Agentic AI Pushes Banks to Fix Security, Data and Decision Rights

The banking sector's rush toward agentic AI is exposing fundamental weaknesses in data governance, cybersecurity architecture, and decision-rights frameworks that most institutions never designed for autonomous systems. Unlike traditional AI that recommends actions for human approval, agentic AI executes decisions independently — and the industry's infrastructure is dangerously unprepared.

A PYMNTS analysis reveals that 67% of large banks have deployed or are piloting agentic AI systems, yet only 23% have established formal governance frameworks for autonomous decision-making. The gap between deployment speed and security readiness represents one of the most significant operational risks in modern banking.

The Autonomy Problem

Traditional banking AI operates in an advisory capacity: flagging suspicious transactions for human review, recommending credit decisions for officer approval, or suggesting portfolio rebalancing for adviser confirmation. Agentic AI eliminates this human checkpoint.

When JPMorgan's autonomous fraud detection system identifies a suspicious pattern, it doesn't flag it for review — it blocks the transaction, freezes the account, and initiates customer verification simultaneously. When Goldman's AI treasury agent detects a liquidity opportunity, it executes the trade within milliseconds. No human sees the decision until after it's made.

This operational model demands a completely different security architecture. The traditional perimeter-based approach — where humans authenticate and AI processes data within controlled boundaries — fails when the AI itself becomes the decision-maker with broad system access.

Current estimates suggest that the average agentic AI deployment in banking has access to 3.4x more data systems than equivalent human-supervised AI tools. This expanded access surface creates proportionally larger attack vectors for adversaries.

Three Critical Gaps Banks Must Address

1. Data Governance for Autonomous Access

Agentic AI systems need real-time access to customer records, transaction histories, market data, and counterparty information. Most banks' data architectures were designed for request-based human access, not continuous autonomous consumption.

The challenge is granularity. A human fraud analyst accesses specific accounts during investigations. An agentic fraud system monitors all accounts continuously. The traditional least-privilege security model breaks down when an agent's legitimate function requires broad persistent access.

Banks like HSBC and Citi are developing "data boundary" architectures that constrain what agents can access based on their current task context rather than their role definition. This dynamic permissioning represents a fundamental shift from static role-based access control.

2. Decision-Rights Frameworks

Who is accountable when an autonomous agent makes a bad decision? Current regulatory frameworks assume human decision-makers. The OCC's guidance on model risk management (SR 11-7) was written for advisory models, not autonomous actors.

Leading institutions are implementing tiered decision authority:

• Tier 1 (full autonomy): Routine actions under $10,000 with established patterns
• Tier 2 (supervised autonomy): Actions $10,000-$500,000 with post-execution human review within 4 hours
• Tier 3 (human-in-the-loop): Actions exceeding $500,000 or involving novel patterns require pre-approval

This tiered approach satisfies regulators while preserving the speed advantage that makes agentic AI valuable.

3. Security Against Adversarial Manipulation

If an attacker compromises a human analyst, the damage is bounded by that person's access rights and processing speed. If an attacker compromises an agentic AI system, the damage potential scales to machine speed across all systems the agent can access.

Prompt injection attacks — where adversaries embed instructions in data that the AI processes — represent a particularly acute threat. A carefully crafted transaction description could potentially instruct a poorly-secured agent to approve fraudulent transfers or modify detection thresholds.

Banks are responding with "adversarial sandboxing" — running agent decisions through isolated verification environments before execution — and cryptographic attestation chains that validate each decision's provenance.

Why This Matters

For accounting and finance professionals, agentic AI governance isn't a technology concern — it's an audit and compliance imperative.

Audit implications: Financial statement audits must now assess whether AI agents making material decisions have appropriate controls. PCAOB standards haven't caught up, but leading firms are already developing AI-specific audit procedures.

Internal controls: SOX compliance frameworks need updating for environments where automated agents execute transactions. The segregation-of-duties principle requires reinterpretation when a single AI system handles what previously required multiple human approvers.

Client advisory: Companies deploying agentic AI need guidance on liability allocation, insurance coverage for autonomous decision errors, and regulatory disclosure requirements that vary across jurisdictions.

Risk assessment: The probability of a major agentic AI incident at a top-20 bank within the next 18 months is estimated at 40-60% by cybersecurity firms. The financial impact could range from $50 million to $2 billion depending on the agent's scope of authority.

The key takeaway: Agentic AI transforms banking security from a perimeter defense problem into a decision-governance challenge — and the institutions that build proper autonomous oversight frameworks first will have both the competitive advantage and the regulatory goodwill when incidents inevitably occur.