6 Nov 2026

Cloudflare's Trusted Agent Delegation note names the problem most payment and lending stacks are still pretending is theoretical. When an agent sits between the customer and your site, you see the operator's infrastructure, not the person. Identity, reputation and accountability all degrade at once.

For a UK consumer credit firm that is not a bot management story. It is a Strong Customer Authentication, mandate and Authorised Push Payment story. Open banking and card flows assume you can bind a payment to a defined authority. An agent that can vary the payee, the amount or the device fingerprint strips out the evidence you use in a dispute and the signals you use in risk based authentication.

Friendly fraud gets cheaper for the customer and more expensive for you. The charge looks authorised to the agent operator and unauthorised to the cardholder. Without a durable link from agent action back to the human who instructed it, you lose the dispute on process, not on merit. The same gap appears if an agent opens a finance application, accepts a disclosure or changes a Direct Debit on a customer's behalf.

The concrete test for this quarter: pick one customer facing journey an agent could already complete, a card payment into a loan account or a soft search in a broker portal. Write the minimum identity, mandate and evidence you would need to defend that action to the FCA or to a chargeback scheme. If you cannot name the human, the cap, the payee allow list and the audit trail, you are not ready for agent volume.

Blocking agents wholesale will not hold. Designing for identity, reputation and accountability now will.

Anthropic is rolling out Personal Finance in Claude in the US, with read only bank and card connections through Plaid. Users can ask where the money went, what is left before payday and what an APR has cost them. Claude does not move money or sell its own credit products. That restraint is deliberate, and it is the bit UK lenders should study first.

The commercial threat is not that Claude becomes a lender. It is that the first place a customer understands their balances, fees and upcoming payments sits with a model vendor, not with the firm that holds the account or the credit. Once that habit forms, the lender becomes a data source for someone else's conversation. Cross sell, forbearance prompts and early arrears outreach arrive late.

Consumer Duty still applies to anyone who shapes a credit outcome. Read only access lowers some operational risk and raises a different one: explanations that sound authoritative while being wrong, or that nudge a customer toward a product without the disclosures your licence requires. Anthropic says it wants banks and wealth managers in the loop for bigger decisions. That only helps if the regulated firm can see the conversation context that led to the referral.

Run this check before any partnership conversation. For one sample customer month, can you reconstruct which balances, transactions and model explanations sat behind a recommendation that mentioned your loan or card, and can you show a human owned the regulated bit? If the answer is no, you are funding someone else's advice journey with your data.

Open banking made account data portable. Agent interfaces will decide who gets to interpret it.

Denis Stetskov's write up of the October Binance theft is useful because it refuses the glamorous version of the story. About $6.3 billion moved, much of it in twenty minutes. The path in was a tampered installer, a fake interview payload on a work laptop, a deploy token that should not have lived there, and an internal AI tool with too much reach. The model was a springboard. The boring layer failed first.

That pattern maps straight onto a UK lender's operational resilience work. You can spend a year on model risk and still lose a week to an unpatched controller, a shared SaaS token or a coding agent that can touch production credentials. The French supermarket refrigeration attacks and the Unitronics style water system campaigns make the same point: entry is usually a missing access control, not a novel exploit.

Agent tooling raises the blast radius of those old failures. A laptop that can ask an internal assistant to reach peers or deploy containers turns one compromised engineer into a lateral movement engine. Binance has since tightened those controls. Most firms I talk to still treat AI coding tools as a developer productivity topic rather than an important business service dependency.

Put this into the next resilience exercise. List every AI coding or agent tool with a path to production credentials, deploy tokens or customer data. For each one, name the owner, the allow list, the detection for unusual tool use, and the isolation step if a laptop is burned. If detection waits for the vendor to call you, that is not a control.

Patching, credentials and what a laptop can reach still decide most breaches. Agents just make the cost of getting them wrong arrive faster.

Thoughtworks argues that the harness around an agent, the instructions, tools, sandboxes, context policy, evaluation and telemetry, is now a product in its own right. Most firms still treat it as a folder of prompts and wrapper scripts. That is why upgrades feel unsafe and auditors get a shrug.

In an FCA regulated lender the harness is where Consumer Duty and operational resilience actually live for agent workflows. The model does not decide which customer records can be read, which collections message can send, or which change needs a human gate. Your instructions and tool permissions do. If nobody owns that layer, you have configuration debt with a system prompt on top.

The failure mode is familiar. A pilot works. Six months later three teams have forked the prompts, the retry logic has no provenance, and nobody can say whether last Tuesday's change made outcomes better or just cheaper. Activity metrics, tokens and acceptance rates, look green while path level evidence stays thin.

Do this in the next planning cycle. Name a single harness owner, version the instructions and tool allow list with the same discipline as a release, and attach a golden set of 20 real tasks with a scored outcome. No harness change ships without an eval result and a rollback path. If a team cannot answer whose permissions the agent used for a given run, stop the rollout.

You will not out model a poorly owned harness. You will only scale the mess.

Jen Kha's a16z piece puts hard numbers on a shift PE backed software operators already feel. A typical 2015 buyout needed about 5 percent a year of EBITDA growth to make the return math work. Today the same shape of deal needs roughly 10 to 12 percent, while Golub's software borrowers have seen revenue growth fall from about 9 percent to under 3 percent in two years. Debt is dearer and multiple expansion has stopped doing the heavy lifting.

For a UK fintech sitting under PE ownership, or preparing for a sale, that is not abstract market colour. Buyers will underwrite durable unit economics, not the hope that rates fall and comps expand. Embedded and home improvement lenders that look like capital light SaaS on a slide still carry credit, conduct and operational resilience obligations that do not flex with the rate cycle.

The commercial implication is blunt. Cost out programmes that protect EBITDA while starving change capacity will look clever in a quarterly pack and fragile in diligence. Buyers will ask which growth is real customer value and which is margin from deferred investment in controls, data and agent tooling your competitors are already shipping.

The test I would run ahead of any sale process is simple. Take the next twelve months of planned EBITDA improvement and split it into price, volume, credit loss and run cost. For each pound of run cost take out, write the control or customer outcome that gets slower or thinner. If you cannot show the residual risk is owned, you are selling a margin story that will not survive an FCA minded buyer.

PE is not finished. The 2010s software buyout script is.