AI in banking operations: what an agent may change, and what not

AI in banking operations means using AI to do the work behind a bank's services: reading requests and documents, checking them against rules and agreements, drafting replies and changes, routing work and keeping the evidence. The newer form, agentic AI, does more than answer; it takes steps. That raises the question every operations and risk leader now asks: what may an agent actually change? The answer this guide argues for, using a treasury maintenance desk as the worked case, is that agents should read, check, cite and draft, and people should verify identity, decide, make the change and approve it. The rules support that line even though no rule yet addresses agents directly: the April 2026 interagency model risk guidance expressly leaves generative and agentic AI out of its scope, while the rules for the change itself apply whoever does the work. Botminds' Treasury Management Client Services is built on that line: seven agents check every maintenance request, and two named people make and approve every change.

The screens show the solution on a fictional credit union's sample data. The guidance and reports are linked to the agencies that issued them.

AI in banking operations, where it is actually used

The near-term uses banks describe are reading and checking, not deciding. When the Treasury Department summarized 103 responses to its request for information on AI in financial services, it reported that "Respondents noted near-term use cases of Generative AI in risk identification and assessment, code assistance, document querying and extraction, and financial crime/AML" (U.S. Treasury, Uses, Opportunities, and Risks of Artificial Intelligence in Financial Services, December 2024). Those are the respondents' views, not Treasury's findings, but they match what operations leaders say: the first value is in the reading.

Operations is full of reading. A treasury maintenance request needs the request itself, the corporate resolution, the cash management agreement, the entitlements and limits on file and the contacts the bank may call; by hand, finding and reading them takes longer than the decision they inform. On Botminds' own estimate for one request, reading and checking fall from more than an hour and a half by hand to a few minutes with agents, while the callback, which needs a person and a client, still takes most of an hour.

Agentic AI in banking operations: what changes when the AI acts

Agentic AI differs from a chatbot in one way that matters to a risk committee: it can take actions in other systems. An agent that can read the digital banking administration screen can, technically, be given the right to write to it. Everything in this guide follows from refusing that right for changes that decide who may move money.

The reason is not that agents are inaccurate; it is that the decision needs accountability and, in this work, a phone call. A maintenance change is verified by calling the client on a number held before the request and hearing them agree to the exact change. An agent can prepare that call; it cannot be the person the client hears, and it should not be the one who decides what the answer means. The design rule in the solution is stated on the request desk itself: "Agents read, check and cite. They never make a change and never decide."

Does model risk guidance cover agentic AI?

No. The revised interagency model risk guidance issued on April 17, 2026 by the Federal Reserve, the OCC and the FDIC excludes it in plain terms, and it replaces the guidance most model risk teams grew up on, the 2011 letter SR 11-7 (SR 26-2). The agencies call generative and agentic AI too new and too fast-moving for the guidance, and leave both outside its scope (OCC Bulletin 2026-13); the exact wording, and what it means for a model inventory, is set out in is a customer risk rating a model.

Instead the agencies promised a request for information on model risk management that would look in particular at banks' use of AI, generative and agentic included (OCC Bulletin 2026-13). No such request from the three agencies had appeared in the Federal Register by late October 2026. The guidance also describes itself as setting no enforceable standards or prescriptive requirements, and as aimed chiefly at banks with more than $30 billion in assets.

A gap in guidance is not permission. It means the bank's own risk management decides, and that the safest design is one an examiner can assess with the rules that already exist. An agent confined to reading, checking and drafting, whose every finding cites its source and whose every output is reviewed by a person before anything changes, can be assessed that way.

What has not changed: the rules for the change itself

The rules that govern a maintenance change do not care who did the work. The FFIEC's 2021 authentication guidance still expects enhanced authentication for account maintenance; Article 4A still asks whether a bank's security procedure was commercially reasonable and followed; the Nacha Rules still require an exposure limit for every originator; the interagency third-party guidance still leaves responsibility with the bank that buys the software. An agent-assisted desk must meet every one of them, and the evidence must show it did.

That is the practical reason for the line between agent and person. Each of those rules is ultimately satisfied by a person's act: placing the callback, deciding a request is genuine, approving the change. Keeping those acts with people, and keeping the agents' findings as cited evidence for them, lets a bank answer an examiner with the same file it would have produced by hand, only complete.

Can AI change a customer's entitlements?

Technically it can, if given write access; in a well-designed operation it should not. In Treasury Management Client Services the change drafter prepares the exact entitlement change, with before and after values beside the reason it is allowed, and stops. A specialist submits it with a reason code, and it takes effect only when a second specialist approves it.

The decision is a person's, with a reason code the agents proposed and she can change

Can AI verify a caller's identity?

Not as the control a maintenance change relies on, and generative AI is the reason. FinCEN reported that "Beginning in 2023 and continuing in 2024, FinCEN has observed an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media in fraud schemes targeting their institutions and customers" (FinCEN Alert FIN-2024-Alert004). A voice, live or synthetic, is weak evidence; a call the bank places to a number it held before the request is stronger, because the fraudster has to control that line as well.

In the sample setup the callback agent's job is narrow: choose the contact on file, refuse any number from the request, and write the script, including an exact read-back of the change. The specialist makes the call and records the answer in the client's words. Why the channel, not the voice, carries the proof covers this in depth.

Who is accountable for an AI-made change?

In this design there is no AI-made change to be accountable for: every change carries the names of the person who made it and the person who approved it, and every refusal the name of a supervisor. Accountability for the agents is different and also explicit. Each agent carries its version, its mode, its confidence threshold and its limits; a finding below the threshold goes to a person; every time a person overrides an agent's finding the override is recorded with a reason code; and every action, by a person or an agent, is written as it happens to a trail sealed daily and kept five years.

That separation answers the question examiners ask about any automation: if this goes wrong, who decided? The trail shows the agent's finding and the evidence it cited, and the person who decided anyway, and why. The maker and checker rule on entitlement changes is the human half of the same design.

Hallucination, and why every finding links to its source

Generative models can produce fluent, wrong answers, and banks know it. GAO reported that, according to one large bank, "hallucinations are a key reason banks avoid using generative AI for activities that warrant a high degree of accuracy, such as credit underwriting or risk management" (GAO-25-107197, May 2025). Verification of payment rights warrants that degree of accuracy.

The defence is structural, not a promise of accuracy. Every finding in the solution opens the clause, message header, registration record, callback or limit it relied on, so the specialist checks the source, not the agent's summary of it. A finding with no source is not a finding. On the sample request the channel check's "broken" opened §7.2 of the client's own agreement with the deciding phrase highlighted; a reader could disagree with the agent in one click.

A finding opens the clause it relied on: the specialist reads the source, not a summary

How to use AI in banking operations: questions before buying

Ask questions that test the line between agent and person, and ask them on your own material. The checklist below works for any agent product in operations, not only treasury.

For the wider buying picture, including what client services software connects to and how it goes live, see treasury management software for banks. To see agents check a live request while people decide, start from Treasury Management Client Services.

Questions people ask

What are the main AI use cases in banking operations?

Reading and extracting from documents, checking requests against rules and agreements, drafting replies and changes, triaging queues, and assembling evidence. Treasury's 2024 report on AI in financial services lists document querying and extraction among the near-term generative AI uses respondents named.

Is agentic AI regulated in banking?

Not by AI-specific guidance yet: the April 2026 model risk guidance leaves generative and agentic AI out of scope, and the agencies' planned request for information had not been published by late October 2026. The rules for the underlying work, from authentication guidance to Article 4A and the Nacha Rules, apply in full.

Can AI replace operations staff in a bank?

In verification work it changes the job rather than removing it. The reading and checking shrink; the call, the decision and the second approval remain, and become the job.

Does an AI agent need model validation?

The revised guidance does not require it for generative or agentic AI, because those are outside its scope. Banks still apply their own risk management; keeping agents to cited findings that people review makes their output testable without treating them as decision models.

What is the biggest risk of AI in banking operations?

Letting an agent act where a person's verification is the control: creating users, raising limits or confirming identity. Fluent output that is wrong, and impersonation using generated voices and documents, both bite hardest there.