LLMs and agentic AI reshape security and risk controls for financial institutions

LLMs and agentic AI reshape security and risk controls for financial institutions

As large language models move from generating answers to taking actions, financial institutions face a new risk profile. Permissions, reliability and data governance are now the three pressure points that matter most, as discussed during The Asian Banker Shanghai International AI Finance Summit.

In March 2026, the Shanghai International AI Finance Summit hosted a session on AI security and risk governance. An exchange between two security specialists, Dong Jiwei, vice president of Tongdun Technology, and Hu Shaoyong, co-founder and chief technology officer of Guan’an Information, captured a turning point for the industry. Autonomous AI agents such as OpenClaw are moving quickly from pilots to production, and AI is no longer only helping users think; it is beginning to act on their behalf.

That shift carries particular weight in financial services. Banking and asset management systems demand determinism, traceability and near-perfect accuracy. The arrival of agents capable of calling tools, obtaining permissions and executing tasks across systems introduces a new category of risk. The question is no longer whether AI can improve efficiency; it is whether institutions can contain execution risk, decision risk and systemic risk before agentic AI becomes embedded in core financial operations.

Execution risk rises when AI is permitted to act

Dong Jiwei was direct about the standard financial institutions apply. Core operations such as net asset valuation and account enquiries cannot tolerate error. That standard sits uneasily alongside the operating logic of most AI agents. To function effectively, these systems are typically granted broad permissions across internal systems. That capability is also a vulnerability.

Once an agent has access to production systems, a mistake is no longer a bad recommendation. It becomes a damaging action. If the model is compromised or produces a hallucination, core data could be deleted or corrupted at scale. In Dong’s view, the autonomous execution capability of AI agents conflicts directly with the financial system’s requirement for deterministic outcomes.

Hu Shaoyong described the security response in similarly direct terms. Guan’an Information is using AI to counter AI. In ransomware protection scenarios, the company has developed an AI-driven approach using high-fidelity honeypots to lure and contain attack traffic within seconds. The broader implication, in his view, is that defensive systems can no longer rely on a “static fortress based on rules”. They must become “active, intelligent prevention based on behaviour”.

For financial institutions, that implies a new layer of oversight: dedicated security agents monitoring operational agents continuously. The industry’s emerging response reflects a clear consensus. Private deployment, strict permission control and full-chain decision traceability are no longer optional. E Fund Management offers a practical example. The firm established a dedicated team to test agentic AI in an isolated network environment and concluded that “the native security permission mechanism of OpenClaw is not yet mature; an internal proprietary version must be developed”. The logic is simple: if an agent can act, the boundaries of that action must be tightly defined.

Decision risk is harder to see, but potentially more damaging

If permissions represent the most immediate vulnerability, model reliability is the more insidious one. Many institutions have not yet fully prepared for this.

Dong Jiwei acknowledged that AI agents can produce unreliable outputs during complex analytical tasks, including credit investigations, with results that are simply “unacceptable” in a regulated environment. Tongdun’s intelligent credit report analysis agent can reduce the processing time of a single report to under five minutes and achieve recognition accuracy of 99%. Dong, however, was candid about where the residual risk remains: “In the financial context, a 1% error can be catastrophic, which can involve millions of dollars in assets.”

That gap between “almost always right” and “always right” is where financial risk lives. In consumer settings, a small error may be tolerable. In credit assessment, pricing or regulatory reporting, even a narrow margin of failure can lead to material losses, mispriced risk or regulatory exposure.

Hu Shaoyong framed the same issue from the model security perspective. Guan’an’s AI-based security tools achieve a model detection rate of 92.3%, enabling real-time identification rather than after-the-fact response. He also noted a deeper technical challenge: highly obfuscated malicious inputs make it difficult to distinguish between a model’s own unreliable outputs and a deliberate external manipulation.
That uncertainty becomes even more serious when accountability is considered. A chief information officer at a fund management company posed the question directly: when an AI agent generates a recommendation or executes a decision that results in a loss, who is responsible — the model developer, the institution deploying it or the individual who authorised its use? In an agent-driven workflow, accountability can become genuinely unclear. That is especially problematic in finance, where regulators expect decisions to be traceable, auditable and clearly owned.

Data and integration carry the most systemic risk

The third challenge is the broadest. Agents do not operate in isolation. They depend on data pipelines, underlying models and external APIs, precisely the most sensitive parts of a financial institution’s infrastructure. Managing this risk is not a matter of controlling a single agent. It requires securing the entire ecosystem on which agents rely.

Dong Jiwei presented Tongdun’s approach through its ZhiCe® Decision Intelligence Operating System. The system is built for openness and integration, with deep connections to mainstream large language models (LLMs) such as DeepSeek, Tongyi Qianwen and GPT-4. At the same time, it uses modular offline deployment to keep business data secure and compliant. The governing principle for private deployment in banking, he said, is that data must not leave the institution's own environment under any circumstances.

Hu Shaoyong approached the same challenge through data governance. One of Guan’an’s core capabilities is the classification and grading of sensitive data, combining the semantic understanding of large models with industry-specific rules to identify sensitive information at field level. In preparing data for model training, the company embeds classification and grading directly into the preprocessing stage, applying dynamic masking or anonymisation to sensitive fields before they are exposed to models. Guan’an is also developing targeted defences against model inversion attacks, which could otherwise expose training data to external parties. A recent strategic partnership with Maifushi aims to embed these security capabilities directly into AI application platforms.

No single institution can address this challenge in isolation. Industry experts have called for cross-sector collaboration, including shared risk-control capabilities and coordinated efforts to break down data silos that currently limit the industry’s collective ability to respond.

That is the deeper implication of agentic AI for financial services. The threat is no longer confined to conventional cybercriminals operating outside the institution. It may increasingly originate from within — from a digital workforce of agents, each capable of acting independently across systems, with permissions that were granted in good faith but not fully governed. Financial institutions that want to remain secure will need to govern permissions carefully, verify the decisions agents make and protect the data and interfaces on which those decisions depend.

Comments (0)
Cancel