Banks keep AI agents in pilot mode over trust, control gaps

Banks and asset managers are keeping AI agents largely in pilot programs because they lack the systems to hand over control of funds, accountability and compliance to autonomous software. A Deloitte survey of more than 3,300 finance and accounting professionals found 80.5% expect agentic AI and generative-chat tools to be standard within five years, while 13.5% said their organizations already use such agents. Citi introduced Citi Sky on April 22, built with Google Cloud and Google DeepMind technology, with a phased rollout to Citigold clients in the U.S. planned for this summer.

Operational and governance limits are cited as the main barriers to wider adoption. McKinsey estimated that 50% to 60% of bank full-time employees work in operations, a range of tasks that could be automated. The firm also projected the agentic AI market could grow from about $5.25 billion in 2024 to roughly $200 billion by 2034. Consultants warn many institutions run narrow proofs of concept without redesigning operating models or updating controls needed for broader deployment.

Technical limits in current models feed into those operational concerns. Many agents use retrieval-augmented generation to extend memory by pulling from external databases, but an agent’s context window still caps how much information it can hold at once. Dipendra Malhotra, head of wealth technology at Citi, highlighted memory as a central constraint: “How long can a client keep a conversation going before the system starts making up facts?” — Dipendra Malhotra, head of wealth technology, Citi.

Industry participants describe practical conditions for safe delegation. “The agent can only act within user instructions, the user can halt it, and the underlying assets never move to a third party,” — MihnChi Park, co-founder of CoinFello. Porter Stowell, CEO of W3.io, warned of limited visibility: “Enterprises have no way to see, control, or audit what autonomous systems are doing with their money. Human oversight doesn’t disappear. It just moves up the stack.” — Porter Stowell, CEO, W3.io.

Developers and blockchain proponents are proposing technical layers to address identity, reputation and task verification. A draft Ethereum standard, ERC-8004, outlines registries for agent identity, reputation and validation. A separate proposal, ERC-8183, describes a job escrow model in which a client funds work, a provider submits results, and an evaluator accepts or rejects the outcome. Academic work on an “agent economy” lays out a five-layer architecture that includes physical infrastructure, on-chain identity, cognitive tooling, economic settlement and collective governance.

Those proposals do not eliminate all vulnerabilities. Agents can generate large volumes of activity quickly, making it possible to inflate reputation signals through speed and scale rather than judgment. That raises questions for banks and regulators about whether a strong automated record demonstrates reliability or merely repeated activity, who is responsible for losses caused by an agent, and which legal frameworks apply when an agent exceeds its mandate.

Citi Sky’s phased rollout will offer an early test of those issues in a live wealth-management setting. For now, financial firms continue to run pilots while work continues on memory limits, model auditing, custody and transaction controls, and liability frameworks. Institutions planning broader deployments report they are developing infrastructure, oversight processes and mechanisms to validate agent identity and behavior before giving agents control over money or critical operations.