else and buy insurance from somebody entirely different. The problem for the consumer is that managing all of those relationships takes effort.
A capable agent could remove a lot of that cognitive cost.
McKinsey has modelled one version of the resulting economic threat. Its banking analysis estimates that if agents made it easy enough for customers to shift just 5% to 10% of checking-account balances towards higher-yield alternatives, banking profit from deposits could fall by more than 20%. That is a scenario model, not something currently happening at that scale, but it demonstrates why the economics get interesting long before customers formally “switch bank”.
There is also a potentially important change in how products compete. Today, inertia has economic value. Customers do not continuously compare every bank account, credit card, insurance policy and savings rate because the time required is greater than the likely benefit. Agents can alter that equation because comparison becomes cheap and potentially continuous.
Accenture’s general consumer research gives us an early indication of what that could mean outside banking. In a 2026 survey of 25,590 consumers across 16 countries, 61% said they wanted an agent able to shop across multiple grocery stores and 71% wanted one capable of assembling a trip across airlines, hotels and activities. Accenture’s interpretation is that the “decision layer” moves upstream, and brands increasingly need either to own the agent relationship or become attractive enough to be selected by somebody else’s agent. It is consumer-commerce research rather than evidence that banking will behave identically, but the mechanism is highly relevant.
That is also why I would be careful with the increasingly common claim that the bank app is going to die.
I can absolutely imagine the app losing its monopoly on customer intent.
That is not the same thing as the app disappearing.
For the next few years, the most natural place for many banking agents may actually be inside existing bank channels. NatWest is already doing this. 25,000 customers were due to receive access to an agentic financial assistant within Cora, initially allowing them to interrogate recent spending in natural language. DBS is evolving Joy and digibot in the same direction.
So I expect the transition to be additive before it becomes substitutive. Mobile banking, web banking, contact centres, human advice and perhaps physical service will coexist with agents for quite some time. Different customers, products and moments will move at different speeds.
The strategic change comes when the customer’s preferred agent no longer belongs to the bank.
At that point, the bank needs to be good at serving intent without necessarily owning the interface through which that intent arrived. For anyone who has spent time thinking about embedded finance, that should sound quite familiar. Embedded finance already demonstrated that the regulated financial capability can sit underneath somebody else’s experience.
Agentic banking takes that one step further because the intermediary will dynamically select which financial provider to use.
That makes today’s idea of the “primary bank” increasingly awkward. The agent does not necessarily care which institution the customer calls primary. It can care about price, risk, service, yield, customer preferences, execution quality and whatever other constraints it has been instructed to optimise.
But before we conclude that everybody is about to hand their financial life to an agent, the consumer data deserves a much closer look.
Consumers want help much faster than they want autonomy
McKinsey found that 23% of surveyed consumers were already using generative AI for financial tasks at least monthly. Among the use cases were understanding financial products, obtaining investment information and comparing alternatives. The same research found that 62% most trusted their primary bank to offer GenAI financial services, compared with 19% selecting a major technology company. At the same time, 57% said they would consider a third-party financial AI agent if their own bank did not offer one.
There is quite a lot packed into those numbers.
Customers are already using AI around money. Banks still appear to have a meaningful trust advantage. But that advantage is not necessarily enough to stop customers going elsewhere if the bank offers nothing useful.
Deloitte’s August study is an equally important counterweight to the autonomy story. It surveyed almost 2,600 US banking customers and found 83% would feel anxious about an AI agent taking action on their finances without approval, while 66% thought the risk of agent errors outweighed the benefits. Only 46% trusted the accuracy of banking recommendations from GenAI tools, compared with 79% who trusted information on banks’ own websites.
Accenture’s broader consumer study provides a useful way of thinking about the progression. Seventy-four per cent of consumers surveyed were prepared to let an agent execute specific routine tasks. Thirty-two per cent were willing to delegate a purchase decision within defined boundaries while retaining oversight before payment. Only 9% were open to fully autonomous purchasing. Accenture found payments to be an especially difficult threshold, with only 12% open to agents making purchase decisions autonomously at that stage of the journey.
Those surveys have different populations and ask different questions, so I would not put the percentages side by side and pretend they form a single adoption curve. But the pattern is intuitive.
Customers appear more willing to let AI remove work than to hand over control.
That suggests a progression from helping me understand something, to comparing alternatives, to recommending an action, to preparing it, to executing after I approve it and only eventually to acting independently inside boundaries I have established.
The technology can jump across several of those steps very quickly.
I am not convinced the customer will.
And finance may make that gap particularly important because the downside of a bad action is not always reversible.
Trust, authority and the parts the demos do not solve
The payment networks are already working on this, and some of the experiments are quite far along already.
On 2 July, BBVA and Visa announced that they had completed a live AI-agent-initiated transaction using real card credentials and the systems of an active merchant. The test used Visa Intelligent Commerce, tokenisation, real-time fraud monitoring and Visa Payment Passkeys to support Strong Customer Authentication. BBVA and Visa were explicit that the experiment maintained cardholder consent, issuer oversight and existing payment protections.
On 7 September, Revolut and Visa announced a similar controlled real-world transaction in France. Again, the significance is not that consumers are now routinely sending autonomous agents shopping with their entire bank balance. The significance is that an agent has participated in a real transaction through existing European merchant and card infrastructure while established authentication and control mechanisms remain around it.
Mastercard is attacking another part of the problem with Verifiable Intent, developed with Google. Instead of merely proving that a payment credential is valid, it aims to create a tamper-resistant record of what the user actually instructed the agent to do. Mastercard’s design links identity, the user’s instructions and the resulting action so merchants and issuers can distinguish legitimate delegated activity and retain evidence if something is disputed. It is also building explicit permissioning and spending limits into Agent Pay for Machines.
This is where I think one of the most important distinctions in Agentic Banking appears.
Identity is not authority.
Knowing that I am genuinely Pål Krogdahl does not tell a bank what I allowed my agent to do.
Imagine I tell the agent to “take care of the household bills and keep them below €3,000 per month”. There are several perfectly reasonable interpretations of that instruction. It might simply pay existing invoices. It might switch electricity supplier. Perhaps it can enter a 24-month contract to reduce the price. Perhaps it can move funds between accounts when the payment account is short. Maybe it can use a credit facility. It could potentially delegate part of the job to another specialist agent.
All of those actions might be consistent with the broad goal. They are absolutely not the same level of financial authority.
This is why delegated consent will need to become considerably richer than a binary answer to “is the customer authenticated?”. Scope, amount, counterparty, product type, duration, context, delegation rights, re-authentication thresholds and revocation all start to matter. Mastercard’s Verifiable Intent work is effectively tackling part of that problem at the payment layer by creating evidence of what the consumer authorised.
Europe is building useful pieces around it. The EU Digital Identity framework is intended to make an EU Digital Identity Wallet available by the end of 2026, which strengthens the infrastructure for portable identity and credentials. DORA has applied to financial institutions since January 2025 and establishes extensive requirements around ICT risk and operational resilience. The AI Act became broadly applicable on 2 August 2026, although some high-risk-system provisions have later application dates, and the AI Office and national authorities now have active enforcement powers over the provisions already in force.
PSD3 and the Payment Services Regulation are also relevant, but the timing is worth getting right. Parliament and Council reached a provisional political agreement in November 2025, and the agreed texts were approved in the European Parliament’s ECON committee on 5 May 2026. As of this article, they remain part of an ongoing legislative process rather than something I would describe as a fully implemented replacement for PSD2. The package strengthens fraud protection, transparency and the wider payments framework, but it was not designed as one neat answer to every question created by general-purpose AI agents.
That last point is important because I could not find a single European framework that neatly resolves the whole chain of a general-purpose consumer agent acting across several financial institutions with broad delegated financial authority. What we have are several relevant frameworks covering identity, payments, AI, data and operational resilience. That is useful, but it leaves some rather interesting questions at the intersections. This is an inference from the current regulatory landscape rather than a claim that the law offers no answers at all.
The liability question illustrates the problem.
An unauthorised fraudulent payment is a familiar category. An authenticated agent acting within permissions deliberately granted by the customer, but making an economically terrible decision, is something different. Perhaps the customer delegated too much. Perhaps the agent provider interpreted the instruction poorly. Perhaps the bank accepted an action it should have challenged. Perhaps the product-ranking mechanism had a commercial conflict. In some situations several parties may have contributed.
I am deliberately not offering a legal answer because I do not think there is one universal answer. What matters strategically is that authorised does not automatically mean good, and proof of intent does not by itself settle accountability for the quality of a financial decision. Mastercard’s own explanation of Verifiable Intent focuses heavily on creating evidence precisely because disputes in delegated transactions need something better than guesswork.
This is roughly how I would expect a serious banking architecture to evolve:
What I like about that architecture is that the agent can still be highly capable. It can interpret an ambiguous goal, explore alternatives, reason over complex information and propose something a conventional rules engine could never have discovered.
But capability and authority are separated.
BCG and SCBX describe almost exactly this idea in their September reference architecture for agentic banking. An AI core can reason and make proposals, while a deterministic boundary decides what is allowed, what gets committed, checks the result and records what happened. Their phrase that “the agent proposes but the system commits” may be one of the most useful ideas I found in the entire research exercise.
Security gets more serious when an answer becomes an action
NIST’s work on agent security focuses heavily on what it calls agent hijacking, also known as indirect prompt injection. The problem is relatively easy to describe. An agent is working for me but consumes information controlled by somebody else — an email, a website, a document or code repository. An attacker hides instructions in that material which the agent then interprets as something it should follow.
Once the agent has access to tools, an attack is no longer limited to producing a strange paragraph. Depending on the authority available to the agent, it could expose sensitive information, execute code or take some other unintended action. In a 2026 red-teaming exercise analysed by NIST’s Center for AI Standards and Innovation, more than 400 participants made over 250,000 attack attempts against 13 frontier models in agentic scenarios. At least one successful hijacking attack was found against every target model.
That does not mean every agent is insecure or that these systems cannot be deployed safely. NIST’s own point is that security testing has to evolve because the attack surface changes when models process adversarial external information and use tools.
Then there is the Hugging Face incident.
I would be careful about describing this as an AI deciding to become evil or “going rogue”, because that turns a useful security lesson into science fiction. This happened in the context of advanced cybersecurity evaluations, not because somebody’s personal assistant unexpectedly developed criminal ambitions.
The technical details are still sobering. Hugging Face’s July reconstruction says an agent escaped the intended OpenAI evaluation sandbox, reached external infrastructure and ultimately interacted with Hugging Face systems. Hugging Face estimated that reconstructing the intrusion involved at least 17,600 individual actions. The important lesson for banking is not that an agent became sentient, it is that a capable system pursuing an objective found routes through its environment that the people controlling the evaluation had not intended.
That is a much more mundane explanation.
It is also a much more relevant one.
A highly capable engineering agent with source-code access, cloud credentials and deployment rights creates a different risk profile from a coding assistant that can only suggest text. A financial agent that can recommend a transfer creates a different risk profile from one that can execute it. The European Banking Authority’s June 2026 risk assessment also points to the changing economics of vulnerability discovery as AI capabilities advance, while recognising that the same technologies can help banks defend themselves.
This is why my working principle has now become high autonomy in reasoning, bounded authority in execution.
It applies to customer agents.
It applies to operational agents.
And it absolutely applies to Agentic Engineering.
The more capable the agent becomes, the less comfortable I am with security models based on the assumption that it will always behave exactly as the workflow designer imagined.
The podcast Hardfork did a recent episode with an interesting update and deep dive into the Hugging Face attack that is worth checking out (sorry for the paywall on this one).
The consultancy forecasts are useful, but they are not evidence of adoption
This also changes the way I read some of the large predictions circulating around the industry.
I do not think it is fair to dismiss them merely because they come from organisations that also sell transformation services. BCG, Accenture, IBM and McKinsey are looking at real client activity, large surveys and genuine technology shifts.
But we should be precise about what their numbers actually mean.
Organisation
The headline claim
What the underlying evidence actually tells us
McKinsey
An AI agent could become the channel of choice for banking interactions within three to five years. A modelled 5–10% shift of checking balances to higher-yield alternatives could reduce banking profits from deposits by 20%+. Source
This is a strategic scenario, not an adoption forecast with a measured probability. Supporting survey evidence is real — 23% use GenAI for financial tasks at least monthly, and 57% would consider a third-party financial agent if their bank did not offer one — but that is not the same as granting autonomous transaction authority.
BCG / OpenAI
AI has the potential to increase bank profitability by 30% and cut costs by 30–40% by 2030. Source
BCG describes potential, not realised industry-wide results. The same work acknowledges fragmented pilots, reliability and accountability concerns and cautious compliance functions, and argues for supervised and auditable agents with humans retaining control.
Accenture
Scaled AI adoption could generate up to US$289bn in additional pre-tax profit across the top 200 global banks over three years; 57% of banking IT executives expect broad or fully embedded agent adoption in risk, compliance and fraud within three years. Source
The US$289bn figure is an economic opportunity model; the 57% figure is an executive expectation. Neither is evidence that those economics or deployment levels have already been achieved. Accenture’s own consumer research also shows the gap between willingness to delegate tasks and willingness to hand over autonomous payment authority.
IBM
In IBM’s 2026 banking outlook, 57% of surveyed executives said tokenisation of settlement rails would significantly strengthen agentic AI and enable autonomous transactions. Source
This tells us where executives believe infrastructure is heading. It is not a measure of consumer use or production-scale autonomous banking. IBM’s own Agentic Engineering work continues to emphasise engineering oversight rather than removing human accountability.
The distinction between potential, expectation, pilot result and observed market behaviour is important.
If executives say they expect agent adoption within three years, that is useful information about investment intentions. It is not proof that customers will trust those agents within three years.
If NatWest reports tenfold productivity in selected Agentic Engineering trials, that is genuinely interesting. It does not mean the whole technology organisation becomes ten times cheaper.
If McKinsey models what happens when agents make deposits extremely mobile, that is useful stress-testing of the existing banking model. It does not mean 10% of deposits are about to move.
I actually found more agreement among the consulting firms once I stopped concentrating on the largest numbers. Their more detailed work repeatedly comes back to some fairly unglamorous requirements such as good data, clear architecture, machine-readable interfaces, identity, permissioning, deterministic control, observability, auditability, human oversight and redesigned workflows. McKinsey’s engineering work stresses human gates and changes to the surrounding operating model. BCG puts deterministic controls around agent reasoning. IBM defines Agentic Engineering in terms of orchestration and oversight rather than abandoning engineering discipline.
Those investments remain useful even if the consultants are five years early about consumer autonomy.
There is another question I have seen discussed much less, and it deserves more attention. What happens when financial agents operate not simply at human scale but at machine scale?
McKinsey’s deposit scenario assumes agents can make balance optimisation easier. Mastercard is explicitly designing machine-payment systems for continuous, high-frequency transactions. It is therefore reasonable to ask whether widespread financial agents could eventually increase the speed of deposit movements, create correlated product switching or contribute to herding around market signals. That is an inference, not evidence that Agentic AI will cause a bank run or destabilise markets. But in a world where thousands or millions of agents can interpret the same rate differential or risk signal simultaneously, it seems worth researching the systemic behaviour as seriously as we research the productivity gains.
Humans have friction.
Agents are rather good at removing it.
Sometimes friction is inefficient. Sometimes it is also what slows a system down, and for good reason.
What I would advise banks to do now
After going through all of this, I have ended up somewhere rather less dramatic than most of the headlines.
I would not advise a bank to redesign its entire distribution strategy around the assumption that autonomous personal agents will become the dominant banking channel within three years.
I would also be equally uncomfortable advising it to wait until customers start asking. By then, some of the things the bank needs may take years to fix.
Do now. I would treat Agentic Engineering as a genuine strategic capability rather than another innovation-lab experiment. The evidence is already strong enough that banks should be learning how agents change software discovery, development, testing and modernisation. At the same time, I would keep improving the foundations that make every version of agentic banking easier. Clean APIs, reliable data, real-time capabilities, eventing, identity, granular permissioning, policy engines, complete audit evidence and observability. Those are not really “AI investments”, they are capabilities a modern bank should want anyway. McKinsey’s data on coding-agent scaling, NatWest’s reported deployment and IBM’s move towards Agentic Engineering all suggest this part of the shift is happening now.
I would also start redesigning engineering governance for human-agent teams. Today’s CI/CD platforms were largely created around human engineering workflows. If agents increasingly analyse, generate, test and remediate software, architecture rules need to become enforceable constraints rather than principles sitting in a PDF nobody has opened since 2023. The agent should know which data cannot leave a jurisdiction, which patterns are permitted, which dependencies are prohibited, what testing thresholds apply, which security controls are mandatory and exactly when human approval becomes non-negotiable. McKinsey’s work on end-to-end agentic delivery already describes the importance of structured machine-to-machine hand-offs and explicitly defined human gates.
Experiment now. On the operational and customer side, I would deliberately work up the autonomy ladder rather than trying to jump to the top. Let the agent retrieve information, compare alternatives, explain something and prepare an action. Then allow selected low-risk actions after explicit approval. From there, experiment with narrow delegated authority where the amount is limited, the mandate is clear and the outcome can be reversed. DBS’s authenticated agentic servicing and the BBVA/Visa transaction are useful examples because they increase what the agent can do without pretending the surrounding control environment has disappeared.
That experimentation should include third-party agents, not just agents the bank owns. A bank can easily become very good at placing AI inside its own mobile application while missing the bigger strategic question of what happens when the customer’s preferred agent belongs to someone else? McKinsey’s finding that 57% of surveyed consumers would consider a third-party financial agent if their bank did not provide one is not proof of future disintermediation, but it is enough to justify learning how an external authorised agent should discover products, understand terms, prove its mandate and interact safely with the bank.
Build progressively. The hard infrastructure around delegated authority probably needs more attention than another chatbot does. Banks need to start answering practical questions about how agent credentials differ from customer identity, how permissions are represented, how a mandate expires, whether sub-delegation is possible, how a customer sees all active mandates and how revocation propagates. Payment-network work such as Mastercard’s Verifiable Intent shows where part of the industry is heading, while the EU Digital Identity Wallet may provide useful identity and credential infrastructure. Neither removes the bank’s need to define its own authority model.
Products will also need to become more machine-readable. Deloitte explicitly recommends structuring rates, fees, disclosures and product information so AI systems can interpret them accurately, and that advice seems sensible regardless of whether the agent is owned by the bank or a third party. The competitive question gradually becomes not merely “can the customer find my savings product?” but “can the customer’s agent correctly understand it, compare it and determine whether it satisfies the mandate?”.
Protect deliberately. The bank needs a clear boundary between what an agent can reason about and what it is allowed to commit. That means least privilege, short-lived credentials, explicit transaction limits, deterministic policy checks, customer or human approval for defined classes of action, continuous monitoring, complete evidence and a practical way to freeze or revoke authority quickly. NIST’s red-team findings and the Hugging Face incident make the case for designing around the possibility that an agent may process hostile instructions or pursue an objective through a route its designers did not anticipate.
I would apply exactly the same thinking to Agentic Engineering. An engineering agent can be allowed to inspect an enormous estate, analyse code, generate a replacement and execute millions of tests without automatically receiving production credentials. High reasoning autonomy and constrained execution authority are not contradictions. They may be the architecture that allows banks to use highly capable agents safely.
And I would keep investing in existing channels.
The evidence simply does not justify declaring the mobile app dead. Customers still trust banks, still want control and remain cautious about autonomous financial action. Deloitte’s 83% anxiety figure is difficult to reconcile with an assumption that most consumers will happily hand broad financial authority to a third-party agent in the next couple of years.
But I would change the design assumption underneath those channels.
I would stop assuming that the bank will always own the interface.
That is a subtle change, but I think it is the strategically important one. A bank should continue building an excellent app while making sure the underlying bank also works when the customer arrives through somebody else’s agent.
Where I have now landed
I started this analysis expecting to conclude that Agentic AI was important but that the industry had allowed the story to run somewhat ahead of reality.
I still think that is true.
But the research changed my view in one important way. I had underestimated how uneven the transformation is.
Agentic Engineering is much more tangible than I expected and may materially change how banks build and modernise themselves over the next few years. Agentic Operations is already moving into real workflows, although generally with far more boundaries and human involvement than the word “autonomous” implies.
Customer-facing Agentic Banking could eventually be the most disruptive of the three because it reaches into distribution, customer context, product selection and the economic meaning of the banking relationship itself.
It is also the least settled.
The technology is moving quickly. Consumers appear to be moving more cautiously. The payment networks are building mechanisms for agent identity, permissions and evidence of intent. Regulators already have relevant frameworks around payments, AI and operational resilience, but the complete accountability model for broadly delegated financial agents is still emerging. Security researchers are demonstrating that capable tool-using agents create attack surfaces we do not get with conventional conversational AI.
So I do not see a reason for a bank board to panic because somebody has told them that their mobile app will be irrelevant in three years.
I do see a reason to make sure that, three years from now, the bank can operate in a world where some customers, employees, developers and counterparties increasingly arrive through agents.
That means learning now rather than predicting perfectly.
Keep serving the humans using the bank today. Start changing the engineering model where the evidence is already compelling. Put agents into bounded operational processes and learn from what happens. Experiment with customer autonomy gradually rather than assuming people want a digital power of attorney because the technology can provide one. Make products and services understandable by machines as well as humans. Build delegated authority and deterministic control before broad autonomy makes them urgent.
And perhaps most importantly, do not confuse the speed of model development with the speed of banking adoption.
The technology is racing ahead.
Trust, accountability and customer behaviour move differently.
The future of banking probably will become increasingly agentic. I am much less convinced that this means it becomes fully autonomous.
And for banks deciding what to do today, that difference matters.
Key sources and methodology
The sources below are the principal materials I used for this analysis. I have deliberately prioritised primary publications from banks, payment networks, regulators, standards bodies and the consulting organisations whose forecasts are discussed. Where a figure represents a consultancy model, executive expectation, survey result or a bank’s self-reported productivity improvement, I have treated it as such rather than presenting it as an independently established industry outcome.
