Agentic AI in banking operations: six agents, one person who releases

Agentic AI in banking operations means software that is given a task rather than a form to fill in: it reads the documents, decides which checks apply, runs them in an order it chooses, and produces a result with the evidence behind it. On a commercial funding desk that is a real change, because the work was never a workflow — it was a person opening five systems in whatever order the request demanded. It is also where the category earns its scepticism, because the same desk is where money irreversibly leaves a bank. Botminds' Drawdown & Payoff Request Processing is built on the position that the interesting part of an agent's specification is its prohibitions: six agents read and check every draw and payoff request, and not one of them may release a payment.

What follows is that desk in detail, on the solution's sample data, with fictional banks, borrowers and payees. The supervisory and standards material is linked where it appears; none of it is about this product, and all of it is about the questions a risk officer will ask.

What are agentic AI systems in banking operations, and what are they not?

Three things are being described with the same words, and a bank that does not separate them will govern the wrong one. A model is a thing that produces an output from inputs — a score, a classification, an extracted value. An assistant answers a person's question and leaves the person to act. An agent is given an objective, chooses its own steps, uses tools, and produces something the business acts on. The governance question moves with the definition: for a model it is accuracy, for an assistant it is what the person does next, and for an agent it is what the agent is permitted to touch.

The standards vocabulary for this is better than the marketing vocabulary. NIST's AI Risk Management Framework describes the range plainly: arrangements between people and AI run from fully autonomous to fully manual, and a system may decide on its own, hand the decision to a human expert, or serve a human decision maker as a second opinion. Those are three different products with three different risk profiles, and the word "agentic" does not tell you which one you are being shown.

In banking operations the honest answer for anything touching money is the middle one: the agent decides what it can decide and defers the rest, and what it may not decide is written down in advance rather than inferred from behaviour. An agent whose boundary is "it has not done that yet" has no boundary.

Six agents, one request: the division of labour on a funding desk

A borrower's request to draw on a revolver or pay a loan off arrives by email, fax or portal, and must be matched to a facility, tested against a signed agreement, checked against balances and certificates, checked against the signer file, and checked against the verified payee file before anything moves. Six agents divide that, and each one ends where its evidence ends.

The division into six is not an implementation detail. A single agent asked to "process the request" has a single failure mode that is impossible to characterise, and nothing to show a reviewer except its conclusion. Six agents, each ending at its own evidence, mean that when the availability figure is wrong the conversation is about one certificate, not about artificial intelligence.

Can AI release a wire? No, and the reason is not technical

Nothing about building software that sends a Fedwire message is hard; banks have had straight-through processing for decades. The reason an agent does not release is that a release is where a bank's controls are designed to require a person, and removing the person removes the control rather than automating it.

Three of those controls are explicit in supervisory material. Dual control over customer transactions and monetary instruments is on the OCC's list of preventive controls. The FDIC's examination module asks whether appropriate separation exists between preparing documents, posting records and disbursing proceeds. And the same module asks the examiner to "review management's procedures to prevent, detect, and respond to lending policy exceptions" and to determine whether deviations "are properly approved and documented". Each of those is a statement that a named person is accountable at a particular moment. An agent cannot be that person, not because it is unreliable but because accountability is not a capability.

NIST's framework asks for the same thing in its own terms: processes for human oversight that are defined, assessed and documented in line with the organisation's policies (NIST AI RMF 1.0, MAP 3.5). Note the verbs. Defined, assessed, documented — in advance, as policy. Oversight that consists of a person being able to intervene is not oversight; it is an opportunity to intervene, and on a desk with forty minutes left before a cut-off it will not be taken. Oversight that consists of the button not working until a named person acts is a process, and it can be described to an examiner in one sentence.

The limits, written down before the agent runs

The capability list of an agentic system is the part that sells it and the part that ages worst. The prohibition list is what a risk officer will ask for, what a vendor can be held to, and what makes the system reviewable. Here is the whole of it for this desk, agent by agent.

Two of those prohibitions do more work than the rest. "Never edits the payee file" closes the attack that defeats every comparison at once: change the record rather than the instruction. "Never fills a missing field" closes the quieter one, in which a confident reader supplies a plausible value and the whole chain of checks is run against something nobody was told.

Effective challenge, applied to software that reads clauses

Banks already have a discipline for software that produces answers people act on, and it predates this category by fifteen years. The model risk guidance the agencies first issued in 2011, and replaced on 17 April 2026 with SR 26-2, puts effective challenge at its centre: critical, objective analysis by people with the expertise to find a model's limits, enough independence to stay objective, and the standing to get changes made (revised guidance). SR 26-2 places generative and agentic AI outside its own scope and leaves their controls to the bank's governance, so applying the same discipline to agents is a choice — the right one.

Applied to an agent that reads credit agreements, that means three specific things. Someone with no stake in the project has to look at a sample of results against the underlying documents — not the summary, the clause. That person must be competent to disagree, which on this desk means a funding specialist or an operations manager rather than a technology reviewer. And they need influence, meaning a route by which "this is reading the notice clause wrong on amended facilities" becomes a change rather than a comment.

The incentives line is the one most banks get wrong. The people best placed to challenge an agent's reading of an agreement are the people whose afternoon it just made shorter, and they will not volunteer failures if the project's success is measured by adoption. Make finding errors the job of a named person for the first quarter, and count what they find as evidence the programme is working.

Where human oversight is defined, and by whom

Oversight is a design decision, and it should be made once, in writing, by a named owner — not discovered per request by whoever is on duty. Four questions settle it, and they are worth answering on paper before any agent is switched on.

What the second person sees before saying yes

This screen is the whole oversight argument in one picture: the agents produced the evidence, and the decision is still a person's, made with that evidence in front of them.

What the supervisors have actually said about AI in banks

Less than the marketing suggests and more than the sceptics assume, and almost all of it is about governance rather than permission. The Treasury's report on its 2024 request for information records where the use actually is: respondents described financial firms using AI, and experimenting with generative AI in particular, mostly for internal operations — risk management, compliance, treasury management, fraud detection and the back office.

The OCC's most recent risk perspective is in the same register, noting that "banks of all sizes are exploring ways to leverage artificial intelligence", that generative uses have "largely been internal facing", and that "while the opportunities of AI are broad, appropriate governance and risk management are essential to mitigate potential risks when implementing AI systems" (OCC, Semiannual Risk Perspective, Fall 2025).

Two practical readings follow. First, internal operations is the acknowledged centre of gravity, which is the opposite of the assumption that the regulated frontier is customer-facing; a funding desk is squarely inside what supervisors already expect to see. Second, nothing in this material offers an exemption from the controls that already apply to the activity. The OCC's fraud principles ask for "system controls designed to prevent employees, agents, third parties, and others from conducting fraudulent transactions, performing inappropriate manual overrides, or manipulating financial reporting" (OCC Bulletin 2019-37) — a sentence that reads differently, and more usefully, once some of the agents in question are software.

Measuring an agent: four numbers worth keeping

An agent that is only assessed by whether people like it will be assessed again every time something goes wrong. Four measures, captured from the first week, make the argument empirical. None of them is a productivity figure.

The first is extraction fidelity: on a sample of requests, how many extracted values match the document, checked by a person against the line the agent cited. The citation is what makes this cheap — a reviewer verifies a quotation rather than searching a PDF. The second is check correctness: of the requests held, how many should have been held, and of those released, how many should not. Both halves matter; a desk that only measures false holds will tune itself toward releasing.

The third is the override rate per check. A check overridden once a quarter is a healthy exception; a check overridden weekly is a rule that does not match the bank's agreements, and the right response is to change the rule, not to keep overriding it. The fourth is time to decision against your own cut-off — not average handling time, but the share of requests resolved with more than an hour in hand, because that is the number that falls first when something is quietly wrong.

Twelve requests, nine checks each, one clock

Does AI replace loan operations staff? What the desk does with the hours

On this desk the honest answer is that it replaces about forty-six of the fifty minutes a request takes by hand, on the solution's own estimate, and none of the responsibility. Reading a request, matching it to a facility, testing it against a clause, computing availability and comparing an instruction against a file are all mechanical, and all of them were being done by people who were also the only people who could decide anything.

What the recovered hours are spent on decides whether the change is worth making. Three uses are visible on the sample desk. The exceptions become the whole queue rather than a layer beneath it, so the request that would have been reached at 3:40 p.m. is reached at noon. The telephone calls get made, because the one part of the control that cannot be done by comparison now has time in the afternoon. And the rules get maintained — someone finally reads the notice defaults against the agreements and finds the three facilities where an amendment changed the clause and nobody updated anything.

The seat that disappears is the one that only typed. The seat that grows is the one that decides, and it grows in value because its judgement is now applied to every request rather than to the ones its occupant had time to open. That is a different claim from efficiency, and it is the one worth making to a board: the desk is not cheaper per request so much as consistent across requests, which is what a control is supposed to be. What the job holds once that is true is worth reading before writing the next job posting.

Questions people ask

Can AI release a wire transfer?

It should not, and on this desk it cannot. The release button is locked while any check is open, and that setting cannot be switched off; the agents prepare the payment instruction and a named person releases it, with a second person approving above $1,000,000. The reason is control design rather than capability: dual control over customer transactions and separation between preparing, recording and disbursing are long-standing supervisory expectations, and software occupying both sides of a dual control defeats it.

How do you govern AI agents in a bank?

By governing the activity, not the technology. Write down what each agent may read, may write and may never do; define human oversight in advance and make it a property of the system rather than an opportunity; subject the agent to the same effective challenge as a model, by someone competent and independent with a route to force a change; version the rules it applies and name an approver for each change; and measure extraction fidelity, check correctness, override rates and time to decision from the first week.

How accurate is AI at reading a credit agreement?

Accurate enough to be useful and not accurate enough to be trusted silently, which is why the design question is what it does when unsure. The workable pattern is to cite: every extracted value carries the line it came from, so a person verifies a quotation in seconds instead of re-reading a hundred-page agreement. The failure to design against is a confident value with no source — and the prohibition that matters is never filling in a field the document does not state.

What model risk rules apply to AI agents?

Fewer than people assume, which puts more on the bank. SR 26-2, which replaced SR 11-7 on 17 April 2026, places generative and agentic AI outside its scope and says a bank's own risk management and governance should set the controls for tools it does not cover; it also excludes simple arithmetic and deterministic rules from its definition of a model. Its principles — effective challenge, validation, outcome monitoring, the same scrutiny for bought components — remain the sensible template for governing agents.

What should an AI agent never be allowed to do?

Four prohibitions cover most of the risk on an operations desk: never move money; never edit the record it checks against; never supply a value a document does not contain; and never contact a counterparty on details taken from the request being checked. Each one closes a specific attack or failure, and all four can be verified by a reviewer in an afternoon, which is more than can be said for most capability claims.

Does an agent decide which checks to run?

It decides the order and which clause applies, not whether to check. The nine checks are fixed for every request of a given kind; what the agent works out is which facility and which clause governs this one, because a notice period negotiated in an amendment beats any bank-wide default. A design in which an agent may conclude that a check is unnecessary is a design in which the control is advisory, and that is the first thing to ask any vendor in this category.