The AI Bank Is Coming, But Who Controls The Risk?

Artificial intelligence is no longer something banks discuss as a distant possibility. It is already working behind the scenes, reading documents, identifying suspicious transactions, supporting lending decisions and changing how customers interact with financial institutions.

The question for banks is no longer whether they should use AI. The question is whether they can introduce it quickly enough to remain competitive while keeping control of the risks it creates.

Across Australia, banks and lenders are moving rapidly into AI-enabled fraud detection, credit underwriting and customer service. Research from Experian found that 72 per cent of Australian financial institutions surveyed were already using agentic AI to support underwriters, while only 3 per cent said their data was fully ready for AI-driven decision-making.

That gap says a great deal about the current state of banking technology. The appetite for AI is strong, but many of the systems beneath the modern bank remain fragmented, inconsistent and difficult to connect. Banks may have access to enormous amounts of customer information, but that does not mean the information is clean, reliable or organised in a way that artificial intelligence can safely use.

From experiment to production

For years, banks described AI projects as pilots. That language is now beginning to change. Technology is moving into live systems, particularly in areas where automation can reduce manual work and identify patterns faster than humans.

Westpac, for example, has introduced five specialist AI agents into parts of its mortgage and credit-card lending processes. These systems are being used to read payslips, analyse bank statements, extract income information and check applications against lending policies. The bank says the technology processes around 32,000 payslips and more than 1.5 million transactions each week, while saving more than 150,000 hours of staff time. 

The important point is that these systems are not presented as replacing the banker entirely. A human still reviews the output and makes the final credit decision. AI is being used to assemble information, identify inconsistencies and check policy requirements before the application reaches the final approval stage.

That may sound less dramatic than a fully automated bank, but it is probably more significant in practice. Much of banking consists of repetitive administrative work that customers never see. If AI can process documents in seconds, reduce errors and allow staff to spend more time on complex cases, the improvement may be considerable.

The danger is that efficiency can become a substitute for judgement. A machine may identify that an application does not fit a policy, but it may not understand the circumstances behind the numbers. A temporary fall in income, an unusual payment or a complicated family structure can look like a risk signal even when the customer’s financial position is sound.

AI as a fraud fighter

The most immediate public benefit of AI may be in the fight against fraud and scams. Banks process millions of payments every day, making it impossible for human teams to examine every transaction individually. AI can monitor patterns across accounts, devices, locations and payment behaviour, then flag activity that appears unusual.

Commonwealth Bank says it processes more than 20 million payments each day and sends more than 40,000 proactive warning alerts to customers daily. The bank reported that customer fraud losses fell by more than 20 per cent in the first half of the 2026 financial year compared with the first half of the 2025 financial year. 

CommBank has also deployed an agentic AI system designed to detect emerging fraud and scam patterns and suggest new rules for intercepting them. Those rules are reviewed and approved by the bank’s fraud analytics team before they are implemented, creating a human-in-the-loop process.

That is the attractive side of AI in banking. It can identify connections that would be almost impossible to see manually. A customer may not realise that a payment request is part of a wider scam, but a bank’s system can compare that transaction with patterns across thousands of other accounts.

AI can also improve the speed of intervention. Banks do not always need to wait until money has left an account before taking action. A suspicious combination of a new device, unusual location and rapid transfer may be enough to trigger an additional verification step.

However, the same tools that protect customers can also create frustration. A legitimate transaction may be blocked because it looks unusual. A customer travelling overseas, making a large purchase or receiving a payment from an unfamiliar source may find an account temporarily restricted without understanding why.

This creates a delicate balance. Banks need to become better at stopping fraud without treating every unusual customer as a criminal. Excessive automation can damage trust just as quickly as weak fraud controls.

The problem of data

The greatest obstacle to AI adoption may not be the algorithms themselves. It may be the condition of the data that banks need to feed them.

Experian found that only a small proportion of Australian lenders believed their data was fully ready for AI. The largest barriers included fragmented systems, poor data quality and a lack of trust in AI outputs. 

This is a familiar problem for established banks. Many operate on layers of technology built at different times, often following acquisitions, mergers or years of incremental development. One system may hold customer identity information, another may store lending history and a third may process payments. Connecting those systems is expensive and creates its own operational risks.

A digital-first lender may have an advantage because it was designed around newer infrastructure. But newer does not automatically mean safer. Fintechs may have cleaner data architecture, but they also depend heavily on cloud providers, external vendors and automated services. If one critical supplier fails, the impact can be immediate.

That is why AI has become a governance issue as much as a technology issue. The question is not simply whether an AI model produces accurate results. Banks must also know what data it uses, who is responsible for it, how it changes over time and what happens when it makes a mistake.

Regulators move closer

Australian regulators are not waiting for a separate AI banking crisis before responding. APRA has signalled that banks and other regulated institutions must manage AI through existing operational-risk and information-security requirements. Boards are expected to have enough AI literacy to understand the systems being deployed and to challenge management when necessary. 

ASIC has also highlighted the importance of governance around AI in financial markets. Its work points towards greater expectations around accountability, monitoring, bias, model risk and the use of third-party technology. 

The Australian Government has introduced a Financial Innovation Strategy that includes a more flexible regulatory sandbox and the possibility of thematic sandboxes for AI-enabled financial services. The aim is to give firms a controlled environment in which to test new ideas while regulators observe the risks. 

This is a sensible direction, but there is an unavoidable tension. Regulators want to support innovation, yet they also need to protect consumers from decisions that cannot be explained or challenged.

A customer who is refused a loan may reasonably ask why. “The algorithm said no” is not an acceptable answer. Banks will need to explain decisions in clear language, maintain human oversight and provide a meaningful route of appeal.

What changes for customers?

The best outcome is not a bank run entirely by machines. It is a bank where technology removes unnecessary friction while human expertise remains available when decisions become important or complex.

Customers may see faster account opening, quicker mortgage approvals, better fraud warnings and more personalised support. Employees may spend less time searching through documents and more time dealing with customers who need help.

But the risks are just as real. AI can make mistakes at scale. A human employee may misunderstand one application. A flawed automated system could misclassify thousands. Bias in historical data can be reproduced by a model, while a cyberattack on an AI system could create disruption far beyond a single branch or call centre.

The banks that succeed will therefore be those that treat AI as a controlled capability rather than a fashionable product. They will invest not just in models, but in data quality, monitoring, employee training, cybersecurity and clear accountability.

The bank of the future

Traditional banks have the money, data and customer relationships needed to become powerful users of AI. Fintechs may have the speed and technical flexibility to develop new services more quickly. Neither side has everything required.

The established institutions must modernise without weakening trust. The fintechs must prove that speed and convenience can coexist with resilience, regulation and responsible lending.

Australia’s regulators are attempting to create room for both. The new innovation strategy suggests that the country wants to become more competitive in financial technology, but it also reflects an understanding that innovation must be trusted if it is to become widely adopted. 

AI will change banking, but it will not remove the need for banks to explain themselves. In fact, the more decisions are influenced by machines, the more important explanation becomes.

The winners will not necessarily be the banks with the most advanced models. They will be the institutions that can use AI to become faster and more helpful without becoming more distant. In banking, efficiency matters. But confidence remains the product customers value most.