Agentic AI in Banking: The Login Is No Longer the Relationship. The Permission Is.
CCO Managing Partner
HSBC launched HSBCnio on 29 September. A corporate client can now bring cash positions, transactions, FX and payment tracking into the tools where the treasurer already works. The sharper part is not the new interface. It is the door behind it. Authorised account and transaction data can be queried by the client’s own AI tools through the bank’s Model Context Protocol, alongside APIs and developer tooling. “Ask HSBC” is still to come. Availability will vary by market and client. The direction will not.
I spent long enough inside a bank to know what the old front door felt like. The client came to us. The portal, the relationship manager, the pack. If the welcome was slow, the relationship started on the back foot. If the pack was thick, we called it service. The client had nowhere else to assemble the picture. That assumption is gone. A treasurer can already ask a model to summarise a position. An advisor’s client can already arrive at a meeting with a brief of their own. Anthropic launched Claude for Financial Advisors in September, connecting it to custodians, planning tools and platforms including BlackRock, Charles Schwab and Addepar. OpenAI had introduced ChatGPT for Financial Services only days earlier, aimed at financial research, modelling and client materials.
HSBC did not invent the client’s agent. It gave that agent a key. The relationship is increasingly won inside someone else’s workflow. Permission, not the login, becomes the product.
What Actually Moved
Three things are changing, and only one of them is technical. The interface moved. Cash, FX and payments no longer have to be read on the bank’s screen. They can be consumed where the client already makes decisions.
The buyer moved. The person choosing the AI tool is often not the person who signed the banking mandate. It may be a treasurer, a family office or a CFO. They will give access to the tool that is already part of their working day, not necessarily to the portal they open twice a month.
And the control moved. Someone has to decide which agent may see live balances, which fields are in scope, which legal entity the permission applies to and who can revoke it. That is both a treasury control and a bank control. A sandbox does not answer those questions.
Cambridge’s 2026 Global AI in Financial Services report shows how quickly this is moving. 52% of surveyed financial-services firms are already actively adopting Agentic AI. 23% are at the scaling or transforming stage, while another 29% are still piloting. Accenture points in the same direction. 57% of business leaders expect agentic commerce to become mainstream within three years. At the same time, 76% of financial institutions say they still have work to do before they can enable smart money.
The interface is moving faster than the control framework behind it.
The Pack Is No Longer Scarce
This is the same pressure I keep seeing in private banking, viewed from the other side of the glass. General knowledge is cheap. A client can produce a coherent view of a portfolio, a rate move or a cash position before anyone at the bank has opened the file. If the institution is still selling that view as the valuable part of the relationship, the fee discussion has already started.
Cost and convenience matter. They are also the easiest things for the client’s own tool to reproduce. What does not travel so easily is the burden of making the answer reliable: one definition of the client, one authoritative balance, a file that still adds up after two agents have read it and a person who can explain the conclusion without opening the prompt history.
That is the part incumbents should compete on: not access to information itself, but confidence that the information still means the same thing when it leaves the bank. Nordea made the board-level version of this point recently: AI is not the strategy. The business is.
HSBC has effectively chosen a side in that argument. It would rather become the permissioned source inside the client’s software than defend a portal the client increasingly has less reason to open. That is a grown-up choice. It is also a bet that the data leaving the building still means one thing.
Where Banks Are Actually Spending
The 2026 Evident AI Index is a useful reality check. JPMorganChase ranks first for the fifth edition, followed by Capital One and Royal Bank of Canada. Wells Fargo is fifth. UBS, in sixth place, is the only European bank in the top ten. HSBC sits just outside it at number eleven.
More interesting than the ranking is the pace. Across the 50 banks, AI deployment accelerated nearly three times faster than the average pace of the previous three years. Yet only 12 banks report a realised or projected return across their AI activities.
The hiring tells the same story in plainer language. AI-related job postings at major banks rose 49% this year to almost 140,000. Mentions of agent orchestration rose from 108 in 2025 to 1,967 in 2026. Responsible AI, governance and risk-management skills are rising alongside them. Those are not simply jobs for people who build models. Banks increasingly need people who can put agents into real workflows, decide what they may access and define where a human has to step back in.
JPMorgan has already talked publicly about moving from agents that work autonomously for two or three minutes to agents that can run for an hour or two. That changes the control question considerably. US regulators have made that gap unusually visible. The revised 2026 model-risk guidance explicitly leaves generative and agentic AI outside its scope because these systems remain novel and rapidly evolving. Banks are still expected to apply appropriate governance and controls, but the handoff is theirs to design. A ranking will not do that for them.
What I Would Not Copy
I would not copy the press release. A new channel with an MCP badge is easy to announce and much harder to stand behind.
I would not start with the simple case that finishes before lunch. The real test is the treasurer with several entities, several banks and an agent that has already formed a view. If your data and another bank’s data describe the same exposure differently, the client’s model will have to bridge the gap. And it will probably do so fluently.
I would not measure logins either. The client’s agent does not log in. It asks. The useful question is whether the answer it received was the authorised one and whether someone at the bank can still explain that answer a year later.
And I would not treat this as a corporate-banking specialty. Private banking may be one product cycle behind, but it is not a different industry. Clients who already arrive at meetings with their own brief will eventually arrive with an agent that has read the custody file. A relationship manager who only brings the pack will face the same question professional-services firms already know well: what exactly am I paying you for?
The Decisions I Would Make Before the Next Connector
Five decisions come before another integration. First, name the authoritative objects. Cash position, client, exposure, transaction. If two systems disagree, the client’s agent will not know which version is the polite one. It will choose one.
Second, define the permission rather than the portal. Which agent? Which fields? Which legal entity? Who can revoke access on the same day? That needs to be a control that both a treasurer and a CRO can understand.
Third, keep a person on the conclusion. Assembly can move. A payment, a credit view or a Source of Wealth conclusion still needs an owner. An agent that runs for an hour is not simply a chatbot with a longer timer. It is a process capable of moving a long way without anyone watching every step.
Fourth, compete on the burden the client does not want to carry: consistency, auditability and one reliable story across accounts and systems. That is trust an incumbent can still charge for. A nicer login is not.
And fifth, put the business problem before the model. Nordea is right on this one. The board question is not whether the bank has an AI strategy. It is which client outcome is allowed to move and who owns it when the agent’s answer leaves the building.
The banks that get this right may actually look quieter from the outside. Fewer portals. Fewer pilots. A client who opens the banking app less often but relies more heavily on the bank because the permissioned picture is the one their own systems trust. The others will keep renovating the front door. The client has already found another way in.
If you are looking at how Agentic AI, MCP and permissioned data access could change the way clients interact with your bank, book a 30-minute exploration call with us. We can look at one concrete client workflow, identify which information should become safely accessible outside the traditional portal and define where permissions, governance and human ownership need to remain explicit.