Agentic AI in Banking: When the Attacker Scales Before You Do
On 31 July 2026, the Joint Committee of the three European Supervisory Authorities, the European Banking Authority, EIOPA and ESMA, issued a formal statement calling for enhanced governance and consistent supervision to mitigate ICT risks from frontier AI models. Six weeks later, Boston Consulting Group published a widely circulated warning that agentic AI will industrialise financial scams, turning fraud from a cottage effort into something closer to a software production line. Taken together, the two documents reset the conversation that most European banks have been having about agentic AI in banking this year.
For most of the year, the agentic AI discussion inside European banks ran along a familiar line. The EU AI Act deadline of 2 August was the organising event. The European Central Bank's SSM-2026-0301 instruction, issued at the end of September, forced the governance question to the top of the agenda. Senior teams asked where agentic AI fitted into the existing model risk framework, how to extend procurement, how to rewrite the vendor contracts that the AI Act required to be rewritten. Serious, necessary work. It assumed, however, that the innovation office had the luxury of sequencing: pick the use case, build the governance, approve the supplier, deploy.
Four weeks into Q4 2026, that assumption no longer holds. The attacker side of the ledger is moving on a different clock.
The problem inside a financial institution
Any innovation lead, head of transformation or CIO reading the BCG and ESA material in the same week knows what the real difficulty is. It is not awareness. The threat picture is well understood inside the industry. The difficulty is that the defensive response runs into every structural constraint that already slows down adoption decisions inside a European bank.
First, the procurement constraint. An agentic AI system that monitors transaction streams, triages fraud alerts or orchestrates sanctions screening touches almost every control function the institution has. Under the AI Act, several of those uses sit in the high-risk category, which pulls the vendor contract into a regime that very few procurement teams have fully industrialised. Under DORA, if the supplier is deemed a critical ICT third party, the contract must meet a further set of requirements, and in some cases the supplier itself becomes a critical third party service provider with direct oversight from the ESAs. Procurement timelines that already run to six or nine months are not matched to the pace at which the attacker side can iterate.
Second, the model risk constraint. The internal framework most banks use was built for predictive models, not for agents that take sequences of actions, call tools and interact with other systems. Many risk committees have quietly concluded over the past six months that their existing validation playbook does not cover what an agent actually does. Rewriting that playbook is itself a multi-quarter programme. Every week it continues, the bank deploys either nothing or something validated against the wrong standard.
Third, the stakeholder constraint. Fraud operations, compliance, cyber, model risk, data, the CTO office, procurement and the business line owner all have a legitimate seat at the agentic AI table. Each sits on its own cadence. The result, in most institutions, is that the decision loop closes slowly, which is precisely what an attacker exploiting agentic tools counts on.
Fourth, the peer opacity constraint. Boards ask what comparable institutions are actually deploying, not only what they are piloting. The answer is harder to produce than it should be. Public disclosures lag deployment by at least a quarter. Vendor case studies describe pilots, not production footprints. The chief risk officer at a comparable bank in another jurisdiction is unlikely to walk through what works and what does not on a webinar. The bank's own supervisor often has a more complete peer picture than the bank itself does, which is uncomfortable but accurate.
Common responses, and what each one trades off
In practice, three responses dominate right now. Each carries a particular trade-off.
The first response is to accelerate adoption by narrowing the use case. The innovation office picks a tightly bounded problem, often inside fraud operations or customer-facing authentication, and runs a single agentic deployment with a clear control envelope. This produces learning quickly. It leaves the enterprise question unanswered. The next use case starts almost from scratch because the first one was scoped too tightly to serve as a template.
The second response is to consolidate on a strategic AI vendor and let that vendor handle the agentic layer. This simplifies procurement and reduces the model risk burden, because validation work compounds. The trade-off is well known: concentration risk, loss of optionality and, under DORA, the possibility that the vendor eventually appears on the critical third party list and the bank finds its leverage reduced.
The third response is to defer. The bank commits to stronger governance, to documentation, to internal upskilling, and treats the production deployment decision as a 2027 question. This response is defensible on paper. It is becoming harder to defend against the fraud picture. If the attacker is moving to agentic tooling in 2026, deferring the defensive deployment by a year is a policy choice with a cost attached to it, and that cost is beginning to show in loss data at institutions that have made it.
None of the three is wrong. Each needs to be made deliberately, against a current map of what peers are doing and what suppliers are credible.
A workable route under these constraints
This is where the innovation office earns its keep. The useful question is not which of the three responses to adopt. It is how to close the information loop fast enough that the response, whichever one it is, can be revisited quarterly rather than annually.
Closing that loop depends on three inputs that most innovation offices currently assemble from scratch each quarter. First, a credible shortlist of agentic AI suppliers who can meet AI Act and DORA obligations without a six-month contract renegotiation. Second, a current view of what comparable banks in adjacent markets have put into production, not what they presented at a conference. Third, a peer-level conversation with equivalents at other institutions about what the supervisor is beginning to ask and what the internal model risk committees will accept.
This is the terrain where The Connector's work sits naturally. A Discovery Innovation Meeting compresses the first task: it puts the innovation lead in front of a curated set of suppliers chosen against the bank's own criteria, with the conversation framed around deployment and control, not pitch. The Peer Forum addresses the second and third: a small, moderated conversation among equivalents in different markets, under Chatham House rules, that produces the peer picture the supervisor already has. Finance X Magazine provides the editorial layer that keeps the senior team exposed to the same material between meetings. None of these replace the internal governance work. They make it faster to do, because the inputs arrive already sorted.
Why this matters right now
Two calendars are converging in the first quarter of 2027. The ECB's 2026 to 2028 supervisory priorities move AI governance from a sub-theme to a stated priority, with the first wave of thematic reviews expected before the summer. Separately, the attacker-side adoption curve described in the BCG material will begin to show up in fraud and operational loss data over the same period. Banks that have not made their adoption decision by then will find themselves making it under supervisory and operational pressure at the same time, which is the worst possible setting for a serious call.
Across the Atlantic, the US Federal Reserve's SR 26-2 update has quietly excluded agentic AI from certain supervisory expectations, drawing a line that European supervisors have not drawn. European banks with US operations therefore face a split framework, one that forces the agentic decision to be made in Frankfurt and Paris rather than New York. For most groups, that means the European answer is now the binding answer.
Making that call now, with the right inputs, is the quieter and better path.
Closing thought
The question senior teams should be asking this week is not whether to adopt agentic AI. The market and the regulators have already closed that question. It is whether the bank's own decision loop can match the pace at which the surrounding environment is changing. The adoption decision is only as good as the current peer picture, the current supplier shortlist and the current regulatory read sitting behind it. Where those inputs are stale, the decision will be too. The work for the rest of this quarter is to make sure they are not.
