AI use cases in banking: 13 use cases with the banks that run them (2026).

What are the AI use cases in banking?

The 140 bank profiles on this site record AI activity under thirteen use cases. By number of banks: ai governance (general) (128), third-party & vendor ai (123), generative & agentic ai (120), model risk management (116), fraud detection (107), cybersecurity (100). 105 banks run the most common one in production; across all thirteen the profiles hold 850 bank-level production records.

The table counts every bank once per use case at its strongest status. A bank is “in production” when it or a named vendor says the activity is live; “rolling out”, “pilot” and “announced” are the bank's own words or the nearest fit. The example column is the largest bank at the strongest status; the use-case link goes to the spoke page that works through that use case in full. The AI in banking pillar explains the three generations of AI behind these counts and the AI disclosure index ranks the US banks on their whole record.

Two reading notes. Governance, third-party AI and generative AI lead because they are preconditions and platforms rather than products: a bank that has an AI committee, a model vendor and an employee assistant is counted in all three before it has shipped anything to a customer. The operational use cases with customer-visible results are fraud, AML/KYC, credit, assistants and, from 2026, agents; those are the sections with the most numbers below. Fair lending shows 8 banks not because the law does not apply but because few banks describe their fairness testing in public.

How do banks use AI for fraud detection?

AI fraud detection means machine-learning models that score card transactions, logins, payments and account applications in real time, block or step up the anomalous ones and route the rest to investigators; behavioural biometrics and voice analytics add signals about how a customer types, holds the phone or speaks. Bank of America says AI-enabled processes have halved its fraud losses since 2018 and analyses 7 million person-to-person payments for fraud; Simmons Bank cut mobile-deposit fraud losses by 96% with scoring; HSBC's Google-built AML system screens about 980 million transactions a month with 60% fewer false positives.

Fraud is the oldest production use of machine learning in banking: a model scores every card transaction, login, payment and new-account application in milliseconds against the customer's own history and the bank's fraud patterns, and the score decides whether the event goes through, gets a step-up check or lands with an investigator. The newer layers are behavioural biometrics (how a user types, scrolls and holds the phone, sold by BioCatch to Bank of America and Wells Fargo), voice and deepfake detection in the call centre (Pindrop at M&T and FNBO) and generative assistants that write up the case for the investigator.

Banks in production. 90 of the 140 banks run this in production on the record, 4 are rolling out, 2 are in pilot and 11 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. Bank of America told investors in November 2025 that AI-enabled processes had cut fraud losses in half since 2018 and that AI analyses 7 million person-to-person payments for fraud. JPMorgan describes machine-learning monitoring across roughly $10 trillion of daily payment flows. At the other end of the size range, Simmons Bank reports a 96% fall in fraud losses, to under one basis point, after scoring mobile deposits, and United Community attributes part of a 50% two-year fall in fraud losses to its vendors' AI. Western Alliance's settlement-payments unit says its fraud stack prevented more than 723 million fraudulent class-action claims in 2024.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. Socure, NICE Actimize and BioCatch lead the fraud detection category by named bank customers; Feedzai, Pindrop and Alloy follow. Named most often by the banks here: Socure (4 banks), NICE Actimize (4 banks), BioCatch (3 banks), Alloy (3 banks).

How do banks use AI for AML and KYC?

In anti-money-laundering and know-your-customer work, AI reads identity documents, screens names against sanctions and watchlists with entity resolution, rates customer risk, triages transaction-monitoring alerts and drafts investigation narratives. JPMorgan's KYC unit cost is down 40% since 2022; BMO cut adverse-media searches from about 180 minutes to 20 and false AML alerts by about 10%; FNBO's investigators spend half the time per financial-crime case with Nasdaq Verafin agents; KeyBank's generative AI does AML screening in 15 to 20 minutes against several hours by hand.

AML and KYC are one programme in US law and two jobs in practice. At the front gate, models capture and authenticate documents, match a face with liveness, screen names against sanctions and watchlists and rate the customer's risk; afterwards, transaction-monitoring models score what the account does, triage the alerts and, since 2025, draft the investigator's narrative. The detailed walk-through is on the AI for KYC and AI in AML pages; the table here lists the largest banks with a production record.

Banks in production. 33 of the 140 banks run this in production on the record, 7 are rolling out, 3 are in pilot and 10 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. JPMorgan put its KYC unit cost 40% below 2022 at its May 2025 investor day and says AI models in Payments cut manual exceptions by more than half. BMO reports about 10% fewer false AML alerts and adverse-media searches cut from about 180 minutes to 20. FNBO, with 15 financial-crime investigators and analysts, halved investigator time per case with Nasdaq Verafin's agents and brought an enhanced-due-diligence case from about 30 minutes to about 15. Scotiabank's Tangerine AML pilot cut existing alert volumes by 37%.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. NICE Actimize, Alloy and Quantexa lead the AML compliance category; HSBC built its Dynamic Risk Assessment with Google Cloud rather than buying a package. Named most often by the banks here: NICE Actimize (4 banks), Alloy (3 banks), Quantexa (2 banks), Feedzai (2 banks).

How do banks use AI in credit underwriting?

AI in underwriting ranges from gradient-boosted scoring models that replace or sit beside the scorecard to document AI that reads pay slips and bank statements and, since 2026, agents that assemble a mortgage file. Citi says new AI models raised US Cards approval rates by 100 basis points; Synchrony approved nearly 50,000 customers in 2025 through cash-flow underwriting who would otherwise have been declined; First Hawaiian automated 55% of credit-card decisions with a Zest AI model, from 4%; TD's agentic pre-adjudication takes a mortgage from an average of 15 hours to under three minutes.

Three different things are called AI underwriting. The first is a machine-learning credit model that scores an application on more variables than a scorecard and, under ECOA, must still produce the principal reasons for a decline. The second is document AI that reads the pay slips, statements and tax forms in a file and extracts the numbers an analyst used to key in. The third, from 2026, is an agent that gathers the documents, checks them across systems and presents a decision for a person to sign. The sibling page on AI credit underwriting works through each; the fair-lending constraints are below.

Banks in production. 56 of the 140 banks run this in production on the record, 15 are rolling out, 8 are in pilot and 5 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. Citi said at its May 2026 investor day that new AI models in US Cards raised approval rates by 100 basis points. Synchrony approved nearly 50,000 customers in 2025 through cash-flow underwriting who would otherwise have been declined and expects up to 150,000 in 2026. First Hawaiian's Zest AI model, by the vendor's account, lifted automated credit-card decisions from 4% to 55% of applications and instant approvals from 4% to 40%. In mortgages, TD's agentic pre-adjudication cut the step from an average of 15 hours to under three minutes, and KeyBank says analyst research time in commercial loan approvals fell from 60% to 25% of the process.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. FICO, Zest AI and Provenir lead the credit decisioning category; nCino and Blend supply the origination and document layer. Named most often by the banks here: FICO (2 banks), Zest AI (2 banks), Provenir (1 bank), Covecta (1 bank).

How do banks use AI for fair lending?

Fair lending is the least disclosed AI use case on the record: only a handful of banks describe how they test models for disparate treatment or proxy discrimination, even though every US bank with an AI credit model must. Société Générale is the clearest example, running a monthly fairness assessment on an XGBoost model that scores about 10 million retail clients for financial fragility; US banks such as Ameris and Renasant disclose the legal exposure and a standing committee rather than a method.

Fair lending is a constraint on every other credit use case rather than a product of its own: a model that scores, prices or markets credit must not treat protected classes differently or use a proxy for them, and a decline must come with the principal reasons. The AI-specific question is whether a complex model can be explained and tested well enough to prove that. The record on this site shows how little banks say in public about the method: 8 of the banks here record anything at all.

Banks in production. 3 of the 140 banks run this in production on the record, 0 are rolling out, 0 are in pilot and 5 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. Société Générale's Active Shell model uses more than 250 variables and 70 data pipelines to assess about 10 million retail clients each month for financial fragility, with a monthly fairness assessment of its predictions. Among US banks, Ameris's 10-K lists equal-opportunity and fair-lending law among the rules applying to its AI and warns of unwanted bias, and Renasant describes a standing fair-lending committee that includes the chief risk and chief compliance officers. The enforcement precedent is a non-bank: the Massachusetts Attorney General's July 2025 settlement with student lender Earnest over its AI-driven underwriting.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. Fairness testing is sold as part of the decisioning stack (Zest AI, FICO) and of the governance tools in the model risk and AI governance category. Named most often by the banks here: FICO (2 banks), Zest AI (2 banks), Provenir (1 bank), Covecta (1 bank).

How do banks use AI chatbots and virtual assistants?

Customer-facing AI covers the assistants in the app (Bank of America's Erica, with 3.6 billion cumulative interactions; Wells Fargo's Fargo, past 1 billion in under three years), the voice and chat bots that answer routine calls, the assistants that help contact-centre staff and the personalisation engines that push insights. Citizens says its CiZi assistant cut call volume by 44%; KeyBank puts an AI-handled call at about $0.25 against about $9 for a human; ING's chatbots resolved 75% of chats without a person in 2025, up from 46% in 2023.

This is the use case customers see. It has four parts on the record: a named assistant in the app that answers questions and, increasingly, completes tasks; a voice or chat bot that takes routine calls; an agent-assist layer that summarises calls and finds the policy for the person on the phone; and a personalisation engine that decides which insight or offer to show. The site splits these across conversational AI, customer service and customer segmentation; the table here shows the largest banks with a production assistant.

Banks in production. 76 of the 140 banks run this in production on the record, 11 are rolling out, 2 are in pilot and 6 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. Bank of America's Erica, launched in 2018, had 3.6 billion cumulative interactions by October 2026 and runs at 2 million a day; EricaAssist, the same technology on about 18,000 customer-service desktops, tells the agent why the customer is calling and takes almost a minute off the average call. Wells Fargo's Fargo passed 1 billion interactions in under three years, more than 160 million of them with Spanish-speaking customers. Citizens' CiZi cut mobile-banking call volume by 44%, and KeyBank's CEO put the cost of an AI-handled call at roughly $0.25 against $9 for a human one.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. Personetics, Glia and Talkdesk lead the conversational AI category; the largest banks build on cloud platforms (Google for Fargo, IBM watsonx for NatWest's Cora+, Amazon Connect at U.S. Bank). Named most often by the banks here: Personetics (5 banks), Glia (4 banks), Talkdesk (3 banks), Backbase (1 bank).

How do banks use generative and agentic AI?

Generative AI at banks is an employee platform first: JPMorgan's LLM Suite, Citi's Stylus Workspaces (65 million-plus interactions since December 2024), Goldman's GS AI Assistant for all 46,000 employees, BNY's Eliza, Morgan Stanley's advisor assistants at 98% adoption. Agentic AI, a model given tools and a goal, is in production for narrower jobs: Huntington runs 50 agents, BNY's contract-review agent cut legal review of vendor agreements from four hours to one, Morgan Stanley's FIXR agents reconcile end-of-day P&L, TD's collections agent lifted the connect rate from about 6-7% to 20-25%.

Generative AI entered banks in 2023 as a platform layer that routes employee prompts to models from OpenAI, Anthropic and Google with the bank's data and controls around them; the work is drafting, summarising, searching policies and reviewing code. Agentic AI is the next step: the model is given tools and a goal, works through the steps and stops for a human before anything leaves the bank. 120 of the banks here record one or the other, which makes it the third most common use case; the AI agents in banking spoke and the agentic banking section go deeper.

Banks in production. 99 of the 140 banks run this in production on the record, 11 are rolling out, 2 are in pilot and 8 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. BNY's Eliza platform has more than half of employees building agents and about 140 digital employees on repetitive tasks; one agent cut legal review of vendor agreements from four hours to one across more than 3,000 agreements a year. Huntington runs 50 agents in production with 60-plus in development, about 15 new a month, on work from regulatory reporting to servicing exceptions. TD's first collections agent reaches 20% to 25% of customers behind on payments against about 6% to 7% with human callers. Morgan Stanley's FIXR agents reconcile end-of-day P&L across finance, risk, operations and trade-capture systems.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. Microsoft Copilot, ChatGPT Enterprise and Claude lead the enterprise AI assistants category by named bank customers; Gemini Enterprise and Amazon Bedrock follow. Named most often by the banks here: Microsoft Copilot (16 banks), ChatGPT Enterprise (8 banks), Claude (8 banks), Gemini Enterprise (6 banks).

How do banks use AI-generated code and coding agents?

Coding assistants are the generative use case with the hardest numbers. Bank of America has about 20,000 developers on coding agents with a 15% to 20% productivity gain; BNY says more than 60% of its code is built with AI help; Santander reports 40% of code AI-generated across 17,000 users; Citi rolled Cognition's Devin agent out to 40,000 developers with humans approving every change; U.S. Bank's code-review assistant cuts review time by 75%; NatWest put AI-written code at over 40% on its Q1 2026 call.

AI-generated code covers three tools: the in-editor assistant (GitHub Copilot and its peers), the code-review assistant that reads a pull request, and the autonomous coding agent (Cognition's Devin, Claude Code, GitHub's agent) that takes a ticket and returns a tested change. Banks disclose this use case readily because the metric is simple, the customer is internal and the rules are the software-development controls they already have. The build brief on AI-generated code covers the controls.

Banks in production. 48 of the 140 banks run this in production on the record, 3 are rolling out, 1 are in pilot and 4 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. Citi rolled Cognition's Devin out to its 40,000 developers from July 2025 for patches, upgrades and language rewrites; the agents read only internal repositories and a person approves every change. Bank of America has about 20,000 developers on coding agents at a 15% to 20% productivity gain. BNY's share of code written with AI went from more than 40% in Q1 2026 to more than 60% by October. U.S. Bank's generative code-review assistant cuts review time by 75%, and Commonwealth Bank says more than 80% of its 7,800 engineers use coding agents and deliver three times more code changes.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. GitHub Copilot is the most-named tool; Cognition's Devin (Citi, Goldman) and Claude Code (Barclays' target of 50% of developers by end-2026) are the agents banks name. Named most often by the banks here: Microsoft Copilot (16 banks), ChatGPT Enterprise (8 banks), Claude (8 banks), Gemini Enterprise (6 banks).

How do banks use AI in trading and capital markets?

In markets, AI is mostly research and surveillance rather than execution: Morgan Stanley's AskResearchGPT answers a client inquiry in a tenth of the time over 70,000-plus reports; Barclays processes about 120,000 Global Markets emails a day with Claude; RBC's Aiden agents automate earnings content and call summaries for more than 8,000 Capital Markets staff; Deutsche Bank's agentic trade-surveillance system is expected to cut false positives by up to 40%. Bank of America's TED score and Citi's Market Guide bring the same models to clients.

The trading and capital-markets use case has three layers on the record. Research assistants over the bank's own reports and filings (Morgan Stanley, RBC, Deutsche Bank's dbLumina, TD Securities' assistant). Surveillance and oversight models that read communications and trades for conduct risk (Deutsche Bank, Citi's 1,700-plus hours a month of oversight capacity). And client-facing analytics such as Bank of America's TED score for issuance timing and Citi's Market Guide across more than 100 custody markets. Algorithmic execution itself predates the current AI wave and is rarely described as AI by the banks. AI in investment banking covers the front office.

Banks in production. 26 of the 140 banks run this in production on the record, 1 are rolling out, 5 are in pilot and 0 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. Morgan Stanley's AskResearchGPT sits over more than 70,000 research reports and answers a client inquiry in one-tenth of the time it took before. Barclays runs about 120,000 Global Markets emails a day through Claude. RBC says research coverage per analyst rose from 14.5 names in 2024 to over 17.5 by October 2026 with Aiden, targeting 22. Deutsche Bank's executives expect the agentic trade-surveillance system to cut false positives by up to 40% and save up to $5 million a year.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. No specialist category: the banks name frontier-model vendors (OpenAI at Morgan Stanley, Anthropic at Barclays, Google at Deutsche Bank) and build the application themselves.

How do banks use AI in cybersecurity?

Banks use AI on both sides of cyber: to find and patch vulnerabilities (HSBC says coding assistants made patching 10 times faster in 12 months; Capital One open-sourced its VulnHunter agent; Goldman uses Anthropic's restricted Mythos model for vulnerability discovery; Wells Fargo says autonomous agents close previously unknown vulnerabilities) and to defend against AI-enabled attacks, which the ECB's July 2026 letter and the US 10-K risk factors now name explicitly. Commonwealth Bank processes over 400 billion threat signals a week; USAA blocked nearly 8 billion threats in 2025.

Cybersecurity is where the regulators and the banks say the same thing: AI makes attackers faster and defenders must use it too. On the defence side the record shows threat-detection models, AI-assisted vulnerability discovery and patching, agents that scan the estate for exposed data and the deepfake detection that FinCEN asked for. On the risk side, every large bank's 10-K now says AI lets attackers automate attacks and find vulnerabilities faster. The planned risks of AI in banking spoke covers the threat side with the supervisory letters.

Banks in production. 80 of the 140 banks run this in production on the record, 2 are rolling out, 8 are in pilot and 10 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. HSBC says vulnerability patching became 10 times faster in 12 months once about 31,000 engineers had AI coding assistants. Capital One built VulnHunter, an agentic code-security tool with attacker-first analysis, and open-sourced it in July 2026. Goldman Sachs works with Anthropic on cyber risk using the restricted Mythos model. Wells Fargo's CEO says the bank uses AI and, in some cases, autonomous agents to close previously unknown vulnerabilities, and Commonwealth Bank's cyber defence processes over 400 billion threat signals a week, from 80 million six years earlier.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. Cyber tooling is not a category of the directory; the banks name Anthropic (Goldman), Microsoft and in-house builds (Capital One's VulnHunter).

How do banks handle data and privacy in AI?

The data and privacy use case is about what the bank will not let the models do: JPMorgan does not let outside AI agents log in with customer credentials; Goldman's platform checks what staff type into prompts; BNY avoids training on personal data and uses an encrypted walled garden where it must; Schwab's Anthropic connector masks account numbers and retains nothing for training; Huntington scanned and redacted more than 400 million stored documents with machine learning at about 10 million a day; Citizens runs some models inside its own cloud network so nothing leaves the firewall.

Every generative deployment starts with a data decision: which data the model may see, where it runs, whether it may be trained on and who may connect to it. The record shows the controls banks describe rather than a product: prompt filters, data masking, no-training clauses with vendors, models hosted inside the bank's own cloud network and, for the agent era, a refusal to let third-party agents use customer credentials. The documents are privacy and automated-decision law rather than banking rules.

Banks in production. 29 of the 140 banks run this in production on the record, 0 are rolling out, 0 are in pilot and 5 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. Huntington scanned and redacted more than 400 million stored documents with Amazon Textract, SageMaker and Step Functions at about 10 million a day, and will reuse the framework for acquisitions. Schwab's connector to Claude passes masked account numbers, no Social Security numbers or dates of birth, and nothing is retained for training. JPMorgan blocks outside AI agents from logging in with customers' credentials, so they can at most read data through open-banking connectors. Capital One discloses more than 20 trillion tokens and 7,100-plus synthetic conversations behind its generative models and sells its Databolt tokenisation tooling to other enterprises.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. Data tooling is bought from the cloud providers (AWS at Huntington, Azure at BNY) or built; Capital One's Databolt is the one bank-built product sold outward.

How do banks apply model risk management to AI?

Model risk management is the use case the regulators wrote: a machine-learning model is a model under the April 2026 interagency guidance (SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026) and must be inventoried, validated and monitored, while generative and agentic AI sit outside that guidance and under broader governance. The scale is now disclosed: Bank of America has 270 AI and machine-learning models in use, DBS more than 2,000 models across more than 430 use cases, OCBC about 400 models making six million decisions a day, Lloyds 800 models live.

Model risk management decides which AI counts as a model and what the bank must do about it. The April 2026 revision of the US guidance keeps machine-learning models in scope and says generative AI is not within its scope, which moved the generative programmes into enterprise AI governance; the UK's SS1/23 and MAS's 2024 information paper reach the same place by different routes. The model risk management page walks through the frameworks; the table here shows the banks whose filings describe AI inside the model inventory.

Banks in production. 105 of the 140 banks run this in production on the record, 3 are rolling out, 0 are in pilot and 8 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. Bank of America told investors in November 2025 that it has 270 AI and machine-learning models in use and reviews every AI project against 16 risk pillars. DBS reports more than 2,000 models across more than 430 use cases on a platform that deploys a model in seven to 10 weeks. OCBC's about 400 models make six million decisions a day. State Street gives the validation argument in one number: over six months, static rules flagged more than 31,000 data exceptions of which 250 were true, while the AI model flagged about 4,000 and found all 250.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. Credo AI, Monitaur, SAS Model Risk, ValidMind and Yields make up the model risk and AI governance category; no bank on this site names one on the record. Named most often by the banks here: Credo AI (0 banks), Monitaur (0 banks), SAS Model Risk (0 banks), ValidMind (0 banks).

How do banks govern AI?

AI governance is the most common AI activity on the record because it is the precondition for everything else: a committee, a chief AI officer, a usage policy, mandatory training and a use-case portfolio reviewed through one lens. JPMorgan counts almost 1,000 use cases with about 50 'really important'; BBVA 1,127 in production; Bank of America 300-plus approved and 400,000-plus employee prompts a day; Citi gave 175,000 staff 60 days to complete prompt training; U.S. Bank reviews every use case through a governance body and sorts ideas into growth, cost-saving and unmeasured-productivity buckets.

Governance is counted here when a bank discloses the structure: who approves a use case, who owns the inventory, what employees may use, how they are trained and how the board hears about it. After the 2026 US guidance pushed generative AI out of formal model risk, almost every large bank described such a structure, which is why 128 of the banks here are counted. The AI governance page sets out the frameworks and the chief AI officers list names the people.

Banks in production. 105 of the 140 banks run this in production on the record, 10 are rolling out, 6 are in pilot and 7 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. JPMorgan runs almost 1,000 AI use cases, about 50 of them described as really important, across risk, fraud, marketing, hedging and document reading. Bank of America reviews every AI project against 16 risk pillars including privacy, bias, workforce impact and intellectual property, has 300-plus approved use cases and sees 400,000-plus employee prompts a day. Citi gave 175,000 staff in 80 locations 60 days to complete its “Prompting like a Pro” course and supports adoption with about 4,000 AI accelerators. U.S. Bank trains 70,000 employees by persona and routes every use case through one governance body.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. Governance platforms (Credo AI, ValidMind, Yields) are in the directory; the banks on the record describe committees and training rather than a bought tool. Named most often by the banks here: Credo AI (0 banks), Monitaur (0 banks), SAS Model Risk (0 banks), ValidMind (0 banks).

How do banks manage third-party AI vendors?

Third-party AI is the pattern of the whole record: build the platform, rent the models, buy the point solutions. The interagency third-party guidance (SR 23-4, OCC 2023-17, FIL-29-2023) makes a model vendor a third-party relationship with due diligence, contract terms and monitoring; the FSB tracks dependence on a few model, cloud and chip suppliers as a systemic vulnerability. The scale of the contracts is now public: HSBC committed to 200,000 Microsoft 365 Copilot seats, Barclays to about 100,000, BBVA rolled ChatGPT Enterprise to 120,000 employees in 25 countries, Lloyds has 40,000 Copilot licences at 97% active.

Almost every AI use case on this site runs on someone else's model or platform, so vendor management is a use case in its own right: due diligence on the model provider, contract terms on data use and training, concentration limits across cloud and model suppliers and an exit plan. The record shows the biggest banks deliberately running several model vendors (U.S. Bank balances OpenAI, Anthropic and Google so it is not stuck with one; Flagstar's StarIQ orchestrates Claude, Llama, Mistral and Titan) and everyone else standardising on an enterprise assistant. The AI tools directory lists the vendors with their bank customers.

Banks in production. 100 of the 140 banks run this in production on the record, 12 are rolling out, 2 are in pilot and 9 have announced plans. The table shows the largest banks with a production record, one row per bank; the use-case page linked in the catalogue above lists every bank.

Case study. HSBC committed to 200,000 Microsoft 365 Copilot seats, according to Microsoft's CEO in July 2026, while running its AML system with Google and its model platform with Mistral. BBVA went from 3,300 ChatGPT Enterprise licences in May 2024 to a 120,000-employee rollout, with about 100,000 using it by June 2026 and more than 20,000 custom GPTs. Lloyds has 40,000 Copilot licences with 97% of holders active and more than 11,000 engineers on GitHub Copilot. BNY turned the vendor question on itself: an agent reviews more than 3,000 vendor agreements a year in a quarter of the time.

Regulators' documents. The three tracked documents that matter most for this use case; the by-use-case page lists all of them.

Vendors. The directory counts, per vendor, the banks of the US set that name it on the record; Microsoft Copilot leads with 16, ChatGPT Enterprise and Claude follow with eight each. Named most often by the banks here: Microsoft Copilot (16 banks), ChatGPT Enterprise (8 banks), Claude (8 banks), Gemini Enterprise (6 banks).