AI in banking: what banks actually use it for in 2026.

What is AI in banking?

AI in banking means three overlapping generations of technology: rules and machine-learning models that score fraud, credit and AML risk (in production at most large banks for a decade); generative AI, meaning large language models that draft, summarise, search and answer for employees and customers (in production at 99 of the 140 banks profiled here); and agentic AI, software agents that carry out multi-step processes with a human approving the result (in production at a minority, led by Huntington, Santander, JPMorgan and American Express).

The first generation is what banks have called “models” since the 2011 model-risk guidance: logistic regressions, gradient-boosted trees and neural networks that score a card transaction for fraud in milliseconds, rank a loan application, flag a suspicious wire or predict which customer will leave. They are narrow, trained on the bank's own history and, under SR 26-2, inventoried, validated and monitored like any other model. 90 of the 140 banks here run this kind of AI for fraud in production and 56 for credit; the vendors are the fraud and decisioning platforms in the AI tools directory.

The second generation arrived in 2023 with large language models. Banks did not retrain them; they built a platform layer that routes employee prompts to models from OpenAI, Anthropic and Google with the bank's data and controls around them: JPMorgan's LLM Suite, Citi Stylus Workspaces, Goldman's GS AI Assistant, BNY's Eliza, Morgan Stanley's advisor assistants. The work is drafting, summarising calls and documents, searching policies, reviewing code and answering customers in natural language. The April 2026 US model-risk guidance says generative AI is “not within the scope of this guidance” and belongs to broader risk governance, which is why AI governance is now the single most common AI activity on the record.

The third generation, agentic AI, is a language model given tools and a goal: read the mortgage file, pull the data, run the checks, draft the decision, and stop for a human before anything leaves the bank. It is the newest and the one bank CEOs are most cautious about in public. The banks below record agents in production rather than in a lab; the agentic banking section and AI agents in banking go deeper.

The adoption path is the same at almost every bank on the record, and it explains why the generations coexist. A bank starts with the models it already had, adds an enterprise assistant for employees (the vendor most often named is Microsoft Copilot, then a bank-built layer over OpenAI, Anthropic or Google models), measures adoption and hours saved for a year, and only then wires a model to its systems as an agent with a human sign-off. The dates in the table are the earliest sourced event on each bank's timeline for that activity, which is why the agentic rows cluster in 2026: the employee-assistant rows on the same pages cluster in 2024 and the fraud-model rows reach back a decade.

Which banks use AI the most?

On the public record, the fifteen US banks that lead on AI are BofA, TD, Amex, Citi, BNY and ten more scored by this site's disclosure index; 15 of the fifteen have a named platform or assistant. Evident's capability ranking puts JPMorgan Chase first and Capital One second among the 50 largest banks worldwide (October 2025).

The score is this site's AI disclosure index: each of the 120 largest US banks ranked by percentile on independent press coverage (45 percent of the weight), use cases in production, a named platform, its own primary disclosures, dated moves in the last twelve months, disclosed numbers, named leaders and use cases described. It measures what is on the public record, not capability, which is why JPMorgan, the largest programme by budget, sits below banks that describe more systems by name. Each bank links to its profile, where every row is sourced.

Outside the US set, the global groups profiled here with the deepest records are DBS (more than 2,000 models across more than 430 use cases), HSBC (over 600 AI use cases in operation, 31,000 engineers on coding assistants), Commonwealth Bank (customer fraud losses down more than 20 percent year on year), Santander and Lloyds; their pages carry the same sourced tables.

What are banks using AI for?

Across 140 banks, the most common production use cases are AI governance (105 banks), third-party AI (100), model risk management of AI (105), generative and agentic AI (99), fraud detection (90), cybersecurity (80), customer chatbots (76) and credit underwriting (56).

The table counts distinct banks, each once at its strongest status, across all 140 profiles (the 120 largest US banks and 20 global groups). A bank appears under a use case only when its page records a named activity with a source; the example is the largest bank at the strongest status. Each use case links to the page that goes deeper on it.

Two reading notes. First, “AI governance” leads because it is a precondition: a bank that has disclosed an AI committee, a chief AI officer, a usage policy or model-data controls is counted here, and after the 2026 guidance pushed generative AI out of formal model risk, almost every large bank did. Second, the counts understate adoption in the categories where banks say least: fair lending shows 8 banks not because the law does not apply but because few describe their fairness testing publicly. By line of business, the same records are cut by line of business on retail banking, corporate banking, investment banking, customer service, customer segmentation, conversational AI, KYC and treasury, with the full catalogue at AI use cases in banking.

What results do banks report?

Banks report usage first (Erica 3.6 billion interactions, Fargo more than 1 billion, Citi 65 million AI tool interactions), then hours (Citi about 100,000 engineering hours a week freed by AI code review, Truist 36,000 teammate hours in a quarter, NatWest 70,000 hours a year), then process time (TD mortgage pre-adjudication from 15 hours to under 3 minutes, Citizens mobile call volume down 44 percent), and only then money (Lloyds about £2 billion of gross savings by 2030, Santander more than EUR 1 billion a year of AI value by 2028).

These are the banks' own figures as reported, with the date and the source, chosen to show the range of what gets measured: usage, adoption, hours, process time, cost. They are not comparable with each other (a “use case” at one bank is a product at another), and almost none is audited. The bank pages hold every disclosed number for each bank, including the ones that cut the other way, such as JPMorgan's CFO saying in October 2026 that AI gains are not yet visible in quarterly results.

How to read a bank's AI claim: look for the denominator and the date. “150,000 weekly users” is a share of about 300,000 employees; “100,000 engineering hours a week” is capacity freed, not headcount cut; a “use case” count rises when the inventory is reorganised. The strongest figures here are the ones a bank repeats in a filing or an earnings call quarter after quarter (Erica interactions, Fargo interactions, Truist Insights, Citi AI interactions), because they are measured the same way each time and the trend is public. The weakest are one-off productivity percentages from a pilot, which is why the table names the source for each row rather than averaging them into an industry number.

What do regulators say?

US regulators govern AI models through the April 2026 interagency model risk guidance (SR 26-2 / OCC 2026-13) and leave generative and agentic AI to broader governance; the EU AI Act makes consumer credit scoring high-risk; the ECB requires an AI cyber action plan from every significant bank by 31 October 2026; the PRA's SS1/23, MAS's October 2026 guidelines and the FSB's proposed twelve sound practices set the model-risk and governance baseline elsewhere.

No banking regulator has written a rule that says “AI” in its title and applies to banks alone. What exists is a layer of model-risk guidance that reaches machine learning, a layer of consumer, fair-lending and AML law that applies whatever the technology, the EU's horizontal AI Act, and a growing set of supervisory letters, frameworks and surveys. The eleven documents below are the ones a bank's AI programme is most often examined against; the tracker holds 238 documents from 41 authorities, each with its official link and a plain-language answer to what it requires.

The supervisors' own adoption data agrees with the bank records above. The EBA's September 2025 report found 92 percent of EU banks deploying AI and 55 percent of surveyed banks already using general-purpose or agentic AI in consumer-facing processes. The CFPB's 2023 chatbot spotlight found every top-ten US commercial bank running a chatbot and about 37 percent of the US population using one in 2022. The Bank of England and FCA's fourth AI survey, which closed in July 2026, is the first to ask about agentic AI explicitly, and the FSB's October 2025 monitoring report names third-party dependence on a few hardware, cloud and model suppliers as the vulnerability it watches most closely.

Which vendors do banks use?

The vendors most often named by the banks on this site are enterprise assistants (Microsoft Copilot, 16 banks; ChatGPT Enterprise, 8 banks; Claude, 8 banks; Gemini Enterprise, 6 banks), then fraud, document, conversational and AML platforms; the largest banks build their own platform layer and rent the models.

The pattern on the record is build the platform, rent the models, buy the point solutions. The largest banks own the layer that routes prompts and holds data (LLM Suite, Erica, Eliza, Layer 6, the GS AI Platform) and rent frontier models from OpenAI, Anthropic and Google; everyone else buys an enterprise assistant, and for fraud, AML, documents, lending and conversational AI nearly every bank names a specialist. The table counts, per category of the AI tools directory, the published vendors and the banks of the US set that name one as a customer on the record; vendor pages list each bank customer with its status and source.

A note on what the counts mean: a bank naming a vendor is a disclosure, not a market share. Microsoft Copilot leads the enterprise-assistant count because banks say so in earnings calls and press; a fraud platform with four named bank customers may have forty. The category guides explain what to look for and which tracked rules apply when a bank buys in that category.

What are the risks?

Unauthorised agent actions, wrong answers to customers, deepfake fraud, AI-enabled cyberattacks, biased credit decisions and provider concentration: each named by a bank CEO or a supervisor in the record below, and each the subject of a tracked regulatory document.

Six risks recur in the bank statements and the supervisory documents tracked here. Agents acting beyond their mandate: JPMorgan blocks outside AI agents from operating customer accounts and Bank of America's CEO says agents “just left to operate” is what the bank does not do. Wrong answers to customers: the CFPB holds a bank responsible for what its chatbot says, “regardless of the processes or technologies used”. Deepfake fraud: FinCEN's 2024 alert reports rising SAR filings for AI-generated identity documents, and NY DFS maps deepfake social engineering to Part 500. AI-enabled cyberattacks: the ECB's July 2026 letter says emerging models find vulnerabilities and write exploits at unprecedented speed. Bias: consumer credit scoring is high-risk under the EU AI Act and adverse-action and fair-lending duties apply in the US. Concentration: the FSB tracks dependence on a few model, cloud and chip suppliers as a systemic vulnerability. Risks of AI in banking works through each with the controls banks describe; model risk management and AI governance cover the frameworks.

Who runs AI at banks?

11 banks on this site name a chief AI officer or equivalent on the record, most appointed in 2025 and 2026; elsewhere the programme sits with the chief data and analytics officer, the CIO or, at Huntington, the CFO. Every bank page lists its named AI leaders with sources and, where verified, LinkedIn profiles.