Operational Risk Examples in Banks Using Agentic AI

The goal here isn't to scare anyone off agentic AI; the goal is to name the exposure clearly enough that a bank can build controls before it needs them, not after.

Start with a distinction that matters more than it sounds like it should. Advisory AI recommends. Agentic AI acts. An agent doesn't hand a loan officer a suggested credit decision; it initiates the payment, queries the account, and picks the rail. It also does this continuously, originating a workflow, monitoring it, and managing exceptions across the full lifecycle rather than showing up once at a single checkpoint.

Two things follow from that. First, speed: agents run at machine pace across several systems at once, while most human oversight loops were built assuming a person would be the one clicking "approve." Second, and more subtle: because agents chain tools together and call other agents to finish subtasks, one bad instruction, whether it's a misconfiguration or something an attacker slipped in, can travel through several workflows before a single human notices.

There's a gap worth sitting with here. In one industry poll of banking executives, 95% said AI can advise and 92% said it can assist. Only 38% believed the technology was actually ready for full autonomy. That 57-point spread between what AI can do and what banks trust it to do on its own isn't a footnote; that's exactly where operational risk sits, in the space between capability and readiness. And the governance playbooks built for older, static models don't stretch to cover systems that keep learning and adjusting after they've already gone live.

How broadly agentic AI is already deployed in banking, and what that deployment looks like in practice

The adoption numbers are past the experimental stage. Roughly 70% of banking institutions are already using or piloting agentic AI, split between about 16% in live deployment and 52% running active pilots. In 2025 alone, fifty of the world's largest banks put out more than 160 distinct use cases between them. Zoom out to financial services broadly and 81% of firms have adopted AI at some level, with 40% already at an advanced stage of use.

What does "deployed" actually mean day to day? An agent picking between FedNow, ACH, and RTP based on a bank's live liquidity position. An agent drafting credit memos. Agents running accounts payable end to end, or triaging fraud alerts before a human analyst ever sees them.

The productivity numbers explain why banks are moving this fast:

• Early agentic use cases show manual workload cut by 30% to 50%
• One U.S. bank reported a 20% to 60% productivity gain in credit risk memo creation
• Purchase order processing cycle time dropped by as much as 80% in a case cited by PwC

Those aren't small, marginal gains. At that scale of automation, the kind of error that used to be a rare edge case turns into a routine operating condition. The question this raises isn't whether something could go wrong, but how often, and how far, when it does.

Autonomous transaction errors and the mechanics of how they cascade

A human clerk who makes a mistake makes one mistake. An agent running at machine speed can repeat that same mistake across thousands of transactions before anyone catches it. That's the core exposure, and it comes down to how these systems are built.

Agents break a goal into smaller steps and hand pieces of it off to other agents or to outside tools and APIs. Picture a five-step payment workflow. If step two goes wrong, silently, that error doesn't stay contained to step two. It rides forward into steps three, four, and five, and by the time a human looks at the final output, the original cause is buried under everything that happened after it.

Prompt injection is one concrete way this starts. OWASP ranks it among the top risks for large language models, and in an agentic setup it does more than produce garbled or misleading text. An injected instruction can redirect what tools the agent calls and what actions it takes, including telling it to initiate or reroute an actual transaction. Related to that is privilege escalation: agents typically touch several external APIs and systems, and each connection is a possible seam where access meant for one task quietly extends into another.

Timing matters too. CrowdStrike reported that average attacker breakout time fell to 29 minutes in 2025. That's well inside the window most banks would need to notice an agentic anomaly and shut it down, which tells you something about the margin for error here: there isn't much of one.

Banking doesn't yet have its own headline case, but an adjacent sector does. A healthtech firm disclosed a 2025 breach affecting more than 483,000 patient records, traced back to a semi-autonomous agent that pushed confidential data into unsecured workflows while it was busy optimizing something else. That's what an "autonomous error" looks like once it's had room to run. For banks, the takeaway is blunt: transaction limits, escalation rules, and confidence thresholds built directly into the agent are the first thing standing between a small error and a cascading one.

Model drift and the validation gap that static governance frameworks leave open

Here's a question worth sitting with: what happens when the model a bank validated on day one isn't the same model running six months later? Adaptive agents that keep learning after deployment don't fit neatly into validation frameworks built for models that stay still.

That gap isn't hypothetical. The OCC's revised Model Risk Management guidance explicitly excludes generative AI and agentic AI models from its scope. The regulatory floor banks assumed they were standing on simply doesn't cover the systems they're now running. SR 11-7, the longstanding Federal Reserve and OCC model risk management guidance still in force, requires banks to explain model outputs, validate that a model performs as intended, and document its limitations. All of that was written with batch-scoring models in mind, and it doesn't account for systems that quietly rewrite their own behavior through ordinary use.

What does drift actually look like on the ground?

• A credit-triage agent trained on 2024 data starts issuing systematically different risk classifications by 2026 as economic conditions shift underneath it
• A payment-routing agent, optimizing hard for cost, edges settlement risk upward in ways nobody explicitly asked for

Neither of those triggers an alert on its own, because no baseline comparison is running to catch the drift in the first place. And there's a data problem sitting underneath all of this: in one 2024 Deloitte survey, more than 90% of data users at banks said the data they needed was often unavailable or took too long to pull. If the inputs feeding an agent are already degraded, any validation of its outputs was compromised before it started.

Regulators, for what it's worth, are converging on roughly the same answer from different directions: continuous post-deployment monitoring and documented behavioral oversight across a system's full operating life. You see it in the EU AI Act's high-risk obligations, in emerging central bank consultation frameworks, and in SR 11-7's lifecycle accountability requirements. The practical ask coming out of all three is the same: model lineage, change logs, and behavioral monitoring that older AI systems never needed and, frankly, weren't built to support.

Correlated agent behavior and the systemic risks it introduces to payment flows

The IMF has warned that autonomous agents could amplify market volatility through highly correlated actions. Sit with that phrase for a second, because it reframes the whole risk: this is about many banks' agents responding to the same signal in the same way, all at once, rather than one bank's agent malfunctioning on its own.

Why would that happen? When agents at different institutions run on similar underlying models and watch the same market or liquidity signals, their decisions start to move together, the same way algorithmic trading produced herding behavior in equity markets years ago. Applied to payments, that shows up as a very specific problem: synchronized payment initiation across many agents at once, all spiking intraday liquidity demand right at settlement. Agents that are each individually optimizing their own liquidity position in real time can, together, drain settlement capacity that was sized for slower, more spread-out, human-paced transaction flow.

The Bank of England flagged something almost paradoxical in 2026: the delays caused by requiring human approval inside agentic workflows could unintentionally raise liquidity risk and blunt the effectiveness of hedging strategies. In other words, the friction that slows agents down and annoys everyone trying to move fast carries real systemic value. Take it away and you may lose more than you gain.

Compare this to circuit breakers in equity trading. Those rely on regulated intermediaries, centralized control, and clear lines of institutional accountability when something needs to stop. Agentic payment activity, especially where an agent is acting under delegated authority across several platforms at once, doesn't obviously have an equivalent kill switch. Which raises the real operational question for any bank running these systems: it's not enough to ask whether your own agent controls hold up. You also have to ask what happens when every other bank's agents are reacting to the same signal, at the same moment, as yours.

Fraud amplification and the cybersecurity exposure that agentic systems add to existing vulnerabilities

Start with the baseline, because it's already large before agentic AI enters the picture. Reported identity and related fraud losses in financial services hit $12.5 billion in 2024. U.S. lenders alone faced $3.3 billion in exposure from synthetic identities tied to newly opened accounts through 2024.

Agentic AI shifts where the attacker aims. Account takeover used to mean stealing a login. Now it can mean targeting an agent's objectives directly. A compromised agent can be reconfigured to route payments somewhere else or quietly change account parameters, no stolen password required. On the attacker's side, AI is also being used to manufacture synthetic identities at scale; in one sample of 272,000 phishing emails studied between September 2024 and February 2025, KnowBe4 found signs of AI involvement in 82.6% of them.

There's also a quieter risk that's easy to overlook because nobody involved means any harm. Staff paste member account details into a public AI tool to draft an email faster or summarize a long document, and without meaning to, they've fed sensitive financial data into a system outside the bank's control. Nobody intended harm here, but the problem is real all the same, operationally and legally.

Smaller institutions carry this exposure just as heavily as large banks, often with fewer people dedicated to catching it. Credit unions in particular face the same agentic attack surface as the biggest national banks, but with leaner security teams and less room to build a dedicated response function. It shows up in how firms rank their own worries: in an FIS report, eight in ten highly automated firms named data security and privacy as their top concern, more than double the 39% reported by less-automated firms. Automation doesn't shrink the security burden; it moves it somewhere new. And that new burden compounds with data quality. A 2026 study from the Cambridge Centre for Alternative Finance found 70% to 74% of firms integrating AI cite data privacy exposure, hallucination in financial decisions, and lack of explainability as leading concerns, meaning bad data is a direct fraud-enablement risk when an agent acts on inputs nobody checked, not merely a modeling headache.

Compliance and audit gaps when AI handles regulated conversations and decisions

The CFPB laid this out plainly in its Winter 2025 Supervisory Highlights: there's no advanced technology exception to federal consumer financial law. Adverse action notices, fair lending obligations, disclosure requirements, none of it disappears because an agent made the call instead of a loan officer.

Examiner expectations have hardened since 2025 around a few specific points. Adverse-action notices need reasons that trace back to the actual model, not a generic boilerplate explanation. Model documentation, lineage, and explanation validation are now treated as baseline requirements, not extras. And supervisors expect to be able to reconstruct exactly which conversations an AI system handled, what it told a customer about collections or disclosures, and whether that can be defended after the fact.

Regulatory convergence on this is happening across several jurisdictions at once, and it's worth listing because the pattern matters more than any single rule:

• The EU AI Act designates credit scoring and creditworthiness assessment as high-risk use cases; enforcement, originally set for August 2026, has been pushed to December 2027 under a provisional agreement
• DORA became fully applicable January 17, 2025, and European supervisors have increasingly treated AI as an ICT risk management issue, not a matter of ethics or innovation
• Freddie Mac added formal AI and machine learning governance requirements to its Single-Family Seller/Servicer Guide, effective March 3, 2026
• The Bank of Thailand's 2025 policy requires a human in the loop whenever AI is used for credit approval, account opening, or approving deposits, withdrawals, or transfers

None of these agencies are talking to each other, and yet they've landed on nearly the same answer.

Underneath all of it sits a structural problem: agent actions span tools, APIs, and sub-agents, and each of those systems logs things its own way. The records end up scattered across systems that were never designed to be reconciled against each other, which creates a compliance exposure that a normal, single-system audit trail simply wouldn't have. One 2025 report found that 63% of breached organizations had no AI governance policy in place at all. That points to a documentation and accountability failure rather than a technology one, and it's the kind of gap a bank can close before a breach forces the question.

The three-lines-of-defense model applied to agentic AI deployments

Banks already have a model for this. It's just never had to stretch over something that acts on its own.

Line one is the agent itself. Transaction limits keep it authorized only up to a set threshold, with anything above that escalated to a person. Confidence thresholds mean the agent flags a decision it's unsure about instead of just acting on it anyway. Escalation rules define exactly when the agent has to stop and hand control to a human supervisor. And every tool call, every API interaction, every step of a decision gets logged as it happens, not stitched together afterward from whatever records happen to survive.

Line two is independent risk oversight. This function checks model performance against the benchmarks set at validation, on a fixed schedule, not just when something looks off. It reviews escalated cases looking for patterns that point to drift or a misconfiguration nobody caught. And critically, it needs the actual authority to suspend an agent when performance slips, not just the authority to write a memo about it.

Line three is internal audit, checking that line one's controls work as designed rather than just as documented, and confirming that line two is genuinely independent, not quietly deferring to the business units it's supposed to be checking.

How a bank structures this governance matters, too. Centralized governance, one authority, one uniform standard, works well for smaller institutions and for functions under heavy regulatory scrutiny, though it moves slower by design. Federated governance, central policy paired with local implementation, scales better for large institutions running across multiple jurisdictions with different rules to satisfy in each one. Neither is right or wrong on its own; it depends on the size and shape of the institution.

One more piece worth naming: fallback documentation. Agentic workflows need a written recovery plan, a documented fallback procedure, and a clear exit plan for any third party involved, especially when the whole workflow depends on a single language model, a single cloud provider, or one orchestration layer. If that one point fails, what happens next needs to already be written down. A September 2025 report from MIT Technology Review Insights and Statista found that banking executives named governance, risk, and compliance as the single biggest obstacle to getting real value out of agentic AI. That's the executive suite saying, in its own words, what risk teams have been flagging from the sidelines.

What responsible deployment looks like when controls and automation are designed together from the start

Every risk this piece has walked through has a structural answer sitting right next to it. Cascading errors get addressed by action logs and confidence thresholds built into the agent itself. Drift gets addressed by continuous monitoring against a real baseline. Audit gaps close when documentation is built into the agent's architecture step by step, rather than assembled after the fact from scattered logs.

One practical point worth sitting with: agents deployed on top of a bank's existing rails, rather than built to bypass or replace core infrastructure, keep the blast radius of any single failure smaller. The agent's actions stay bounded by the same settlement, reconciliation, and limit structures that were already governing everything else. The difference that makes is the difference between a contained error and a cascading one.

So what should a bank actually be asking before it expands an agentic deployment? Can the system explain, in specific and traceable terms, why it made a given decision, not just that it made one? Is there a human checkpoint at every point where the cost of being wrong is high enough to matter? Is someone actually watching for drift, on a schedule, with a real baseline to compare against, rather than waiting for a customer complaint to surface it first?

None of this is an argument against agentic AI. The productivity numbers alone make clear why banks are moving toward it as fast as they are. But speed without a matching set of controls is exactly how a routine error turns into a systemic one. Build the governance in from the start, at the same time as the automation, and the risk map in this piece stops being a list of things that might go wrong. It becomes a checklist for making sure they don't.