Branimir Akmadza, AI & Data Engineering Team Director at Infinum
For years, a bank’s app has been at the centre of the digital customer relationship. Banks have invested heavily in making apps faster, simpler and more intuitive. But AI is challenging the assumption that customers need to navigate a bank’s interface to access its services.
Across the UK banking market, conversational and agentic AI is moving from experiment to real-life applications. For example, Revolut has launched AIR, an in-app AI assistant that lets customers use conversation to explore spending, investments and subscriptions and carry out tasks such as freezing a card. Starling has launched an agentic AI assistant that can help customers budget, organise bills and set savings goals.
These developments are a model of conversational banking where the bank retains ownership of the interface and embeds AI within its existing app. But another model is emerging, where the conversational layer sits outside the bank altogether. Instead of asking a bank’s own assistant to retrieve information or carry out a task, a customer could use a general-purpose AI tool to access services from multiple financial providers.
A bank-controlled assistant operates within the bank’s own technology, permissions and regulatory framework. But a general-purpose AI model sits outside that framework, which creates governance and security issues. The FCA has identified this as an emerging regulatory concern and, in its recent Perimeter Report, notes that consumers are already using general-purpose LLMs such as ChatGPT and Claude to help them make financial decisions, without the protections associated with regulated financial advice.
One way to achieve a secure conversational banking interface in a general-purpose LLM is through the use of Model Context Protocol (MCP) and PSD2 open banking APIs. Infinum’s recent proof of concept demonstrated how authenticated users can query balances, transactions and spending summaries conversationally inside ChatGPT. Importantly, it shows how those interactions can be built around explicit permissions and constrained capabilities, without giving AI unrestricted access to banking infrastructure.
The market is moving towards wanting more autonomous financial experiences. The FCA’s Mills Review, published in July 2026, found that 20% of UK consumers would be likely to use AI capable of acting autonomously within pre-set goals. It also found that around 26% regard general-purpose tools such as ChatGPT, Claude or Gemini as reliable sources of financial information or advice. This highlights the need for trust, control, consumer protection and accountability as AI moves from assistance towards delegation.
The FCA’s response is not currently to introduce AI-specific rules for financial services. It intends to rely on existing, principles-based frameworks, while considering how they need to work as AI becomes more embedded. The Mills Review specifically considers whether existing approaches to consumer protection, accountability, operational resilience and critical third parties remain sufficient as AI becomes more autonomous and interconnected.
Beyond the banking menu
Traditional digital banking is built around navigation. Banks decide how information and services should be organised and customers learn that structure. In a conversational interface customers can describe what they want in their own language and the system determines which authorised capability is needed to provide the answer.
The same shift is happening at an infrastructure level. UK Banking-as-a-Service provider Griffin has made an MCP server available in its sandbox that allows AI agents to open accounts, make payments and analyse transactions. Personetics, a financial technology company, has introduced an MCP server that gives banks access to its financial behaviour analysis, predictive analytics and contextual engagement capabilities.
This points to the broader change in the architecture of financial services, where AI doesn’t sit inside the bank’s own interface. It becomes an interaction layer over defined financial capabilities, as long as those capabilities can be exposed securely and governed appropriately.
The architecture matters
The Infinum proof of concept shows that there is no need to give a model unrestricted access to banking APIs to make it useful. This means, if a capability such as initiating a payment is not exposed as an authorised tool, the model has no mechanism to trigger it. Authentication is checked before data-fetching tools can be invoked and tool calls are logged to create an audit trail. Access is read-only, so accounts, balances and transactions can be queried, but payments cannot be initiated.
For conversational interfaces outside a bank’s interface to be widely adopted, the industry has to be clear on how to establish, enforce and evidence the boundary in which AI is allowed to act.
The direction is not just towards greater autonomy, it is controlled autonomy. In its June 2026 analysis of Money20/20 Europe, Forrester identifies transparency, explainability, control, consent, accountability and governance as central to building trust in AI-mediated financial services.
It is a simple principle where the model doesn’t need to be trusted with everything to be useful. Its usefulness can come from giving it precisely defined capabilities, backed by authentication and an auditable trail of what it has requested and received.
There is also a resilience challenge. In May 2026, the FCA, Bank of England and HM Treasury warned that increasingly capable frontier AI models have significant implications for cyber security and operational resilience. For conversational banking, that means the controls around the AI layer and its third-party dependencies matter as much as the customer experience itself.
Trust as part of the interface
Conversational banking changes what good UX needs to communicate. Traditional banking interfaces make many things visible, such as which account the customer is viewing, which section they are in and what actions are available. A conversation removes much of that and the system has to interpret intent, retrieve information and present an answer without the customer necessarily seeing the underlying process.
That makes transparency and control an essential part of the product experience. Customers need to understand what they have authorised, what information an AI system can access, where an answer comes from and what the system is capable of doing. For financial institutions, these questions are matters of governance and accountability.
The regulatory challenge will be to ensure that these systems operate within a framework where responsibility remains clear.
A conversational model can misunderstand a request, produce an incorrect answer or be manipulated by malicious input. Connecting it to financial data does not turn it into a financial expert. The quality and safety of the experience depend on the data sources, tools, authentication, permissions and controls surrounding the model.
Banks need to think beyond their own apps
Banking apps will still be important, particularly for complex tasks and where customers need a high degree of control. However, banks can’t just assume their app will be the only place their customers want to interact with financial data and services.
Open banking provides a mechanism for accessing financial information with user permission, while conversational AI provides a new way of making that information accessible. MCP adds a standardised way of exposing only defined capabilities to the AI layer. Together, these technologies can deliver a model where banks and fintechs provide secure, interoperable financial capabilities that appear across multiple interfaces.
This doesn’t mean every financial interaction should become autonomous. Customers may want an AI system to explain their spending, find a transaction or identify a subscription without wanting it to move money without explicit approval.
Banking has already moved from the branch to the browser and from the browser to the smartphone. The next move, from navigating financial services to asking for them, is already underway. The technology exists. The challenge now is ensuring the permissions, controls and accountability that it safe enough to become standard practice.
