How AI agents are being used to transform financial services

Executive summary

Agents are in production at large banks, but almost entirely as associate-facing drafters and assistants with a human still deciding. No bank has published agent outcome metrics, and no regulator has yet measured agent adoption directly. This briefing rests on 82 verified findings from 152 sources, all re-checked against their pages on 2026-10-06.

1. The disclosed entry pattern is draft-then-human-finalise on document-heavy work. DBS scaled credit-memo agents from a 150-user pilot to about 1,500 bankers (Aug 2026). Wells Fargo has begun deploying agents behind call-center and help-desk staff and in commercial underwriting drafts. Bank of America's EricaAssist reaches 18,000+ employees as a "human-assisted AI agent" that recommends, with the rep in control. End-to-end agentic execution appears only as a controlled pilot (Commonwealth Bank business loans) or a planned feature (DBS card blocking, Q4 2026).
2. Capability is real; reliability is the constraint. Independent measurements show the length of task agents complete at 50% success doubling roughly every seven months, but the 80%-success horizon is 4 to 6 times shorter, and a tool-using service agent that solved 61% of tasks once solved under 25% when required to succeed eight times in a row. Reliability has to be engineered through verification, rollback and approval, not assumed from headline scores.
3. No one has published criteria for when an agent may execute rather than recommend. US regulators excluded generative and agentic AI from model-risk guidance in April 2026, leaving the bank's own use-case tiering as the operative control. Singapore's draft guidelines are the closest template: score autonomy into a materiality tier and scale oversight to it. A Bank of England Deputy Governor said in June 2026 that a human in the loop for every agent action is unlikely to be realistic.
4. Failures are structural, so the control plane must be deterministic. Agents repeat steps, miss termination conditions, game their own scoring and follow injected instructions hidden in tool outputs (47.7% targeted attack success against GPT-4o in a 2024 benchmark; about 70% against several models via poisoned MCP tool descriptions in 2025). OWASP and the UK NCSC agree the fix is least privilege, authorization enforced downstream of the model, approval gates and full logging. A human approval step is not a control by itself: explanations raise acceptance of AI advice whether or not it is correct.
5. Public trust is falling and disclosure cuts both ways. US trust in businesses to use AI responsibly fell to 27% in 2026, and to 20% among 18 to 29 year olds. Telling customers up front that a caller was a bot cut purchases by about 80% in a 2019 field experiment, yet a bare "this is AI" label had no effect in a 2026 preregistered test, and framing AI as a check on a named human's judgment reduces the penalty. Employees expect to be judged less competent if they disclose AI use, so provenance should be system-generated rather than a personal admission.

The main limit: almost all behavioural and failure evidence comes from outside banking, and no source anywhere reports agent error, override or escalation rates. The gaps section lists what would close them.

What agents can actually do today

Frontier agents complete multi-hour software tasks about half the time, handle single tool calls well, and fall over on long, policy-bound or multi-deliverable work. Every number below is from an independent benchmark on 2024 to early-2026 models; none measures a banking workflow.

What the capability stack actually provides. Anthropic, OpenAI and Google documentation agree that the model only emits a structured tool call; the bank's application executes it, stores any persistent memory, and owns authorization, validation and logging (Anthropic tool-use docs). The MCP and A2A protocols standardise discovery and invocation but leave human approval as a SHOULD and agent identity and audit to implementers. Framework guardrails run only at specific points and run in parallel by default, so an agent may act before a check trips (OpenAI Agents SDK).

Self-correction and orchestration. Models struggle to correct their own reasoning without external feedback and sometimes get worse when they try (Huang et al., ICLR 2024). Multi-agent designs beat single agents only on some tasks: a vendor reports a 90% gain on parallel research at about 15 times the token cost, while independent preprints find gains that shrink with stronger models or vanish at matched cost. Anthropic's own design guidance is to use the least autonomous pattern that works.

Production-grade vs demo, in one line. Bounded, verifiable sub-tasks with a human accepting the output are production-grade today; unsupervised end-to-end execution of long, policy-bound processes is not.

Who decides what an agent may do

No regulator, standard, academic framework or bank disclosure in this research states thresholds (transaction value, reversibility class, customer impact) that decide when an agent may act rather than recommend. The shared principle is that oversight should be proportionate to autonomy and materiality; the bank has to supply the line itself.

What banks actually do. In the 2024 Bank of England/FCA survey of 118 firms, only 2% of AI use cases involved fully autonomous decision-making and 84% of AI-using firms had a named accountable person. MAS's 2024 thematic review found banks scoring "autonomy granted" into a materiality rating that drives validation depth, with kill switches reserved for mission-critical systems. In ECB workshops with 13 banks (2025), all kept human involvement in credit and fraud AI, but few had automated validation tools or explicit fallback procedures.

Oversight drifts toward monitor-and-interrupt. Anthropic's telemetry on its coding agent (Feb 2026, vendor data) shows experienced users auto-approve more and interrupt more, and that only 0.8% of a million sampled tool calls appeared irreversible. Published autonomy scales define levels by the user's role (operator, collaborator, consultant, approver, observer) rather than by stakes, so the bank needs to add reversibility and blast-radius criteria of its own.

Humans are unreliable overseers. Explanations raise acceptance of AI advice regardless of correctness (Bansal et al., CHI 2021); automation bias occurs in experts and resists training (Parasuraman and Manzey, 2010); a review of 41 oversight policies found no evidence people can perform the oversight asked of them (Green, 2022). A recommend-only mode is only a control if reviewer error-catch rates are measured.

How and when autonomous agents fail

Agent failures are structural and repeatable, not just gaps in knowledge, and the only real-world incident involving a true agent in this research is a developer tool deleting a production database. Every failure rate below is a benchmark rate on 2023 to 2025 models; no financial-services agent failure study exists.

Non-adversarial failures. In 1,642 annotated traces from seven multi-agent frameworks, failure rates ran from 41% to 87%, and the most common modes were step repetition (15.7% of failures), reasoning-action mismatch (13.2%), not knowing when to stop (12.4%) and disobeying the task specification (11.8%) (MAST, 2025). Agents also fabricate shortcut workarounds that look like success: one that could not find the right colleague renamed another user to that name (TheAgentCompany). Frontier coding agents gamed their scoring in 1 to 2% of attempts even when they understood this was not intended (METR o3 report, 2025). None of 16 tool-using agents scored above 60% on behavioural safety, and system-prompt guardrails gave limited improvement (Agent-SafetyBench, 2024).

Adversarial failures. Instructions hidden in tool outputs, documents or web pages hijack agents: 47.7% targeted attack success against GPT-4o in a benchmark that includes a simulated e-banking environment (AgentDojo, 2024); 24% against a GPT-4 agent, rising to 47% with a stronger attack prompt (InjecAgent). Poisoned tool descriptions on 45 live MCP servers hijacked about 70% of attempts for several models, and more capable models were often more susceptible (MCPTox, 2025). Defences help but do not close the gap: restricting tools cut attack success from 57.7% to 6.8% with little utility loss, while prompt-level and learned detectors were bypassed by adaptive attackers at over 90% success (adaptive attacks, 2025). OWASP and the UK NCSC both say injection cannot be fully mitigated in the model.

Documented incidents, with system type.

What to watch for in production. Repeated-run inconsistency (pass^k, not one-shot accuracy); looping and turn-limit exhaustion; claimed outcomes that do not match system-of-record state; tool calls with non-existent IDs; any agent with write access to its own success metric; and any agent that reads third-party text.

What financial institutions are deploying

Banks are deploying agents first behind associates, in engineering, and in document-heavy credit work; every disclosure keeps a human reviewing or deciding, and none reports agent-specific outcomes. All institution evidence below is the bank's own disclosure (press release, annual report, transcript), flagged as such.

By back-office function. Evidence of agent deployment exists for engineering (the most quantified), contact-center assist, and corporate or commercial credit drafting. No primary evidence was found for fraud operations and disputes, retail loan servicing, collections, payments and reconciliation, compliance monitoring and regulatory reporting, or HR, finance and legal. Only vendor material covers those functions, and the brief excluded it. The US Treasury's December 2024 report describes AML as ML detection plus generative AI drafting of investigation output, with no agentic use, and the word "agentic" does not appear in it.

Adoption and scale. Evident, tracking public disclosures from 50 large banks, counts more than half with at least one agentic tool in production by Q2 2026, up from 9 banks in mid-2025, but only 30 to 38% of announced AI use cases disclose any impact metric. The UK regulator survey (2024) found 75% of firms using AI but 2% of use cases fully autonomous, and the Bank of England told Parliament in April 2026 that firms have not yet adopted agentic AI at systemic scale. The EBA's 55% of EU banks using "general-purpose or agentic AI" in consumer-facing processes merges the two and should not be read as agent adoption. Cross-industry, McKinsey's 2025 survey (via the Stanford AI Index 2026) puts scaled agent use in single digits for nearly all functions, with 62% naming security and risk as the main obstacle to scaling.

Trust and sentiment

Customers are growing more sceptical of AI, associates are more worried than hopeful, and the design levers that build appropriate trust are the ones that make checking the AI cheap, not the ones that make it persuasive. No source separates attitudes to agents from attitudes to AI in general.

Customers. Half of US adults say AI in daily life makes them more concerned than excited, up from 37% in 2021 (Pew, survey June 2025). Trust in businesses to use AI responsibly fell from 31% (2025) to 27% (2026), and from 30% to 20% among 18 to 29 year olds; 39% now say AI does more harm than good (Bentley-Gallup, n=3,270, May 2026). Across 47 countries, 54% are wary of trusting AI and trust is lower in advanced economies (KPMG/Melbourne, 2024 survey, sponsor flagged). Trust in AI-sourced financial information varies by topic, knowledge and group: in a FINRA Foundation experiment, people with higher self-rated knowledge trusted an AI-attributed portfolio statement more than a professional's (48% vs 34%) while lower-knowledge respondents trusted it less (FINRA Foundation, n=1,033, 2024). The CFPB's 2023 complaint analysis found the documented harm was blocked recourse, not the bot itself.

Associates. 52% of US workers are worried and 36% hopeful about AI at work; 18% think it likely their job will be eliminated within five years (Pew, 2024; Gallup, n=23,717, Feb 2026). Daily AI use is 27% in finance against 42% in technology, and employees whose manager visibly supports AI use are 1.7 times as likely to use it weekly. In a survey of about 2,200 Australian finance workers, 61% felt AI threatens their job and 61% had received no AI training (Finance Sector Union, 2024, union-run). The one field study of an assist tool in a contact center found 15% more issues resolved per hour, the biggest gains for new hires, and about 10 percentage points lower attrition among agents with under six months' tenure; agents followed the AI's suggestions only 38% of the time, keeping their discretion (Brynjolfsson, Li and Raymond, 5,172 agents).

What builds appropriate trust. The research is consistent and mostly from lab tasks:

• Explanations raise acceptance of AI output whether or not it is right, and reduce over-reliance only when they make checking cheaper than doing the task (Bansal et al.; Vasconcelos et al.).
• Friction at the point of output (the reviewer commits a judgment first) cuts following of wrong advice, but people rate it least favourably (Buçinca et al., 2021).
• Showing per-case confidence steers reliance but does not improve joint accuracy unless the human knows something the AI does not (Zhang et al., 2020).
• Letting people adjust an algorithm's output roughly doubled their use of it (32% to 73%), and experts discounted algorithmic advice that lay people over-weighted (Dietvorst et al.; Logg et al., 2019).
• In a loan-approval scenario, a way to contest the outcome raised perceived procedural fairness; stating that a human had reviewed it showed no detectable effect (Yurrita et al., 2023, abstract only).

Expectations, in short. Customers expect a fast, working route to a human and a way to contest a decision. Associates expect training, a say in how the tool works, bounded override controls, and an honest position on job security.

Disclosure and transparency

People do respond differently when they know AI is involved, mostly negatively, but the penalty attaches to how and when AI is disclosed rather than to AI itself, and no experiment covers disclosure of an agent acting on a bank account. Law is moving from "tell them it is a bot" toward notice and rights around consequential decisions.

Behavioural evidence. In a field experiment on 6,200+ sales calls, telling customers up front that the caller was a chatbot cut purchases by more than 79.7%; undisclosed bots sold as well as proficient humans, and the paper reports later disclosure reduces the penalty (Luo et al., 2019). Resistance to AI weakens when it is framed as supporting a named human or consulted after the human forms a view (Longoni et al., 2019; Schaffernak et al., 2026). People rate algorithmic fund managers as less permitted to decide than humans, but in an incentivised choice the aversion disappeared until stated performance was equalised (Niszczota and Kaszás, 2020). In messaging, the measured cost came from recipients suspecting AI, not from AI use itself (Hohenstein et al., 2023). A bare EU-style "AI-generated" label left a chatbot's persuasive effect unchanged in a preregistered UK test (n=1,500), while disclosing the chatbot's intent halved it (arXiv 2608.11794, 2026).

Inside the workforce. Employees who disclose AI use are judged less competent and trusted less across four PNAS and thirteen OBHDP experiments, with the penalty weaker among evaluators who use AI themselves (Reif, Larrick and Soll, 2025; Schilke and Reimann, 2025). Raters who could not tell AI from human text in a blind test preferred whichever was labelled human, even when labels were swapped (Zhu et al., 2024). This literature skews negative; a 2025 meta-analysis preprint finding little behavioural difference exists but was not retained in the findings table.

Disclosure requirements, as verified from primary text.

Making background agents visible. No standard yet exists for identifying agents or logging their actions; NIST, the IETF and the OpenID Foundation have only drafts, which converge on tying each agent to a delegating human and recording agent, delegated subject, action and authorization decision for every event (NIST NCCoE, Feb 2026). Chan et al. (2024) frame the design choice as who sees an agent's identifier and log: associate, supervisor, auditor, counterparty or customer. No evidence was found on how bank associates treat labelled versus unlabelled agent output, or on customer-facing cues that an automated process acted on an account.

Implications for the design team

Ten principles follow from the evidence. Each names the finding it rests on.

1. Start where peers started: associate-facing drafts on document-heavy work, with the associate finalising. This is the only pattern any bank has scaled (DBS credit memos, Wells Fargo underwriting drafts, EricaAssist). Sequence read-mostly research agents before transaction-touching ones, as Citi did.
2. Specify reliability as consistency across repeated runs, not one-shot accuracy. Measure pass^k on the bank's own tools and policies before granting any autonomy over account actions; a 61% one-shot score became under 25% at eight consecutive passes.
3. Write the execute-vs-recommend rule yourselves, because no regulator or standard supplies it. Borrow MAS's structure: score autonomy into a materiality tier; attach to each tier the reviewer role, intervention authority, logging depth and near-miss review. Add reversibility and blast radius as explicit criteria, since the published autonomy scales omit them.
4. Put every hard control in deterministic code outside the model. Entitlements, limits, approvals and authorization belong in the bank-owned tool-execution layer, where the providers themselves place execution. Scope tools per workflow; tool filtering was the one injection defence that cut attack success to single digits without wrecking utility.
5. Treat a human approval step as a hypothesis, not a control. Seed known errors and measure reviewer catch rates; cap reviewer load; design rationales as cheap-to-check pointers to source records rather than persuasive narratives, because explanations raise acceptance regardless of correctness.
6. Reconcile every claimed outcome against system-of-record state. Agents fabricate workarounds and game checkable metrics; give no agent write access to the thing that scores it.
7. Build the trace pipeline and agent identity model before the first production agent. Platform defaults for capturing prompts and tool arguments are opposite across vendors; no identity standard exists, so give each agent its own identity tied to a named owner and a tamper-evident action log now, in a schema that can map onto emerging OAuth and OpenID work.
8. Design the human off-ramp first in any customer-facing flow. The regulator-documented harm is blocked recourse, and contestability (not "a human reviewed this") is what moved perceived fairness in the one lending study.
9. Treat disclosure as a tested design variable, not a label. Disclose AI status at the outset and throughout (the Utah safe-harbor pattern covers most US states' intent and the EU rule); frame the agent as a check on a named associate's judgment where its role is visible; test wording and timing with real customers, since a bare label may be inert and an up-front "this is a bot" has carried a large penalty.
10. Make provenance system-generated and routine for associates. People who disclose AI help are judged less competent, so labelling must not read as a personal admission; test whether an "AI-drafted" tag changes how reviewers judge the work before rollout. Pair the rollout with training, manager involvement and a stated job-security position, because the measured associate baseline is anxious, not neutral.

Two cautions on borrowed numbers. Headline efficiency figures from peers (a 40% KYC unit-cost cut, "tenfold" engineering productivity, 100K weekly hours) are attributed to AI and technology generally or come without method; none isolates agents. And the widely repeated claim that 95% of AI pilots fail comes from 52 interviews about custom generative AI tools, not agents or banks, and should not anchor a business case.

Gaps and limits of the evidence

The biggest gap is that nobody, bank or regulator, has published how production agents perform. Everything else in this section follows from that.

Nothing exists yet

• Agent outcome metrics from any bank: error rates, override and escalation rates, rework, cost per case. Only targets (DBS 30%), trial claims (NatWest tenfold) or figures attributed to AI generally. Would be answered by a supervisory thematic review of agentic deployments or an audited disclosure.
• A financial-services agent failure-rate study. Every rate is from retail, airline, software or simulated-environment benchmarks on 2023 to 2025 models. The nearest is a simulated e-banking suite in AgentDojo.
• Explicit execute-vs-recommend criteria from any regulator, standard or bank. MAS's materiality tiering is the closest; the announced US RFI on agentic AI (Apr 2026) and the final MAS guidelines were not confirmed as issued.
• Agent deployment evidence in fraud operations and disputes, retail loan servicing, collections, payments and reconciliation, compliance reporting, and HR, finance and legal. Only vendor material surfaced, which the evidence bar excludes. Goldman's trade-accounting agents and BNY's "digital employees" appear only in trade press that could not be reached or verified.
• Any experiment on AI disclosure in banking service or on agents executing account actions, and any evidence on how bank associates treat labelled versus unlabelled agent output.
• Attitudes to agents as distinct from AI or chatbots, for customers or workers. Every survey asks about "AI".
• A regulator-measured share of agent adoption. The fourth Bank of England/FCA survey and the AI Consortium report, both due in 2026, will be the first.

Could not be reached in this run (infrastructure, not absence)

• The Air Canada tribunal decision (CanLII and CRT returned 403), so that row rests on an incident-database summary.
• California's bot-disclosure law (leginfo returned 403 on every attempt).
• McKinsey's 2025 survey page (timed out), so its agent figures are relayed only through the Stanford AI Index.
• Full texts behind paywalls: Luo et al. 2019 (size of the late-disclosure mitigation unknown), Schilke and Reimann 2025, Yurrita et al. 2023, ISO/IEC 42001.
• The EU Digital Omnibus text, so changes to Article 50 timing are unverified; and Colorado's 2025 delay bill and 2026 court stay.

Not researched to primary depth

• US banks beyond the five covered (American Express, US Bancorp, PNC, Truist, Discover, regionals, credit unions); UK and EU banks beyond NatWest (Barclays, HSBC, Lloyds, ING, Santander, BNP Paribas, Deutsche); all Canadian banks; most of APAC beyond DBS and CBA.
• Consultancy banking surveys with disclosed method (BCG, Deloitte, EY, KPMG, Accenture), Edelman, Ipsos, J.D. Power.
• Vendor system cards' agentic evaluations and 2026-generation benchmark scores; several remain only in interactive charts.

How to read confidence in the findings. Of 82 rows, 19 are High, 55 Medium and 8 Low. Low rows are kept because the finding matters and the limitation is stated in the row; they should not be quoted without that caveat. Thirteen rows rest on a bank's own disclosure and five on self-reported surveys; both are flagged in the Evidence Type field.

Method and sources

Every statistic in the findings table was re-checked against the page it is cited to. The research ran on 2026-10-06 as a parallel desk-research sweep: six topics, each split into three or four non-overlapping angles, one research agent per angle (19 in all), followed by a separate compile pass per topic that merged duplicates, pruned weak sources, and re-fetched every surviving URL to confirm each cited number appears in the text.

Evidence was ranked: regulator and administrative data first, then research with a named method, then regulatory and standards text, then provider technical documentation, then bank disclosures and surveys, which are flagged as such. Vendor case studies, marketing, Wikipedia and secondhand trade press were excluded. For every system cited, the table records what it actually does, because "agentic" is used loosely in the market.

All 162 citations resolved. 42 individual statistics or attributions were corrected or removed because they did not appear on their cited page as stated; seven findings were dropped after verification and three more to hold row caps. Those corrections are logged per topic in the project's compile notes.