Mastering financial risk and compliance with AI -…

Ambitious and explorative – this is how analysts describe the adoption of AI across the financial services sector. Companies have been quick to see opportunities to enhance innovation, efficiency and customer experience. But to reap the rewards, they must also tackle new threats.

“For financial services firms, the question is no longer whether AI can create value, but how they can industrialise it in a controlled, explainable, resilient and auditable way,” says Bastian Bahnemann, financial services industry compliance and business development lead at Microsoft.

“AI – especially agentic AI – can increasingly influence decisions, trigger workflows, access sensitive data and interact with core systems. Unlike traditional systems, the speed of change and evolution of models is rapid and dynamic. That means the control model must evolve as well.”

Bahnemann advises organisations to structure their thinking around four compliance columns: contracts, off-cloud activities, in-cloud controls and other topics such as training, business continuity and broader regulatory readiness. However, he says, most AI risks cut across these categories.

“AI risk is not a separate category anymore,” he says. “It is part of mainstream prudential, cyber and operational risk management. Models like Claude Mythos have shown that advanced cyber capability is being compressed into multi-AI-model and AI agent powered tools which identify vulnerabilities, improve exploit paths and materially reduce the time from discovery to attack. That doesn’t just create a technology challenge; it changes expectations around patching discipline, baseline hygiene, third-party oversight and operational resilience.”

In this environment, a ‘deploy fast, govern later’ approach doesn’t work. AI maturity demands both ambition and a clear strategy for adoption and governance. 

Financial institutions need to follow a clear adoption and governance strategy to support AI maturity

“Many organisations start with technology enthusiasm and try to add governance later, but that creates friction in regulated industries like financial services,” says Bahnemann. “A better path is to scale in stages with the four-column compliance concept in mind: get the contractual and documentary side right, put the in-cloud controls in place, establish operating guardrails and keep the broader resilience and compliance topics visible from day one.”

For instance, rather than leaving AI agents scattered across individual teams or toolchains, Bahnemann recommends setting up an agent control plane such as Microsoft Agent 365, which provides a central registry, policy-based controls, observability and role-specific oversight. Robust data governance policy and AI-specific security controls are also essential in the agentic era. By bringing layers together in familiar tools, Microsoft empowers companies to build in these measures without hampering…