Banks Wield Frontier AI as Regulators Rethink Rules

Financial institutions are escalating their cyber defenses by embracing the latest "frontier" AI models. In a notable move, U.S.-based fintech giant FIS (Fidelity National Information Services) extended its partnership with AI lab Anthropic to deploy its most advanced large language model, known as "Mythos 5," as a cybersecurity co-pilot within FIS’s core payment systems ([1]). FIS’s technology underpins critical banking infrastructure – routing payments, managing core banking software, and serving thousands of financial institutions worldwide ([2]). By inserting an AI of unprecedented sophistication into its security architecture, FIS aims to detect threats across this vast footprint with speed and scale beyond human capability.

This initiative reflects an emerging AI arms race in cybersecurity. Sophisticated criminal groups are already exploiting AI to supercharge phishing attacks and probe for system vulnerabilities faster than any human team can ([3]). Traditional defenses like rule-based scanners and firewalls struggle to keep up ([4]). By tapping a frontier AI model, FIS is effectively enlisting machine-speed pattern recognition and autonomous threat hunting to protect the very "brains" of global finance. The decision is bold, but logical ([5]): with payments and core banking systems forming the backbone of the financial system, an AI-driven breach at an FIS platform could propagate across thousands of banks in one blow.

Notably, this deployment is happening under controlled conditions. Anthropic’s “Project Glasswing” limits access to its powerful Mythos 5 model to a select group of key infrastructure players ([6]) ([7]). Rather than releasing its most potent AI widely, the lab is partnering only with systemically important firms like FIS to apply the technology in a safe, governed manner ([8]). For bank executives, the takeaway is twofold: cutting-edge AI can dramatically strengthen defense-in-depth, but proper governance and trusted partnerships are essential. Even global regulators are paying close attention. The Basel Committee on Banking Supervision recently warned that frontier AI will transform both sides of the cyber battlefield – helping banks identify vulnerabilities and fortify systems, but also enabling faster, more disruptive attacks by adversaries ([9]). In short, staying ahead in security may require embracing top-tier AI, yet doing so responsibly in concert with industry partners and watchdogs.

A surge in generative and agentic AI is forcing banks to rethink how they guard sensitive information. A new analysis by RegTech firm ACA notes that traditional information barriers designed to prevent the spread of insider data may falter when faced with AI’s ability to access and analyze data at machine speed ([1]). An AI system can quickly trawl through vast internal data stores or communications, potentially piecing together non-public, market-moving insights that would normally remain siloed. As a result, financial institutions are confronting a worrisome question: are their existing market abuse and insider trading controls sufficient in the age of ChatGPT-like AI?

Examples of AI’s accelerating impact on information leakage are already apparent. While AI doesn’t redefine what constitutes "inside information" under laws like the UK’s Market Abuse Regulation, it can dramatically accelerate how fast restricted data is aggregated and disseminated ([2]). For instance, a document once safely locked in a confidential deal folder might now be ingested by an AI assistant and summarized or shared in seconds ([3]). A junior analyst could unwittingly use an AI tool to generate a market report or client memo that incorporates sensitive, non-public details, spreading them beyond approved recipients. In short, AI can act as an amplifier for existing compliance weaknesses ([4]), turning minor control gaps into major reputational or legal risks.

Financial regulators are responding with guidance – and a clear message that AI is no excuse for compliance lapses. In the UK, the Financial Conduct Authority (FCA) recently updated its guidance on controlling inside information, emphasizing robust systems and governance to manage how confidential data is identified, accessed, and disclosed ([5]). Crucially, the FCA has indicated it will not draft separate insider trading rules just for AI; instead, firms must apply existing obligations around oversight, accountability, and risk management to any AI-driven processes ([6]). Across the Atlantic, U.S. regulators are taking a similar stance. The SEC’s 2026 examination priorities explicitly call out supervisory expectations for AI governance and record-keeping, putting investment advisers on notice that their use of AI will face heightened scrutiny ([7]). The bottom line for compliance chiefs is that AI technologies must be woven into firms’ current control frameworks immediately – from stricter limits on which AI tools can touch sensitive data, to new training and audit trails – because regulators’ patience for errors is low.

In an effort to stay ahead of disruptive fintech trends, incumbent institutions are banding together to guide the rise of AI-driven “agentic” payments. The Emerging Payments Association Asia (EPAA) this week launched an AI & Agentic Payments Working Group, with HSBC announced as a founding member alongside major payment networks and tech firms ([1]). Their mission: to develop industry standards and best practices that will make autonomous, AI-initiated commerce safe and scalable across the Asia-Pacific region. This proactive alliance signals that banks and payment providers recognize a coming wave of transactions executed by AI agents on behalf of customers and enterprises – and they want to shape how that ecosystem develops.

Real-world examples of autonomous payments are no longer science fiction – they’re happening now. HSBC and Mastercard recently piloted end-to-end business payments handled entirely by AI agents for corporate clients in Singapore ([2]). And China’s Alipay has already seen its "AI Pay" platform handle more than 120 million fully automated transactions in a single week ([3]) – a staggering demonstration of demand for agent-driven finance. Even Mastercard completed its first live consumer “agentic” payment in Asia earlier this year ([4]). These early experiments underscore both the potential and the urgency: if banks can offload routine transactions to trusted AI, they might unlock new efficiency and customer convenience, but they also face challenges in ensuring security, integration with legacy systems, and maintaining customer trust.

From a strategic perspective, the formation of the EPAA working group is a defensive and offensive play for incumbents. By collaborating on standards, traditional banks and payment giants aim to ensure interoperability and safety, hoping to prevent a Wild West of incompatible or unsafe autonomous payment schemes. It’s also a bid to avoid ceding ground to tech-first entrants: without a coordinated framework, big technology platforms and nimble fintechs could set the norms and pull transaction volume away from banks. Moreover, as AI agents assume tasks once handled by people, firms must consider how roles and skills will shift. Industry observers note that increasingly capable finance-focused AI agents could displace some service providers and even entry-level finance jobs ([5]). Forward-looking banks will use this transition to rethink their operating models – retraining staff for higher-value advisory roles and reorienting their digital strategy – so they remain integral in an AI-driven payments ecosystem.

While firms push into new AI frontiers, regulators are moving to ensure the financial system remains safe and fair in an AI-driven future. The UK’s Financial Conduct Authority this month published the "Mills Review," an independent look ahead at how advanced AI could transform retail financial services by 2030 ([1]). Led by FCA executive director Sheldon Mills, the review – the first of its kind by any financial regulator – identifies four major shifts on the horizon: AI becoming embedded across firms’ operations; consumers increasingly delegating financial decisions to AI-driven tools; intensifying competition from AI-empowered new entrants; and an escalation in fraud and cyber risks enabled by AI ([2]). To prepare, the report makes seven key recommendations for the FCA, from expanding the regulatory perimeter to cover novel AI-based activities, to boosting the regulator’s own AI capabilities (such as a dedicated AI lab), and clarifying accountability when “machines” make decisions on customers’ behalf ([3]). Industry experts have welcomed the FCA’s proactive stance, while also urging vigilance on where to draw regulatory boundaries and how to protect consumers if autonomous finance goes awry ([4]).

Global policymakers are similarly gauging how to balance innovation and risk in financial AI. Regulators in the EU are finalizing an expansive AI Act that will impose stricter governance on high-risk AI use cases including credit, trading, and fraud prevention. In the US, financial supervisors have put firms on notice that AI models will be closely examined under existing rules – for example, the SEC’s guidance for 2026 emphasizes oversight of AI-driven advice and model risk management ([5]). The immediate lesson for C-suite leaders is that a regulatory framework for AI in finance is rapidly taking shape. Banks and fintechs should engage with these policy efforts and invest in strong internal AI governance, auditability, and explainability. Those that proactively align their AI projects with emerging regulatory expectations – and can demonstrate control over their AI models’ decisions – will be best positioned to innovate confidently in the new AI era.