AI autonomy stops where banks cannot account for decisions

Written by Russell Pereira

Jun 23, 2026
9 min

As digital banks in Asia deploy AI agents across credit, fraud and customer service, Tonik Bank and GXBank show that autonomy is not determined by what the technology can do. It is determined by whether the institution can trace, explain and defend every decision its agents influence.

Most banks still ask whether their artificial intelligence models work. Biswanath Banik, chief data officer of Tonik Bank, the Philippines’ first digital bank, raised the more important question during a discussion on agentic artificial intelligence (AI) in banking. "I think the real question that we are asking is, the AI that we are building, do they have the right business context to be trusted?" His question shifts the debate from model performance to institutional accountability, where banks ultimately carry the risk.

Trust begins with the data trail
Jamie Luk, who leads delivery and customer success engineering at nCino, warned that many banks are deploying AI on top of fragmented data, systems and workflows. He compared the risk with the familiar end-user computing problem, where spreadsheets solve immediate business needs but later become difficult to govern because they sit across laptops, shared drives and informal processes. "If you don't do that then you're going to build the next evolution of this EUC problem and it's going to be far harder to untangle," he warned. The comparison turns AI risk into a familiar operational risk problem for bankers because a spreadsheet can become business-critical even when ownership, source data and version control remain unclear, while AI can recreate that weakness at greater scale across more data, recommendations and workflows.
A bank cannot govern an AI decision if it cannot reconstruct how the decision was reached. Data context therefore becomes the first condition for trusted AI, not a technical layer that sits below the business. Banks need to know what data the model draws on, why that data is authoritative, who can access it and how the output enters a decision workflow. Without that trail, AI can make decisions faster than the institution can explain them.

Alternative data raises the burden of proof
The same accountability issue appears in a different form at Tonik Bank. The Philippines has relatively low standard credit bureau coverage, with only about 25% to 30% of the population covered, leaving many potential borrowers with thin or absent formal credit histories. A credit-led digital bank therefore needs alternative signals if it wants to lend responsibly to customers whom traditional credit data does not capture. Banik explained that Tonik uses device, behavioural, in-app and third-party data to extract credit and fraud indicators.
That approach extends AI’s credit reach beyond the conventional bureau system, but it also raises the evidentiary burden when AI influences a credit or fraud outcome. Customers, regulators and internal risk teams may ask how a behavioural signal became a risk signal, why it was considered relevant and how the bank controlled access to sensitive customer data. Tonik’s experience illustrates how alternative data can support broader access only when the bank can validate the signal, explain its use and defend the decision that follows.

Autonomy narrows as customer impact rises
The move from analytics to agentic AI raises the stakes because AI begins to recommend actions, trigger workflows and influence customer treatment. Banik described this as a shift from data-driven banking, to AI-driven banking, to agent-driven banking, where agents make recommendations or take steps independently. That shift changes the governance question from whether the model is accurate to whether the bank can account for the decision. Banik put the issue in concrete banking terms: "Who is making that product recommendation? Who is making the decision whether or not to grant a loan to the customer? Who is making the decision what is the right time to make a loan offer to the customer?"
At Tonik, the boundary between internal analytical autonomy and customer-impacting autonomy is clear. Its internal analytics product, Customer IQ, can operate autonomously for internal insight by learning from the questions users ask, the answers it produces and the feedback it receives. Customer-facing agents operate under stricter controls because they can affect credit outcomes, fraud treatment or customer rights. Autonomy can expand where decisions remain explainable, owned and reversible, but it must narrow where customer impact and regulatory exposure rise.

Controlled automation can protect customers faster
GXBank’s chatbot experience shows what that principle looks like when the autonomous action is itself a protection measure. Bee Teng Lim, executive director, data science and analytics at GXBank, said the bank’s generative AI-powered chatbot handles about 80% of live-agent chat volume, including transaction disputes, without escalation to a human agent. When a customer reports a card problem, the bank can block the card immediately, which improves speed and protects the customer from further loss. GXBank allows AI to support fast operational action inside a defined scope, while keeping judgement-heavy decisions subject to oversight and escalation.
This example avoids a false choice between manual banking and fully autonomous banking. Banks can automate high-volume actions that follow defined rules, especially where speed protects the customer or limits loss. They still need policy controls, escalation paths and accountable owners for decisions that require interpretation, discretion or regulatory defensibility. The practical operating model is not full autonomy, but controlled automation with clear decision rights.
Clear decision rights work when the problem the bank is solving remains stable. Fraud does not offer that stability. As attacks become faster and more adaptive, banks need control models that can learn continuously without surrendering accountability.

Fraud defence must learn at attacker speed
Fraudsters now use AI to forge documents, mimic behaviour and test bank controls faster than manual teams can respond. Banks that rely only on periodic reviews or post-event investigations remain exposed to attackers that learn continuously. GXBank uses AI to analyse the digital characteristics of documents and determine whether they are genuine, while its cyber security team acts as a red team by attempting to forge documents using similar tools. "We operate on the adversary feedback loop," Lim noted.
The adversarial loop turns fraud control into a continuous learning process. Each attempt to forge a document helps the bank test and improve its detection model against realistic attacks. This gives the bank evidence that its controls are not only designed but actively challenged and strengthened. That evidence becomes important as regulators scrutinise how banks govern AI-enabled fraud risk and how quickly institutions can respond when attack methods evolve.

Regulation is making governance part of the operating model
The regulatory direction across Asia Pacific is becoming clearer. Luk pointed to the Australian Prudential Regulation Authority and the Monetary Authority of Singapore as examples of authorities examining how financial institutions deploy AI. Lim also noted that Malaysia introduced national AI governance and ethics guidelines in 2024 and has been moving towards a mandatory AI governance regime, with potential penalties for institutions that use AI improperly. These examples show that AI governance is moving from voluntary discipline towards enforceable expectations.
The common regulatory themes are becoming familiar to senior bankers: cyber security controls, board-level responsibility, model governance, supply chain risk management and clear ownership of AI decisions. Banks therefore need governance structures that connect data, models, vendors, business owners and outcomes before AI becomes embedded across customer and risk workflows. Luk argued that banks can turn regulatory convergence into an advantage: "I think there's now an opportunity to now not be reactive with governance but instead treat it as more of a competitive advantage." nCino’s own experience illustrates the point because the firm adopted the National Institute of Standards and Technology AI risk management framework voluntarily before any of its markets required it, finding that subsequent regulatory conversations became substantially easier. "It's more of a roadmap as opposed to a reactive compliance driver," Luk added.

Collective fraud intelligence is the next line of defence
Regulation addresses institution-level accountability, while fraud intelligence addresses system-level learning. Fraudsters do not attack one institution in isolation; they test across banks, learn from each other and reuse successful patterns wherever controls are weakest. Banik argued that banks need to learn across institutional boundaries in the same way: "Fraudsters, they learn from each other very easily. Banks should also learn in the similar way through institutional networks." The region already has building blocks for this collaboration, including national fraud portals, regulator-led initiatives and common fraud databases.
The next step is more sophisticated than sharing alerts or blacklisted data. Banik pointed to the need for fraud signatures, meaning the behavioural, device, document or transaction patterns that indicate fraudulent intent or credit risk without requiring banks to transfer customer data. Pattern-level intelligence would allow institutions to learn from one another while preserving privacy, competition and accountability. It would also give regulators and banks a practical way to strengthen collective defence against fraud networks that already learn across borders and institutions.

The next phase is accountable scale
"The real impact may not always be by building models, but to enable people to get their answers maybe 2x faster," Banik noted. For Tonik Bank and GXBank, that speed depends on whether the accountability architecture they are building across data pipelines, decision rights, adversarial testing and regulatory alignment can scale without becoming the bottleneck it is designed to prevent. The human-in-the-loop boundary that both institutions maintain for customer-facing AI is not a permanent answer, but a holding position until governance infrastructure can validate wider autonomy.
The fraud intelligence opportunity faces the same test. Pattern-level sharing across institutions requires trusted infrastructure that does not yet exist at scale in Southeast Asia. Whether that infrastructure develops through regulatory mandates, bilateral bank agreements or industry bodies will determine how quickly collective fraud defence can outpace the networks it is trying to stop. The banks that move fastest will not be those that give agents the broadest autonomy, but those that can prove where autonomy creates value, where judgement must remain human and how every decision can be challenged, improved and defended.