Agentic Banking
A personal AI agent can sit between a client and several banks, compare their products and prepare transactions for approval. The bank keeps the regulated capability, but the interface, the recommendation and the routing decision become contestable. This eight-part series takes that provocation seriously and tests it against architecture, security, liability, regulation and South African realities: what MCP, A2A and AP2 each do, why delegated authority is a permission problem, why a signed mandate is not proof of good judgement, how competition moves product by product, what a machine-readable bank looks like, how the fraud surface grows, and what to build now, pilot next and postpone. One fictional South African bank and its client carry the examples.
8 articles
- Part 1When the bank app becomes optionalA personal AI agent can sit between a client and several banks, compare their products and prepare transactions for approval. Part 1 covers the three layers of a banking relationship, what happens to 'customer ownership', why the agent is not necessarily neutral, what the bank app is still for, and the questions executives should ask now.10 min read
- Part 2MCP, A2A and AP2 are not the same thingThree protocols are often listed together as if they were one agentic-commerce stack. Part 2 explains the job each one does, the boundary it crosses, what it cannot prove, how they fit into a bank's architecture, and the questions a bank should ask before supporting any of them.9 min read
- Part 3One agent, five banks, one permission problemReading balances across banks is a hard integration problem; letting an agent act is harder. Part 3 covers the four capability classes, a reference architecture, the several identities in every agent request, consent that is more than a checkbox, the bank's policy decision point, data semantics, resilience, and a production control matrix.9 min read
- Part 4A signed mandate is not proof of good judgementA cryptographically valid mandate shows what a client approved. It cannot show that the agent understood the client's situation before the approval. Part 4 covers the intent chain, what a human-present approval must show, where delegated authority should start, the liability questions to settle before launch, and the evidence pack that explains how an authorised action was reached.8 min read
- Part 5The bank competes product by productWhen one agent can manage several banking relationships, the primary-bank bundle gets easier to unpick. Part 5 covers what changes in banking economics, why 'best' is never one number, the funding implications as a scenario, agent-mediated requests for offers, and the measures bank leaders will need.10 min read
- Part 6Make the bank machine-readableAn API can return a product list and still leave an agent unable to interpret it. Part 6 covers the three layers of machine-readable banking, the product passport, trust an agent can verify, agent discoverability, separating information from transaction, and why machine-readable does not mean agent-owned.8 min read
- Part 7Agentic banking expands the fraud surfaceTraditional payment security protects credentials, devices and transactions. Agent-mediated banking adds a new target: what the agent believes before the customer approves anything. Part 7 covers the threat map, why a valid signature is one control among many, zero-trust principles for agents, agent-aware fraud signals, a control matrix and the incident playbook.10 min read
- Part 8Agentic banking: a South African roadmapSouth Africa has foundations for agent-mediated banking, not a finished market. The final part covers where the country actually stands, a five-stage sequence from agent-readable information to agent-mediated competition, what to build now, pilot next and postpone, an illustrative 24-month roadmap, the architecture views to keep, and the questions for the board.10 min read
Working through any of this in your own organisation?
These articles come out of delivery work rather than theory. If the problems in this series look familiar, a short scoping conversation is usually the quickest way to work out what is worth doing first.
Talk to CloudNala