Financial services and insurance
Agent pilots in Philippine banks, digital banks, e-money issuers and insurers work in the demo and stall in risk review. We build the gateway, the audit trail and the review pack that get them through BSP examination and into production.
A bank or an insurer does not need AI that moves faster than its examiner. It needs AI its examiner can read, and then it needs it quickly.
Where you are
Claims triage, onboarding, servicing, fraud review: somewhere in your organization an assistant already does a job that used to take a person. The platform underneath is settled.
Supervision
The BSP's rules on IT risk management and on information security ask for a board-approved framework, an inventory of what you run and controls proportionate to risk. An agent outside that framework is the first thing an examiner will find.
What waiting costs: an examination finding, and a pilot that stays a pilot.
Open finance
The BSP's Open Finance Framework sets out consent-based sharing of customer data through APIs with other institutions and fintechs. Partners will build first with the banks whose APIs are governed, documented and ready.
What waiting costs: the ecosystem forms around someone else's bank.
Fraud and customers
The Anti-Financial Account Scamming Act and the Financial Products and Services Consumer Protection Act expect fraud management systems and fair treatment of customers, and the National Privacy Commission's rules put a deadline on breach notice.
What waiting costs: liability for scams your controls should have caught, and a notice to the National Privacy Commission.
| Regulator or law | What it asks | What it means for an agent |
|---|---|---|
| BSP, IT risk management rules (Circular 808, 2013, as amended) and information security rules (Circular 982, 2017) | A board-approved IT risk framework, an inventory of IT assets and services, information security and cyber controls, and oversight of outsourced technology. | Every agent and every API it calls sits in the IT inventory with an owner, and third-party AI services are governed as outsourced technology. |
| BSP, technology and cyber-risk reporting and notification (Circular 1019, 2018) | Prompt notification to the BSP of major cyber incidents and disruptions, and regular reporting on technology risk. | Agent actions are logged so a notification can say what happened, through which interface and when. |
| BSP, Open Finance Framework (Circular 1122, 2021) | Consent-based, secure sharing of customer data among participating institutions through APIs. | The agent and every partner call carry a consent reference, and the gateway stops anything outside it. |
| Anti-Financial Account Scamming Act (Republic Act 12010, 2024) | Fraud management systems and safeguards against account takeover and social engineering, with BSP powers to examine accounts. | Agents that touch accounts sit behind fraud controls and step-up checks, and hand anything unusual to a person. |
| Insurance Commission | Supervision of insurers, pre-need companies and HMOs, including how they handle policyholder data and claims. | Claims and underwriting agents keep the same audit trail and review gates a BSP-supervised bank would. |
| SEC Philippines, rules for lending and financing companies (Memorandum Circulars 18 and 19, series of 2019) | Registration of online lending platforms and a ban on unfair debt collection practices. | A collections or lending agent stays inside the permitted contact rules, and every message it sends is on the record. |
| Data Privacy Act of 2012 and the National Privacy Commission | Lawful processing, transparency and data subject rights; breach notice to the Commission within 72 hours; guidance on AI systems (2024). | Agents use personal data only for a stated purpose, explain automated decisions where required, and support a 72-hour breach notice. |
What is in the way
The distance between a pilot and a system your risk, audit and operations teams will accept is made of gateways, audit trails, data access and ownership. The review asks questions a pilot was never built to answer.
If your examiner asked for one decision, its log and its owner by Friday, what would you hand them?
The examiner asks for one decision
Without
Six places to search. No single answer.
With
One record. Every field present.
How we clear it
The institutions that get one governed agent into live use learn from real work while others rewrite a pilot for review.
We put Apigee in front of your estate and design the policies, quotas and logging first.
You hold: a governed API layer with an inventory, an owner for every endpoint and policy your examiner can read.
Apigee and APIsWe build agents on Gemini Enterprise and the Agent Development Kit that work inside the controls your risk team has already set.
You hold: one agent in production, in claims, onboarding or servicing, with review gates built in and a decision log that rebuilds any action.
Gemini Enterprise and agentsWe write the pack model risk and internal audit will ask for: control descriptions, test results, ownership and a sample decision log.
You hold: a review pack you can hand over without a rewrite.
Security and responsible AIEasy to start
Choose one workflow, name one owner, and give us time with the people who sign it off.
We bring engineers and the gateway design, we work inside your environment under your security rules, and we write the review pack alongside the build.
A good first workflow for a bank is one open finance API or a servicing assistant. For an insurer it is claims intake. See the fixed-price ways to start.
What the work feels like
One workflow is chosen and one person owns it. The questions your reviewers will ask are written down before any build starts. Your second line sees the controls in the first week, not at the end.
Governance goes in before the first agent does: the gateway, the audit trail and the access rules. Your risk team sees them working.
A working demo you can show your own review board, not a status slide.
A decision log that can rebuild any action, and a go-live date that was agreed at the start.
Seen it before
Production readiness check
A short readiness check on a live or planned agent workflow. You get a score and the principles worth another look.
Take the readiness checkOur delivery is built on Google Cloud, so the design assumes Apigee, Gemini Enterprise, Vertex AI and BigQuery. If your estate runs another gateway today, we begin with an assessment of what to keep and what to move.
In your environment, under your keys and perimeter. Agents read governed data in place instead of copies of it.
Yes. We ask for them in the first week and write the review pack with them.
The ones in your market. The table above lists the main ones, and we confirm the local rulebook at the start.
One workflow, one owner, a short assessment, then a build with a working demo every week.
For banks, digital banks and e-money issuers, the Bangko Sentral ng Pilipinas, through its rules on IT risk, information security, cyber incident reporting and open finance. Insurers answer to the Insurance Commission, lenders and financing companies to the SEC, and every firm to the Data Privacy Act. We confirm the exact set for your license at the start.
Yes, with a lawful basis, a stated purpose and transparency to the customer. The National Privacy Commission's 2024 guidance on AI systems adds expectations on accountability and explaining automated decisions, and we design the decision log to meet them.
Tell us what you are working on. Our Customer Partnership Team will reply to arrange a conversation.
Get answers to your questions
AI assistant. It can make mistakes, so check anything important with our team.
