9 Nov 2026

BMO has given its Canadian contact-centre staff AI tools that match transactions, pull up the relevant policy and prepare the case, so a colleague stops flipping between systems. The bank is targeting 20 to 30 per cent shorter handling times on eligible calls, and wants roughly 40 per cent of eligible credit refund requests processed automatically, potentially with same-day credits.

This is the right shape for AI in a regulated lender. The model is not deciding who gets credit. It is doing the dull assembly work around a decision whose rules are already written down, and the human still owns the outcome. That is far easier to defend under Consumer Duty than a chatbot answering customers directly, and the benefit lands with the customer: a faster refund is a good outcome you can evidence.

The test for a UK firm is simple. Pick your highest-volume servicing journey, whether refunds, payment holidays or settlement figures, and time how long a colleague spends gathering information against making the call. If gathering is more than half, that is where an agent earns its keep. Just make sure every automated refund leaves a trail a complaints handler or the Financial Ombudsman could follow line by line.

Visa tested 22 AI models on 15 shopping scenarios where the model had to uncover what the customer actually needed and decide whether a purchase made sense. The overall pass rate was 57.2 per cent. Worse, 54 per cent of the failures still ended with a recommendation to buy, despite requirements that were unmet or never discovered.

That second number should worry anyone in point of sale finance. An agent that fails safe, by stopping and asking, is a nuisance. An agent that fails by pushing the sale is a conduct problem. Put a finance option behind that recommendation and you have a customer taking on credit for something that does not meet their needs, which is close to the textbook definition of foreseeable harm under Consumer Duty.

Visa plans to extend the tests to checkout and order placement, and lenders should watch that closely. In the meantime, any firm letting an agent sit in a credit journey, its own or a retailer's, should ask one question before go-live: when the agent does not know enough, what does it do? If the answer is anything other than stop and ask the customer, it should not be anywhere near a finance application.

Goldman Sachs has pulled Anthropic's Claude Code and Microsoft's GitHub coding tools from bankers and traders doing engineering work, while letting its quantitative strats keep them. The bank is weighing productivity against risk role by role rather than issuing one blanket policy.

That is a sensible pattern, and one most smaller firms skip. The usual approach is all or nothing. Either the tools are banned and people use them quietly on personal laptops, or they are switched on for everyone and nobody knows what has been built. Neither survives an awkward question from an auditor. Drawing the line around who has the skills and controls to check what the tool writes is the right way to cut it.

For a lender the equivalent exercise takes an afternoon. List everyone who can currently run a coding agent, from developers to the analyst writing SQL against the loan book, and write next to each name what they can change and who reviews it. Anyone who can alter pricing, affordability or reporting logic without a second pair of eyes is a gap, with or without AI. The tool just makes the gap fill up faster.

LiteLLM has published the attack chain behind its poisoned v1.107.0 release, and it is an uncomfortable read. An admin key for its internal agent platform was committed to a public repository on 27 May and removed within hours, but never revoked. On 10 October an attacker used it to pull an org owner's unscoped GitHub CLI token. With that and two maintainer tokens stolen through CI workflows, they overrode branch protection and published poisoned packages and images that stayed up for about two hours.

Nothing in that chain is exotic. Each step is a hygiene failure most firms would recognise in their own estate: a secret treated as gone because it was deleted, a token with far more scope than its job needed, and branch protection an owner could quietly switch off. LiteLLM also sits underneath a lot of AI tooling, so if your developers use it, its supply chain is part of yours.

The resilience test is concrete. Search your repositories' full history for any credential ever committed, not only the current files, and confirm each one has been rotated. Then check whether anyone is alerted when branch protection is overridden or a workflow run is deleted on the repositories that build customer-facing systems. If nobody is, that is this week's job.

Microsoft is tightening usage limits on Copilot Chat for Microsoft 365 customers who do not have separate Copilot licences. It has not disclosed the thresholds, and IT admins cannot see or override them. The rollout started on 2 November for organisations of up to 2,000 seats and reaches larger enterprises today.

For most firms this is an irritation. For a regulated one it is a small but real resilience question. If colleagues have started using Copilot Chat to draft customer letters, summarise complaints or check policy wording, a limit nobody can see means that work can stop mid-afternoon with no warning and no way to know when it comes back. Undisclosed limits also make capacity planning impossible, which is a basic expectation of any supplier you depend on.

The practical step is to find out who relies on the free tier for real work. A short survey or a look at the usage reports will tell you. Anything that touches customers or regulatory output should either move to a licensed service with stated limits or have a written manual fallback. Thirty days without the tool is a fair test: if a team could not cope, it belongs on your supplier register.