Adoption has moved faster than most people expected. In 2026 around 44% of finance teams report using agentic AI, a sharp jump year over year, and the market for it is projected to reach close to 33 billion USD by 2030. Banks already run agents across lending, underwriting, fraud detection, AML/KYC monitoring and portfolio operations. The technology question is largely settled. The design question is not.
The mistake we see is treating “agentic” as a single capability you switch on for a whole process. It isn’t. An agent that drafts a credit memo and an agent that approves the loan are different animals with different failure costs, even if they share the same model underneath.
Sort the work by the cost of being wrong
Our first move on any agentic project is boring and it saves a lot of grief. We split the workflow into steps and ask one question per step: if the agent gets this wrong, how expensive is it, and can we undo it?
Where a wrong answer is cheap and reversible, give the agent room to run. That covers a surprising amount of real finance work:
- Drafting: a first-pass credit memo, a reconciliation summary, a client email that a person edits before it goes out
- Triage and routing: sorting an AML alert queue by likely severity, flagging which KYC cases need a human eye
- Retrieval and extraction: pulling figures out of filings, gathering counterparty data, assembling the inputs for a decision rather than making it
In all of these the agent produces something a person checks before it has consequences. A bad draft costs a few minutes. That is the right place for autonomous workflows.
Where a wrong answer is expensive, a person signs. A credit decision, a trade, a number that goes in front of a client or a regulator: these need a human approval step, not because the agent is untrustworthy but because the cost of an undetected mistake dwarfs the cost of the review. Human-in-the-loop AI is not a transitional phase you graduate out of. For consequential decisions it is the design.
The risk that creeps in quietly
The harder problem is continuous-learning agents. An agent that updates its behaviour from new data is appealing, and it also drifts. What it does in March may not be what it did in January, and if you are retaining every interaction to train on, you have built a data-retention and governance exposure that legal will eventually find. In a regulated setting, an agent whose decision logic you cannot reconstruct after the fact is a liability, however well it performs in aggregate.
So we treat the agent’s autonomy as something you grant deliberately and constrain at the architecture level. Four guardrails do most of the work:
- Scoped tools. The agent can call only the functions it needs. A triage agent has no path to move money. Capability is bounded by what you wire in, not by what you ask it not to do.
- Logged actions. Every tool call and every output is recorded with its inputs, so you can replay any decision and produce an audit trail when someone asks how a particular outcome happened.
- A human approval step on anything irreversible or client-facing, placed at the exact point where cost crosses your threshold.
- Monitoring for silent failure. The dangerous failure mode is not the agent that errors out, it is the one that keeps returning confident, wrong answers. We hold an eval set the agent runs against on a schedule, so drift shows up as a falling number rather than a surprise at quarter-end.
Where this leaves you
AI agents in financial services are genuinely useful, and the teams getting value from them are not the ones with the most autonomous systems. They are the ones who drew a clear line: agents do the gathering, drafting and sorting at speed, and people keep their hands on the decisions that cost real money. Scope the tools, log the actions, put the approval where the risk is, and watch for the failure that doesn’t announce itself.
If you are scoping an agentic project and the plan is “let the agent handle the whole process,” that is the part worth a second look before anything ships.