Introduction
AI is moving deeper into financial services. The first generation of enterprise AI primarily helped employees summarise documents, search information, draft communication and analyse large datasets. The next generation can increasingly trigger workflows, call systems, evaluate information, recommend decisions and potentially execute actions. That changes the governance problem.
Deloitte notes that financial institutions are beginning to allocate dedicated budgets to agentic AI, while banks are exploring AI agents across customer service, application development and operational workflows. The question for BFSI therefore cannot remain: Can AI do this? The more important question is: How much authority should AI have when the decision has financial, regulatory or customer consequences?
A useful four level model
Rather than treating AI as either automated or human controlled, organisations can think about four levels.
Level 1 - AI assists
AI retrieves, summarises or structures information. A human makes the decision.
Level 2 - AI recommends
AI evaluates available information and proposes a course of action. A human approves or rejects it.
Level 3 - AI executes with approval
AI prepares and orchestrates an action but cannot complete it until an authorised person approves.
Level 4 - AI executes autonomously
AI decides and acts inside predefined limits without individual human approval. All four can be useful. They do not carry the same consequence.
Fraud detection
AI is well suited to detecting patterns across large transaction volumes. It can identify unusual behaviour, prioritise suspicious transactions, correlate signals and surface cases for investigation. But detection and final enforcement are not always the same thing. Automatically blocking a clearly anomalous transaction may be appropriate under defined rules.
Closing a customer account or escalating a serious fraud accusation may require additional review. The control model should therefore reflect the consequence of an incorrect decision.
KYC and AML
AI can significantly reduce manual work in document review, information extraction, adverse-media screening, transaction analysis and case prioritisation. But regulated institutions remain accountable for the final outcome. That means the system needs more than model accuracy. It needs traceability, evidence, access controls, escalation, audit history and human override.
The objective is not merely faster compliance. It is faster compliance without weakening accountability.
Credit
Credit decisions illustrate why autonomy requires care. AI may help assess transaction behaviour, income, repayment history, risk indicators and portfolio patterns. But a rejected application affects a customer directly. The institution may need to explain why the decision occurred, which information influenced it, whether bias entered the process and who owns the decision.
The higher the financial and customer consequence, the stronger the requirement for explainability and oversight.
Customer operations
This is one area where greater automation may be possible. AI agents could potentially handle account-information requests, simple service workflows, transaction-status queries, document collection and routine servicing. But even here, the boundaries matter. There is a major difference between telling a customer their balance and executing a financial instruction. The same conversational interface may perform both.
The control architecture cannot treat them as equivalent.
Compliance
AI can help compliance teams process enormous volumes of information. But compliance is not purely a classification problem. Context matters. Exceptions matter. Regulatory interpretation matters. That suggests a stronger role for AI in triage, evidence collection and recommendation than in completely autonomous final decisions.
The principle: autonomy should rise more slowly than capability
AI capability is improving quickly. Enterprise permission should not automatically move at the same speed. Deloitte describes AI-native banking products as requiring permissioned autonomy - with explicit guardrails, execution rights, monitoring and the ability for people to review or override actions. That is an important distinction.
A model being capable of an action does not mean the organisation should immediately authorise it to perform that action independently.
Three questions should determine human control
1. What happens if the AI is wrong?
If the action is easily reversible and low consequence, higher autonomy may be reasonable. If it affects money, credit, regulatory reporting, account access or customer rights, the threshold should be higher.
2. Can the decision be explained later?
BFSI systems need auditability. An organisation should be able to reconstruct what information AI used, what rule or model influenced the result, what action occurred, who approved it and what system executed it.
3. Who remains accountable?
Adding AI should not make accountability disappear. Every production AI workflow needs clear business ownership.
Human in the loop is not always the answer
There is also a danger in assuming that adding a human approval step automatically makes a system safe. If employees must approve thousands of AI-generated decisions, they may simply click through recommendations. That creates the appearance of oversight rather than meaningful oversight.
Deloitte's banking governance work argues that institutions need to think beyond simplistic human-in-the-loop models and design oversight according to actual AI risk and autonomy. The goal is meaningful human control - not ceremonial approval.
A practical autonomy framework
Before increasing AI autonomy, evaluate:
Consequence - What happens if it fails?
Reversibility - Can the action be undone?
Explainability - Can the institution reconstruct the decision?
Data sensitivity - What information is being accessed?
Permission level - What systems can AI act upon?
Regulatory exposure - Does the workflow create legal obligations?
Monitoring - Will abnormal behaviour be detected?
Escalation - When does a human regain control?
The takeaway
Financial institutions do not need to choose between AI everywhere and humans everywhere. The real design problem is deciding the appropriate level of autonomy for each workflow. The stronger principle is: As the consequence of an AI action increases, the strength of control around that action should increase with it. The future of BFSI AI will therefore depend not only on smarter models.
It will depend on better decisions about where those models are allowed to act.
FWC perspective: Production AI architecture should define permissions, escalation, monitoring and human control before autonomy is increased. Governance is not a layer to add after deployment; it is part of the system design.
