Agentic banking in 2026: from pilots to governed operations
In 2026, the question in banking is no longer whether to use AI agents. Now it is how to govern them to bring them into production. According to KPMG's June 2026 survey, 51% of banks are piloting agents, but only a minority are scaling them across multiple areas (KPMG). Gartner places agentic AI at the peak of expectations: only 17% of organizations have already deployed agents, although more than 60% expect to do so in the next two years (Gartner).
What is Agentic Banking
Agentic banking is the use of AI agents that do not just answer questions: they query systems, prepare cases, and execute tasks within the institution's rules. Unlike a chatbot or traditional automation (RPA), an agent decides which tool to use at each step based on what it finds.
In practice, an agent can gather a credit file from the core, the bureau, and documents, evaluate it, and have it ready for the committee. The institution defines what the agent does alone, what it prepares for a person to decide, and what it never executes without confirmation.
1. Massive adoption, limited scale
Agentic AI is already in active adoption in 52% of financial firms, but only 23% use it in mature stages. This is shown by the Cambridge (CCAF) 2026 Global AI in Financial Services Report, prepared with the BIS, IMF, World Economic Forum, and IDB, surveying 628 organizations.
Traditional institutions lag behind fintechs: 45% compared to 57% in agentic adoption.
Only 14% view AI as transformative for their strategy.
55% of the industry says it struggles to measure the value of AI; in large institutions, this rises to 76%.
Firms in emerging markets report more deployment at scale than those in advanced economies. For Latin America, this is an opportunity, not a disadvantage.
The same source lists data quality, talent, and legacy systems as the main barriers. 46% of vendors cite legacy systems and siloed environments as a problem when working with their clients.
How Bankingly solves it: Bankingly Agentic Platform operates on the Bankingly Platform, which is already integrated with the institution's core. The first flow is built on top of production integrations, without changing the core. This directly attacks the legacy system barrier that holds most back.
2. Governance is the bottleneck
The bottleneck to scaling is not the technology: it is control. In its first Hype Cycle dedicated to Agentic AI (April 2026), Gartner highlights the emergence of agent governance, security, and cost management as disciplines of their own as a key signal. It also warns that the need for supervision appears early, not after massive deployment.
The main barriers to deploying agents in banks are data readiness and access (63%), complexity of agentic systems (49%), and lack of human supervision skills (41%) (KPMG, June 2026).
Responsibility for AI-driven decisions is distributed: in 49% of banks, it falls on the CEO or executive committee (same source).
Regulators place primary responsibility on the regulated institution more frequently than the industry itself: 38% compared to 18% (CCAF).
Traditional institutions fear losing human supervision more than regulators do: 60% compared to 42% (same source).
The conclusion is straightforward. If the responsibility lies with the institution, the institution must be able to decide, see, and reconstruct every action of an agent.
How Bankingly solves it: The division of responsibilities is defined from the design phase. Bankingly provides and operates the infrastructure, connectors, security, and model evaluation. The institution decides which processes are automated, the rules and thresholds, who approves at each step, and which agent or model changes go into production. Every action is recorded in an audit-only, append-only registry, and every model has its model card (AI-BOM) with provider, version, and data usage.
3. Agents enter first through the back-office
Four of the top five uses of AI in financial services are internal, according to the CCAF. AI is mostly used to execute better, not to reinvent the business model.
Gartner observes the same pattern: organizations use agents mostly to automate narrow tasks in software engineering, customer service, and operations, and most deployments remain limited in scope (Gartner).
How Bankingly solves it. The platform applies a simple criterion: it works for processes that combine querying information, evaluating, and approving. Examples by area include:
SME Lending: the agent builds the file with documents and bureau reports, and makes a recommendation; the committee decides.
AML/CFT Compliance: the agent prepares the pre-analysis of alerts; the Compliance Officer decides.
Operations and treasury: reconciliations, prepared disbursements, and liquidity position.
Customer service and collections: claims classification and preventive collections.
Routine and verifiable tasks are executed by the agent within the rules. What moves funds or is irreversible is decided by the person designated by the institution.
4. Rules in code, agents to evaluate, humans for the irreversible
The best practice in 2026 is not to give the entire process to the model. It is to combine deterministic code, agents, and human approval, each where appropriate.
Gartner concludes in 2026 that fully autonomous agents are not ready for most enterprise use cases, recommending that realistic expectations for autonomy be set.
In banks surveyed by KPMG, reasons for overriding an AI recommendation include exceeding predefined risk thresholds and conflicting with regulatory or legal requirements. That is: explicit rules that decide when a person steps in.
The cumulative error is simple arithmetic. If each step succeeds 95% of the time, five chained steps succeed about 77% of the time end-to-end (0.95 to the power of 5). A better model reduces the error of each step, but does not eliminate the effect. What controls it is the design of the flow.
How Bankingly solves it. Each flow follows a baseline structure with specific steps, which the institution adapts to its process:
Routine items go straight to execution; what the rule flags goes to a person before execution, and everything is recorded.
Thresholds, policies, and amounts go into code rules. The agent queries, prepares the file, and recommends. Transactions involving movement of funds or that are irreversible go through a person. Execution is fixed code behind each tool: the model proposes, the platform decides.
5. Open standards and not relying on a single model
In 2026, the Model Context Protocol (MCP) consolidated as the infrastructure to connect agents with systems. Governed by a neutral foundation, the Linux Foundation's Agentic AI Foundation, it reached approximately 97 million monthly SDK downloads and is natively supported by Claude, ChatGPT, and Gemini, among others. Its March 2026 roadmap prioritized enterprise readiness: audit logs, single sign-on, and gateways (SerpApi, state of MCP in H1 2026).
At the same time, concern about concentration is growing. According to the CCAF, 63% of the industry builds on external foundational models. Regulators are more concerned about concentration (43% vs. 28%) and critical third-party risk than the industry itself.
How Bankingly solves it: Agents connect to operations only through MCP connectors (Banking, Admin, and custom connectors). Each connector exposes limited tools and applies the user's actual permissions. Each agent is a fixed version of instructions, model, and tools: it is adjusted without rewriting the flow. Bankingly evaluates each new model with the test cases of each agent and, if it improves quality, latency, or cost, proposes it with evidence. The change takes effect only with the institution's approval, and the bank's data is not used to train models.
6. Security designed for agents, not just models
An agent acting on systems opens up risks that a chatbot does not have. The CCAF warns that the rapid deployment of agentic AI exacerbates vulnerabilities and makes manual oversight less effective. Privacy and data protection is the number one risk for 73% of respondents, and 48% point to adversarial AI as a major concern.
Adoption is moving faster than security. According to the Cloud Security Alliance (June 2026), 62% of financial institutions are already deploying AI agents. Sensitive data leakage is their primary security concern, and the governance of non-human identities is emerging as a priority.
The first incidents already show where the risk comes from. Between January and February 2026, more than 30 vulnerabilities linked to MCP were recorded, and "tool poisoning" became a general concern: hidden instructions in the text returned by a tool, which the model might take as orders. The defenses that prevailed are treating those responses as data, isolating high-privilege tools, and not allowing executions without confirmation (SerpApi).
How Bankingly solves it: Controls are applied per layer:
Isolation: dedicated instance per institution. The institution is identified by the signed token, never by the request.
Identity: the user authenticates in the channel and each request carries a short-lived signed token.
Agents: each version has its closed list of tools and token and iteration limits per execution. Content returned by systems is treated as data, not instructions, to mitigate prompt injection.
Operations: those that move funds or are irreversible require a confirmation that the model cannot trigger, plus whatever second factor the institution requires.
Data and logs: models are not trained on bank data, and logs are append-only, with Bankingly staff access fully audited.
Bankingly also has ISO/IEC 27001 certification for information security.
7. Measure value before scaling
Only 40% of firms report higher profitability thanks to AI, and 43% see no change (CCAF). Often, the problem is that it is not measured: 55% of the industry struggles to measure the value of AI. In banks, only a third have complete visibility of what it costs to operate AI, while 87% feel pressure from the board or investors to prove value (KPMG). Gartner adds agent cost management (FinOps) as an emerging discipline (Gartner).
The practice taking hold is the pilot with a baseline: measure the current process, run the agent in parallel, and compare before expanding autonomy.
How Bankingly solves it: The work plan has three stages:
Technical workshop: with the areas defined by the institution, the flow, scope, and its metric are chosen.
Pilot: runs in parallel to the operation, without touching production. It begins with synthetic data and continues with real cases under a data processing agreement.
Scale: more flows and more autonomy, action by action, based on pilot evidence.
What financial institutions should do now
The institutions that reach scale will be those that treat agentic AI as a governed capability, not an experiment. Five decisions make the difference:
Choose a process with real operational load, combining query, evaluation, and approval, and measure its baseline today.
Separate what needs to be exact from what requires judgment: rules in code for thresholds and amounts, agents to evaluate, humans for the irreversible.
Demand governance from day one: who approves, what is logged, and who can shut down or limit an agent.
Build on top of integrations that already work and open standards like MCP, instead of starting from scratch with each vendor.
Scale with evidence: expand autonomy action by action, only when the pilot demonstrates results.
For institutions in Latin America and the Caribbean, the window is open. Emerging markets are already showing more deployment at scale than advanced economies, according to the CCAF. The difference will be made by whoever combines speed with control.
→ Let's design your first agentic flow
The difference between an experiment and a real capability lies in how you start: a specific process, a clear metric, and governance from day one. Bankingly Agentic Platform operates on the channels your institution already has with Bankingly, without changing the core.
Let's start with a technical workshop. Together with your teams, we choose the process with the highest operational load, define the scope, and agree on the metric to measure the pilot. You decide what is automated and who approves at each step.
→ Request your technical workshop here
Sources
All external sources are from 2026.
2026 Global AI in Financial Services Report: Cambridge Centre for Alternative Finance with BIS, IMF, WEF, IDB, CGAP, and AMF. April 2026.
What the 2026 Hype Cycle for Agentic AI Reveals: Gartner. April 2026.
AI Quarterly Pulse Survey: Banking, Q2 2026: KPMG. June 2026.
The State of Cloud and AI for Financial Services 2026: Cloud Security Alliance. June 2026.
The State of MCP: Everything That Changed in H1 2026: SerpApi. June 2026.
Bankingly Agentic Platform: presentation of Bankingly's architecture and governance model.
