AI agents may reshape banking, but banks must tighten security and accountability

AI agents could significantly change banking by making decisions and carrying out tasks, but banking leaders say institutions must strengthen security, accountability and human oversight before giving these systems wider responsibility.

Speaking at the Business Standard BFSI Summit in Mumbai, executives said banks would need to rethink how they authenticate users, monitor transactions and manage risks as autonomous banking develops. The discussion took place during a session titled Autonomous Banking & Security, moderated by Business Standard's Shivani Shinde.

Authentication and accountability

Ramesh Lakshminarayanan, HDFC Bank's Group Head of Information Technology and Chief Information Officer, said agentic banking was becoming an enduring part of the sector. He said banks should prepare for the change while developing their own methods until a clear regulatory framework emerges.

Lakshminarayanan said AI agents should be authenticated in the same way as human users. Banks would also need stronger transaction monitoring, including systems capable of identifying suspicious activity in near real time.

The accountability issue becomes more difficult when a customer authorises an agent to make a payment or perform another banking task, then the system behaves unexpectedly. Lakshminarayanan said responsibility for an autonomous agent's actions would ultimately return to the bank.

That principle could affect how banks design customer permissions, review transactions and respond when an AI system acts outside expected boundaries. The leaders' comments indicate that convenience cannot be separated from controls when agents are given access to banking services.

Banks remain responsible for risk

Rajesh Prasad, Director at Punjab National Bank, said safeguards were necessary because risk management was central to banking. He compared the issue with lending, where precautions do not remove a bank's responsibility when a loan turns bad.

Prasad said AI could support autonomous banking while also improving transaction monitoring. Banks were already using AI to examine customer transaction patterns, including the geography and frequency of activity.

Such monitoring can help identify unusual behaviour, but the discussion also highlighted the need to distinguish an alert from a final decision. A transaction that appears unusual may still be legitimate, making oversight important before action is taken.

From digital journeys to flexible interactions

Sameer Shetty, Axis Bank's Group Head of Digital Business, Transformation and Strategic Programmes, said AI represented a deeper shift than the move from traditional banking to digital banking.

Traditional digital services often require customers to complete forms, submit information in a prescribed order and pass through several authentication steps. AI could handle more of that complexity, allowing customers to interact with banks through less rigid journeys.

Shetty said AI could also let customers select individual products from different banks instead of depending on a single institution for all their banking needs. At the same time, he cautioned that customer-facing agents created a more complicated governance challenge.

Banks would remain responsible for their own AI systems. However, the treatment of agents acting for customers through their credentials and instructions was less clear, particularly when those agents interact with several institutions.

Setting boundaries for agents

Paritosh Wechalekar, Managing Director of Technology Services for India Business at Accenture, said banks should separate tasks that agents can perform within defined limits from decisions requiring closer oversight.

An agent that gathers documents, reviews them and verifies information would operate within controlled boundaries. An agent independently approving a loan would carry a different level of risk.

The same distinction applies to fraud monitoring. Detecting a potentially fraudulent transaction is not the same as conclusively declaring it fraudulent, because a legitimate payment may also appear unusual.

Wechalekar said banks must assess each use case and establish safeguards suited to its risks. They also need stronger identity and access controls, allowing them to determine which agent acted, whether it was authorised and the circumstances surrounding the action.

The path towards autonomous banking

Nishant Singh, Founder and CEO of Business Next, said banks should look beyond isolated AI projects and build capabilities for more autonomous operations. He described the future of banking as “zero touch”, while also stressing that automation and agentic AI alone do not constitute autonomous banking.

Singh said banks would need an intermediate stage of cognitive banking, where intelligence from different processes is brought together to inform decisions. He also said institutions must rethink security as customers begin using their own AI agents to interact with bank systems.

That would require banks to identify such agents, specify the authority granted to them and create ways to withdraw that authority. Singh also called for mechanisms that can stop an agent when something goes wrong, describing a kill switch as part of a wider security architecture rather than a standalone function.

Conclusion

The banking leaders' central message was that AI agents may make services more flexible and operations more automated, but wider adoption depends on authentication, defined authority, transaction monitoring, governance and continued bank responsibility.

Frequently Asked Questions

Q. What did banking leaders say AI agents could change?

AI agents could automate decisions and operations, simplify customer journeys and support more autonomous banking.

Q. Why is authentication important for AI agents?

Banks need to establish which agent is acting and whether it has permission to perform the activity.

Q. Who would be responsible if an agent acted unexpectedly?

The banking discussion stated that responsibility would ultimately return to the bank.

Q. How are banks using AI to monitor transactions?

Banks are using AI to study transaction patterns, including the geography and frequency of customer activity.

Q. What is the difference between detecting and declaring fraud?

An unusual transaction can be legitimate, so identifying a potential fraud signal is different from conclusively declaring fraud.

Q. What tasks could operate within controlled boundaries?

Collecting documents, reviewing them and verifying information were cited as examples of bounded agent tasks.

Q. Why would loan approval require greater oversight?

An agent independently approving a loan would involve a different level of risk from document collection or verification.

Q. What controls must banks develop for customer-owned agents?

Banks need to identify those agents, define their authority, withdraw that authority when necessary and stop them if something goes wrong.