Banking and capital markets
Agent pilots in banks and capital markets firms work in the demo and stall in risk review. We build the gateway, the audit trail and the review pack that get them through examination and into production.
A bank or a broker-dealer does not need AI that moves faster than its examiner. It needs AI its examiner can read, and then it needs it quickly.
Where you are
Onboarding, servicing, fraud review, advisor support: somewhere in your organization an assistant already does a job that used to take a person. The platform underneath is settled.
Examination
Supervisors expect you to show how a model reached a decision, who approved it and how it is monitored. Model risk guidance, FINRA's expectations for broker-dealers using generative AI and, in New York, the cybersecurity regulation all reach AI that nobody can explain.
What waiting costs: a finding with your name on the remediation plan, and a pilot that stays a pilot.
Third parties
Fintech partners, vendors and cloud services connect through APIs your compliance team cannot map by hand. Resilience and outsourcing rules ask you to know them all and prove control.
What waiting costs: an outage or a breach at a vendor becomes your conversation with the regulator.
Legacy core
Monolithic cores cannot offer the real-time interfaces that digital products and agents need, and competitors on cloud-native stacks change faster than your release calendar allows.
What waiting costs: a gap customers feel long before your board sees it.
| Who is looking | What they look at | What it means for an agent |
|---|---|---|
| Bank supervisors | Model risk guidance from the OCC and the Federal Reserve. | Models have an inventory, an owner and monitoring. |
| New York DFS | The cybersecurity regulation and its October 2024 guidance on AI risk. | Every agent action can be rebuilt after the fact. |
| Broker-dealers and investment advisers | FINRA's guidance on generative AI and their existing supervision duties. The SEC's amended Regulation S-P: an incident response program, oversight of service providers and notice to customers when their data is exposed. | AI that touches customers or trading is supervised like any other activity. Vendors that handle customer data report incidents to you in time for you to tell customers. |
Reserve Bank of India directions on IT governance, outsourcing and digital lending, and the RBI FREE-AI framework of August 2025. For an agent: a named owner for each AI use, board-level policy, an audit trail, and testing for explainability and bias where customers are affected.
The Digital Operational Resilience Act, applied since January 2025. For an agent: it and the APIs it calls sit inside the ICT risk register, and its incidents are reportable.
The Monetary Authority of Singapore, the Central Bank of the UAE and the Bangko Sentral ng Pilipinas each set their own technology risk expectations. The questions are the same and the filings differ; we confirm the local rulebook at the start of every engagement.
What is in the way
The distance between a pilot and a system your risk, audit and operations teams will accept is made of gateways, audit trails, data access and ownership. The review asks questions a pilot was never built to answer.
If your examiner asked for one decision, its log and its owner by Friday, what would you hand them?
Two pilots meet the same four questions
The examiner asks for one decision
Without
Six places to search. No single answer.
With
One record. Every field present.
How we clear it
The institutions that get one governed agent into live use learn from real work while others rewrite a pilot for review.
The examiner asks for one decision
Without a decision log
Six places to search, and nobody owns the answer.
With a decision log
One record, ready before the examiner asks.
We put Apigee in front of your estate and design the policies, quotas and logging first.
You hold: a governed API layer with an inventory, an owner for every endpoint and policy your examiner can read.
Apigee and APIsWe build agents on Gemini Enterprise and the Agent Development Kit that work inside the controls your risk team has already set.
You hold: one agent in production, in onboarding, servicing or fraud review, with review gates built in and a decision log that rebuilds any action.
Gemini Enterprise and agentsWe write the pack model risk and internal audit will ask for: control descriptions, test results, ownership and a sample decision log.
You hold: a review pack you can hand over without a rewrite.
Security and responsible AIEasy to start
Choose one workflow, name one owner, and give us time with the people who sign it off.
We bring engineers and the gateway design, we work inside your environment under your security rules, and we write the review pack alongside the build.
A good first workflow for a bank is onboarding checks or a servicing assistant. For a capital markets firm it is client onboarding or an advisor assistant with supervision built in. See the fixed-price ways to start.
What the work feels like
One workflow is chosen and one person owns it. The questions your reviewers will ask are written down before any build starts. Your second line sees the controls in the first week, not at the end.
Governance goes in before the first agent does: the gateway, the audit trail and the access rules. Your risk team sees them working.
A working demo you can show your own review board, not a status slide.
A decision log that can rebuild any action, and a go-live date that was agreed at the start.
Seen it before
Production readiness check
A short readiness check on a live or planned agent workflow. You get a score and the principles worth another look.
Take the readiness checkOur delivery is built on Google Cloud, so the design assumes Apigee, Gemini Enterprise, Vertex AI and BigQuery. If your estate runs another gateway today, we begin with an assessment of what to keep and what to move.
In your environment, under your keys and perimeter. Agents read governed data in place instead of copies of it.
Yes. We ask for them in the first week and write the review pack with them.
Yes. Supervision and recordkeeping come first there, so the agent's inputs, outputs and approvals are kept as records your compliance team can review.
The ones in your market. The table above lists the main ones, and we confirm the local rulebook at the start.
One workflow, one owner, a short assessment, then a build with a working demo every week.
Tell us what you are working on. Our Customer Partnership Team will reply to arrange a conversation.
Get answers to your questions
AI assistant. It can make mistakes, so check anything important with our team.
