AI IN BANKING
Generative AI in Banking: Use Cases, Limits, Rules
Seven generative AI use cases in banking with their risk levels, what SR 26-2, the PRA's SS1/23 and the EU AI Act expect, a worked check of an AI-drafted credit memo, and the customer data rule.
The main generative AI use cases in banking are drafting and summarising: credit file summaries and first-draft credit memos, KYC and AML alert narratives, adverse media triage, customer reply and complaint drafts, regulation and policy look-ups with citations, and meeting preparation for relationship managers. In each one the model writes and a banker decides. Regulators treat AI that informs credit or other material decisions as a model to be governed, and the EU AI Act lists creditworthiness assessment of individuals as high-risk, so the safe pattern is approved tools, no customer data in public AI services, and every number checked back to source.
Checked on 11 October 2026 against the sources listed under this post. Product claims are dated October 2026.
Where does generative AI help in a bank, and where must it not decide?
Banks have used machine learning for fraud scoring and credit models for years. Generative AI is different: it reads and writes language, which is most of the work in credit, compliance, operations and service. That makes it useful everywhere and dangerous anywhere its text is mistaken for a decision.
| Use case | What the AI produces | Risk level | Who decides |
|---|---|---|---|
| Credit file summary | Borrower, facility, financials in a set format | Medium: numbers can be wrong | Credit analyst checks every figure |
| First-draft credit memo | Structured memo with risks and mitigants | High if unchecked | Analyst writes the recommendation; committee sanctions |
| AML alert narrative | Draft narrative from alert facts | High | Investigator decides if activity is suspicious |
| Adverse media triage | Summary of news hits, likely false positives | Medium | Analyst confirms the match |
| Customer replies and complaints | Draft response in plain language | Medium | Staff check facts, tone and redress |
| Policy and regulation look-up | Answer with citations from your own documents | Medium: citations can be invented | Reader opens each cited clause |
| Relationship manager prep | Client briefing from approved sources | Low to medium | RM owns advice and suitability |
The pattern is consistent: generative AI is a drafter, summariser and search tool. It should not approve a loan, close an alert or decide a complaint.
What do regulators expect from banks using AI?
Three documents set the tone for most banks' AI governance in 2026.
Model risk guidance. The Federal Reserve, OCC and FDIC issued SR 26-2, Revised Guidance on Model Risk Management, on 17 April 2026. It supersedes SR 11-7 (2011) and SR 21-8 (2021), emphasises "a risk-based approach to model risk management", and is described as most relevant to banking organisations with over $30 billion in total assets.
The PRA's SS1/23. The Prudential Regulation Authority's model risk management principles for banks apply to all models used to inform business decisions, whether built in-house or bought, "regardless of technology", and include a sub-principle on risks from artificial intelligence in modelling techniques such as machine learning. The current version was published on 23 April 2026.
The EU AI Act. Annex III lists as high-risk the AI systems "intended to be used to evaluate the creditworthiness of natural persons or establish their credit score", with an exception for systems used to detect financial fraud, and also lists risk assessment and pricing for life and health insurance. Our post on the EU AI Act after the Digital Omnibus explains the current timetable.
For a member of staff, the practical message is the same under all three: use the approved tool, keep a human in the decision, and be able to explain how an output was produced and checked.
Worked example: checking an AI-drafted credit memo
Suppose your bank's approved AI tool drafts a credit memo summary for a small manufacturing company from its anonymised financial statements. The summary says: "Debt service coverage is comfortable at 1.45x." Before that sentence goes anywhere, tick it back to the figures.
| Item from the statements | Value |
|---|---|
| EBITDA | $2,400,000 |
| Less: cash taxes | $160,000 |
| Less: maintenance capital expenditure | $340,000 |
| Cash available for debt service | $1,900,000 |
| Annual debt service (interest plus principal) | $1,510,000 |
| Debt service coverage ratio | 1.26x |
The arithmetic: 2,400,000 minus 160,000 minus 340,000 = 1,900,000; 1,900,000 / 1,510,000 = 1.258, rounded to 1.26x. The model's 1.45x most likely used EBITDA without deducting tax and capital expenditure (2,400,000 / 1,510,000 = 1.59) or picked up a figure from a different year; either way it is wrong, and 1.26x may sit close to your bank's covenant threshold. A spreadsheet formula, not the chat window, is where the ratio belongs.
The habit generalises: let the AI lay out the memo (borrower, facility, purpose, financial analysis, risks, mitigants, recommendation), then verify every number, date and name against the source documents and write the recommendation yourself.
This short Bloomberg Tech video, How Banks Are Utilizing Artificial Intelligence, gives an overview of AI in banking. It is one of the opening lessons of our free AI for Banking and Financial Services course; EDWartens is not affiliated with Bloomberg.
A prompt pattern for banking work
Banking prompts need four parts: the role, the source, the format and the check. For an AML alert narrative, for example:
You are an AML investigator. Source: the alert facts below (anonymised: Customer A, Account 1). Format: a narrative covering who, what, when, where and why the activity was flagged, in under 250 words, past tense, no conclusions. Check: use only facts in the source; list any fact you needed but did not have.
The "no conclusions" instruction matters. The narrative describes; the investigator decides whether the activity is suspicious and whether a report is filed. Ask the model to list missing facts, and the gaps in the alert become your next investigation steps instead of invented details in a regulatory filing.
Customer data: the rule that comes first
Customer names, account numbers, identity documents, statements and loan files must never be pasted into a public AI tool or a personal ChatGPT, Claude or Gemini account. Consumer AI services have their own data terms; Google's Gemini Apps Privacy Hub, for example, says some chats are read by human reviewers and asks users not to enter confidential information. Banks that allow generative AI usually provide an enterprise or internal tool, with its own contractual terms, logging and access controls. Use that, follow your bank's AI policy, and practise on public or made-up data.
Which banking jobs change most?
| Role | Tasks AI speeds up | Skill that grows in value |
|---|---|---|
| Credit analyst | Summaries, ratio tables, memo structure | Checking numbers, judging the story behind them |
| KYC and AML analyst | Narratives, adverse media triage | Deciding suspicion, documenting reasoning |
| Operations | Exception summaries, procedure drafts | Control design and sign-off |
| Customer service | Reply drafts, complaint summaries | Accuracy, empathy, fair outcomes |
| Compliance | Regulation look-ups with citations | Interpretation and challenge |
| Relationship manager | Client briefings, meeting notes | Advice, trust and suitability |
The shift is from producing text to verifying it. Staff who can prompt well, spot a wrong number and explain why an output can be trusted are the ones banks need as they scale these tools.
How to build the skill
- Learn your bank's AI policy and which tools are approved.
- Practise structured prompts: role, source, format and check.
- Work on public material first: annual reports, published regulations, made-up loan books.
- Build checking habits: recompute every ratio, open every citation.
- Learn enough about model risk, bias and explainability to answer "how do you know?"
For a wider grounding in what language models can and cannot do, read Generative AI for Engineers: What LLMs Can and Cannot Do.
A free course for bank and fintech staff
The free AI for Banking and Financial Services course is written for people already working in banks, credit unions, microfinance institutions and fintechs: prompting for banking tasks, customer data and AI policy, what regulators expect (including SR 26-2, SS1/23 and the EU AI Act), credit files and memos, KYC and AML narratives and adverse media, customer communication and complaints, reading regulations with verified citations, loan book analysis in Excel and Sheets, model risk and bias, and AI for relationship managers.
It is a free course with a verifiable certificate of completion, and anyone can check a certificate on our verification page. It is not a banking qualification or a regulator's approval; it shows you finished the course and passed its assessment. Start the AI for Banking and Financial Services course at your own pace.
Take the free course
Questions
What are the main use cases of generative AI in banking?
Drafting and summarising: credit file summaries and first-draft credit memos, KYC and AML alert narratives, adverse media triage, customer replies and complaint drafts, regulation look-ups with citations, and client briefings for relationship managers. In each case a banker checks the output and makes the decision.
Can generative AI approve loans?
It should not. It can summarise a credit file and draft a memo, but the recommendation and the sanction stay with people. The EU AI Act lists AI used to evaluate the creditworthiness of individuals as high-risk, and model risk guidance expects decisions to be governed and explainable.
What is SR 26-2?
SR 26-2 is the Revised Guidance on Model Risk Management issued by the Federal Reserve, OCC and FDIC on 17 April 2026. It supersedes SR 11-7 and SR 21-8, emphasises a risk-based approach, and is described as most relevant to banking organisations with over $30 billion in total assets.
Can bank employees use ChatGPT at work?
Only where the bank allows it, and only in the approved version. Customer names, account numbers, identity documents and loan files must never go into a public AI tool or personal account. Many banks provide an enterprise or internal AI tool with its own data terms instead.
Will generative AI replace bank jobs?
It is changing tasks faster than it is removing roles. Drafting, summarising and routine replies speed up, while checking, deciding and explaining grow in value. Staff who can prompt well and catch a wrong number become more useful as banks scale these tools.
Is there a free course on AI for banking?
Yes. AI for Banking and Financial Services on EDWartens is a free course with a verifiable certificate of completion, covering prompting for bank tasks, customer data, regulators' expectations, credit memos, KYC and AML narratives, complaints, regulations with citations, loan book analysis and model risk.
Sources
- Federal Reserve: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026, read 11 October 2026)
- PRA: SS1/23 Model risk management principles for banks (current version 23 April 2026, read 11 October 2026)
- EU AI Act: Annex III, High-risk AI systems (read 11 October 2026)
- Google: Gemini Apps Privacy Hub (read 11 October 2026)
Written by the EDWartens engineering team for general education. Product names are trademarks of their owners; mentioning them does not imply endorsement. Prices and terms of other providers were checked on the date shown and can change.
1Z0-1122 Study Guide: OCI AI Foundations, Topic by Topic
Free Generative AI and Prompt Engineering Courses With Certificate, Compared
ChatGPT for Procurement: Prompts, Maths and Limits
ChatGPT Prompts for Sales: 10 That Hold Up
How to Use AI in Project Management, Stage by Stage
MQTT Sparkplug B Explained: Topics, Birth/Death and UNS (Video)