AI agents are entering bank operations through the back office — procurement has to catch up

Opinion · Finlane Editorial · Bank Radar

Two UK banks put AI agents into production this week, and neither of them is a chatbot. Starling has an agent that works a transaction-monitoring alert, writes up the audit trail and reaches a decision in 17 seconds. LHV Bank now answers routine customer emails with a Gradient Labs agent and sends anything sensitive to a person. In the same week, Amex was fined $350m after about $13bn of suspected laundering slipped through its monitoring over more than a decade.

Put those three side by side and the picture is clear. AI agents are coming into banks through the back office, in fincrime, servicing and casework, not through shiny customer products. The banks that get the most out of them will buy agents the way they'd buy any regulated process, not switch them on like a software feature.

Why the back office goes first

Agents are good at work that's high-volume, has a known procedure and a clear end state, and can be checked afterwards. An alert investigation fits that. So does a lost-card email. Look at how both banks set it up and you'll see the same design: a narrow job, hard-coded guardrails around the model, an escalation path to humans, and every change signed off before release. LHV spells this out in detail. Starling goes a step further by running the agent inside its own core, so it sees the full transaction history without waiting on an integration.

The pressure comes from the other side, too. Supervisors are punishing monitoring that can't keep up with volume. Amex is the latest example, and the size of that fine will be in a lot of board packs. An agent that clears alerts in seconds and documents every step speaks directly to that problem.

The case against

Starling built this on a core it owns. Most banks don't have that luxury. If your monitoring, case management and core data live in three vendors' systems, an agent will be working on partial information, and that's a liability, not a control. Then there's the examiner. A decision made in 17 seconds still has to be explained months later, and no supervisor has said yet what good looks like for AML decisions made by an agent. Early movers carry that risk. It's real, and we wouldn't wave it away.

What it means for your bank

• Pick the boring processes first. Alert triage, servicing emails and document checks have clear procedures and outcomes you can measure. Credit decisions and advice don't, yet.
• Put the guardrails in the contract. Ask vendors to document the agent's scope, the data it can reach, the escalation rules, how changes get signed off and what gets logged. LHV's published controls are a good starting checklist.
• Sort out data access before you buy. If your systems can't be queried together, the agent inherits every gap.
• Don't treat monitoring as an IT project. After this week's Amex penalty, it's a licence question. Agents can add capacity, but only on top of sound rules and clean data.
• Keep a named owner for every decision. Someone has to be able to explain each one to a supervisor.

What we're watching

• Whether UK or EU supervisors set out expectations for agent-made financial-crime decisions in the next 6–12 months.
• Starling's Nvidia-built transaction model, due in early 2027, and whether it publishes any fraud results.
• More banks naming agent vendors for servicing and fincrime, rather than announcing another AI pilot.

If you're scoping this, you can compare AML, fraud and RegTech providers on Finlane.

Sources: Finextra · Finextra · Fintech Brainfood