12 Nov 2026

The OCC has given its examiners a framework for assessing how banks use advanced and agentic AI in routine business. The headline is what it leaves out. Examiners should not treat AI as a separate risk category, and banks need not set a separate AI risk appetite. The agency calls that technology-neutral.

I think that is right, and it is closer to how the FCA already talks than many firms admit. Consumer Duty, SM&CR and the operational resilience rules do not care whether a bad decision came from a model, a spreadsheet or a tired underwriter. The outcome and the accountable person are what count. Firms that built a standalone AI policy, with its own committee and its own risk register, may find it sits beside the real controls rather than inside them.

The test is straightforward. Pick one AI-assisted step in your lending journey, say income verification or complaint triage, and ask where it shows up in your existing risk framework. If the answer is only in the AI policy, it is not really governed. It should appear in the process map, the control testing and the senior manager's statement of responsibilities, the same as any other step.

PayPal took its internal AI assistant from 43% to 95% accuracy without changing the underlying model. It added a separate knowledge layer instead: business definitions, approved queries, analytical playbooks and trusted procedures. Agents are made to consult that memory at critical steps, with human approvals and production testing on top.

This is the most useful AI story of the week for anyone running a lender, because it moves the problem from procurement to housekeeping. Most firms do not have one agreed definition of an active customer, an arrears case or an approval rate. Finance means one thing, risk another, and the board pack a third. A model asked to answer questions over that will be confidently wrong about half the time, which is roughly where PayPal started.

Try it before buying anything. Write down your ten most-asked management questions and the single correct query behind each. If your team cannot agree the answers in an afternoon, no model upgrade will fix it. If they can, you have the start of the knowledge layer, and it stays yours whichever supplier you use next year.

Chime's chief executive, Chris Britt, says automated comparisons of fees and features could make customers more willing to switch, which helps cheaper providers. Chime is building secure connections for members' own assistants, with users controlling what each one can see and do, alongside its own agent, Jade.

The point for UK credit is about back books. A lot of consumer lending profit still depends on people not shopping around once they have a product. An agent that checks every month whether a cheaper loan or a better rate exists does not get bored or embarrassed. Consumer Duty already asks whether your pricing gives fair value to existing customers as well as new ones. Agent-driven switching turns that from a compliance question into a retention one.

Two things to do now. First, run your own existing customer book through the comparison an agent would make, and see how many would leave on price alone. Second, look at how a customer's assistant would get your data and act on it, through open banking permissions, with clear consent and limits. Being easy and safe for a good agent to deal with is likely to matter more than resisting them.

Flex, Livble, Esusu and Zip are pushing pay-later products beyond retail into rent and recurring bills. The US market for those payments is put at about $2 trillion, against roughly $160 billion for retail BNPL. The pitch is income smoothing for people whose pay and bills fall on different days. Consumer advocates warn the products can add fees and stack debt around essential costs.

Splitting a sofa into four payments is one thing. Deferring rent is something else. When the thing being financed is a cost the customer cannot cut, a missed instalment is not a lost discretionary purchase, it is the start of a debt spiral. Any UK firm looking at bills or rent should assume the FCA will read it as lending to people already under pressure, and judge it on that basis.

The question worth asking of any product like this is simple. If the customer needed it this month, what tells you they will be in a better position next month? If the honest answer is nothing, the product is moving a shortfall around rather than solving it. Affordability checks and forbearance need to be designed in from the start.

When Entra revokes a session, refresh attempts fail, but the current access token can stay valid for up to 90 minutes. Continuous Access Evaluation is meant to close that gap, but it can clash with IP restrictions, so many teams only use critical event evaluation. That shuts off the Outlook apps but not Graph API access. The only guaranteed way to cut access at once is to disable the account.

Plenty of incident playbooks say revoke sessions and reset the password, then move on. For a lender, the mailbox of a compromised underwriter, broker manager or finance clerk is full of customer data, bank details and payment instructions. An hour and a half of quiet reading is plenty of time to set up an invoice fraud or lift a batch of applications.

Check your own runbook this week. Does the first step for a compromised account say disable, or does it say revoke? Then ask IT whether Continuous Access Evaluation is fully on, and if not, why. Disabling a senior person's account feels heavy-handed in the moment. It is a lot lighter than explaining a data breach to the ICO.