AI strategy for banks: a three-year roadmap

A bank AI pilot that wows the board and then stalls in model risk review is a familiar story. A sound AI strategy for banks avoids it by moving in four stages, from governed data to agents doing real work.

Through my role at DXC I've worked with banks across the Middle East and Africa. Ambition is rarely their problem.

The data is. Customer, account and transaction records sit in a core banking system, a card platform, a CRM and a dozen spreadsheets. Each has its own idea of who a customer is.

This roadmap works with any core banking platform, cloud or model provider your regulator accepts. It covers retail, SME and corporate banking.

Three years, four stages

1. 01

   Now: data foundation

   Customer, product and risk data in one governed platform, with lineage regulators can trace.

2. 02

   Year 1: governed intelligence

   One business language for customers, accounts and transactions, AI governance and the first quick wins.

3. 03

   Year 2: scale AI agents

   Agents for onboarding, credit, fraud and AML, plus near real-time customer engagement.

4. 04

   Year 3: AI embedded at scale

   AI inside key business functions, with people and agents working together and every decision traceable.

The foundation pays for itself through trusted data and cleaner regulatory reporting. The first AI value shows up in year one, and the bigger gains come once agents start doing real work in year two.

Banks already know why data matters, because regulators taught them. The BCBS 239 principles on risk data aggregation ask for accurate, complete and timely risk data with clear owners. A good AI foundation is that same discipline, stretched to cover customer and product data too.

Here's the work, in the order I'd do it.

1. Bring core banking, cards, payments, lending, CRM and digital channel data into one platform. That's usually a lakehouse, a single store for raw and cleaned data, in the cloud or in-country.
2. Add a catalogue and lineage, so every figure in a regulatory return and every input to a model traces back to its source system.
3. Give product, risk and finance teams self-service reports built on the same customer and balance figures.

The hardest part is the single customer view. Take a woman with a current account and a credit card at your bank. She's also a guarantor on her brother's business loan and a director of one of your corporate clients.

In most banks she's four records. The core system spells her name one way, the card platform another, and the corporate file has her passport number but no date of birth. An AI agent checking her total exposure would miss the guarantee completely.

The fix is dull. Set matching rules on ID number, date of birth and address, then build one golden record with a named business owner. Do it once in the foundation and every model inherits it.

Here's a second case. Your risk report and finance ledger show different exposure figures for the same corporate client. The cards platform posts overnight and the loan system at midday.

With lineage in place, an analyst traces both numbers to source and sees the timing gap. Without it, someone rebuilds the figure in a spreadsheet before every board meeting.

1. 01Core bankingAccounts, balances and transactions
2. 02Cards and paymentsCard spend, transfers and salaries
3. 03Lending and CRMLoans, limits and contact history
4. 04Landing zoneRaw copies with lineage from day one
5. 05Single customer viewOne person, every role they hold
6. 06Reports and returnsProduct, risk and regulatory figures that agree

Trusted data you can trace for the regulator

The core of year one is a semantic layer. That's one business language, shared by people and AI agents, where customer, account, product, limit, exposure, transaction and complaint each get one definition.

Why does that matter? Ask three teams how many active customers you have.

Marketing counts anyone who opened the app in the last 90 days. Finance counts anyone with a balance, and risk counts anyone with an open product.

An agent answering that question for the board must use the board pack's definition. The semantic layer is where you write it down once.

AI governance comes in the same year, shaped around your regulator. In the UAE that means the joint guidelines for financial institutions adopting enabling technologies. In the UK, it's the PRA's model risk management principles (SS1/23).

In the EU, the AI Act treats creditworthiness checks on individuals as high-risk. My advice is to keep one register of AI use cases. Give each one an owner, a risk rating, test results and a human review step, then map the register to every rule you answer to.

Then go for quick wins that staff and customers notice. I'd pick from these:

1. A staff copilot, an assistant that answers questions from policies, product terms and customer history.
2. Complaint summaries that give a case handler the whole story in one screen.
3. A personal spending advisor inside the app customers already use.
4. Retention prompts that tell a relationship manager when a customer looks ready to leave.

Here's a staff copilot in a contact centre. A customer calls about a fee on a card payment she made abroad. The copilot finds the fee clause, checks her card tier and shows the answer with the clause quoted.

Whether to refund the fee as goodwill is still the agent's call, and I think it should stay that way.

The spending advisor works on patterns customers already live with. Say a salary lands on the 25th, rent leaves on the 1st and school fees hit every September. The advisor suggests saving a little each month for September.

Retention prompts read quieter signals, such as a salary that suddenly stops landing on the 25th. The relationship manager hears about it that week, while there's still time to call.

1. 01Relationship manager asksWhich of my clients look likely to leave?
2. 02Semantic layerBank definitions of customer, product and active
3. 03Governed dataAccounts, transactions and complaints
4. 04Copilot answersWith the reason and the source for each
5. 05Manager checksCalls the client or drops the prompt

The same answer the board pack would give

Business valueHighMediumLow

• Personal spending advisor

• Retention prompts
• AML alert triage

• Credit decision support

• Staff policy copilot
• Complaint summaries

LowMediumHighRegulatory risk

• Low
• Moderate
• Critical

Year two moves from assistants to agents. An assistant answers a person's question. An agent does a piece of work within limits you set, then hands it to a person.

In banking the volume and the value sit in four places:

1. Onboarding and KYC, the know-your-customer checks every new account needs.
2. Credit, from collecting documents to drafting the credit memo.
3. Fraud, where the agent scores card and payment transactions in near real time.
4. AML (anti-money laundering), where alerts pile up faster than investigators can clear them.

Take SME onboarding. A trading company uploads a trade licence, a memorandum of association and its shareholders' passports. One shareholder is a company registered in another country.

The agent works through it step by step:

1. It reads each document and pulls out names, dates and registration numbers.
2. It checks the licence against the company register and screens every name against sanctions and watch lists.
3. It follows the foreign shareholder up the chain to find the ultimate beneficial owner, the real person who owns the business.
4. It finds a near match on a sanctions list for one director, with the same name and a different date of birth.
5. It prepares the file with that match flagged and the evidence attached.

A compliance officer looks at the flag and decides. The agent did the collecting, and she does the judging.

Credit works the same way. For an SME asking for a working capital line, the agent gathers bank statements, audited accounts and the bureau report. It lays the numbers out in the bank's standard format (credit teams call this spreading) and drafts the credit memo.

It might point out that most sales go to one buyer. The decision stays with the credit officer.

Fraud moves faster. Someone uses a card in a shop at home, then online in another country forty minutes later. The agent holds the second payment, asks the customer to confirm in the app and shows an analyst why it acted.

AML is slower. Cash deposits keep landing just under the reporting threshold at different branches. The agent gathers the history and drafts the case narrative, and the investigator decides whether to file a suspicious activity report.

The same year brings near real-time engagement. A small business owner sees a cash-flow forecast a week before a big supplier payment is due.

The operating model changes too. Every agent needs an owner, a clear limit on what it may do, monitoring and a kill switch. Model risk teams should review agents with the same care they give models.

1. 01AlertTransaction monitoring raises an alert
2. 02GatherAccounts, counterparties, history and screening hits
3. 03AssessScores the alert against past cases
4. 04DraftWrites the case narrative with evidence
5. 05DecideInvestigator closes or escalates
6. 06LearnOutcomes tune the next triage

Model risk reviews the agent like a model

By year three, AI sits inside retail lending, cards, SME banking, treasury, operations and risk. People and agents work side by side, and every decision path has a named owner and an audit trail.

Data sharing widens what agents can see. Open banking APIs let customers share accounts held elsewhere, with consent. ISO 20022, the newer standard for payment messages, carries richer detail about who paid whom and why.

Take a corporate client that receives hundreds of payments a day. An agent matches each one to the right invoice using the ISO 20022 remittance details. It flags the rest for the client's treasury team.

Back-office work changes too. At month end, an agent matches the bank's nostro accounts (its accounts at other banks, in foreign currencies) line by line. An operations analyst works only the breaks it can't explain.

Partners plug into the same governed layer and use your definitions and controls. A competitor can't copy three years of plumbing quickly.

1. Chief operating officerOwns the agent portfolio and its results
   Model risk and complianceValidation, monitoring and a kill switch
2. Business headsOwn the agents in their line of business

• Onboarding agentOwned by the head of onboarding
• Credit agentOwned by the chief credit officer
• Fraud agentOwned by the head of fraud
• AML agentOwned by the MLRO

1. 04AI agents and copilotsOnboarding, credit, fraud, AML and engagement agents, with human approval points
2. 03Governed intelligence layerSemantic model of customers, accounts, products and transactions, plus the AI register
3. 02Data foundationLakehouse with lineage, catalogue and data quality, in-country where required
4. 01Core systemsCore banking, cards, payments, lending, CRM and digital channels

Four commitments run through any AI strategy for banks.

1. In-country and sovereign AI options. Many regulators expect customer data to stay in the country. Choose platforms and models that can run there, including open models you host yourself.
2. An open, multi-platform stack. Models change every few months, so keep the bank free to switch AI vendors.
3. Governance aligned to your regulator. One AI register and one model risk process, mapped to every rule you answer to.
4. People who can work with agents. Relationship managers, analysts and investigators need to know when to trust an agent and when to overrule it.

Here's what overruling looks like. An AML agent marks an alert as low risk because the deposits match the customer's usual salary. The investigator knows the employer closed last month, so she reopens the case.

The first mistake is starting with a customer-facing chatbot. Without a semantic layer it gives different answers to the same question.

Ask for your card limit twice and you might get two figures. One came from the card platform, the other from a stale CRM copy.

I'd start your bank's AI strategy inside the bank. Staff copilots and operations agents are safer places to learn, because a person checks every answer before a customer sees it.

The second mistake is building AI outside model risk management. A pilot that skipped validation can't go into production, so the team starts again. Bring risk and compliance in from the first use case, even if it feels slow.

How it goes wrongWhat works

1. 01How it goes wrong: A customer chatbot as the first project→What works: Internal copilots and operations agents first
2. 02How it goes wrong: Pilots built outside model risk management→What works: Model risk involved from the first use case
3. 03How it goes wrong: Each model with its own customer definition→What works: One governed customer view for every model
4. 04How it goes wrong: Risk and compliance invited at the end→What works: Risk, compliance and the business own it together

If you want to know which stage your bank is in today, book a call with me. Bring your current list of AI use cases and I'll tell you where I'd start.

What should a bank's AI strategy include?

A good AI strategy for banks needs a governed data foundation, a semantic layer and AI governance aligned to your regulator. It then adds agents for onboarding, credit, fraud and AML. In-country options, an open stack and staff training sit underneath all of it.

Where should a bank start with AI?

Start with the data foundation and internal use cases. Staff copilots, complaint summaries and a personal spending advisor bring value with manageable risk. Credit decisions come later, with the strongest controls and a person approving each one.

Is AI for credit scoring high-risk under the EU AI Act?

Yes, the EU AI Act lists AI systems that assess the creditworthiness of individuals or set their credit score as high-risk. Fraud detection is an exception. High-risk systems need risk management, data governance, documentation, human oversight and monitoring.

How do AI agents differ from AI assistants in banking?

An assistant answers questions for a person. An agent takes actions within limits you set, such as gathering KYC documents, triaging alerts or drafting a credit memo. In banking, agents should prepare decisions and a person should approve them.

Can banks use AI and keep data in the country?

Yes. Many cloud providers offer in-country regions, and open models can run on servers the bank controls. Decide which data may leave the country before you choose platforms and models.