Issue #37
Weekly Banking Intelligence: October 09 to October 15, 2026
THIS WEEK’S SIGNAL
The Federal Reserve, OCC, and FDIC asked banks this week to explain how they would shut down an AI agent. Not slow it down. Not audit it after the fact. Shut it down. That question alone tells you where supervision is heading. Regulators are no longer asking whether banks are using AI; they are asking whether banks are in control of it. The institutions that can answer that question clearly, with documented shutdown procedures, audit trails, and governance structures that actually work, are going to be in a very different position than the ones that have been deploying agents without asking it themselves.
DEEP DIVE
When regulators ask how you shut it down
The Fed, OCC, and FDIC issued a joint set of supervisory questions this week asking banks to document how they would shut down AI agents operating within their systems. The questions cover shutdown procedures, audit trail integrity, model provenance (including questions about the use of Chinese-developed models), and whether banks can demonstrate real-time oversight of agent behavior. The framing references SR 26-2, the interagency guidance on AI risk management issued earlier this year, and signals that examiners are moving from general AI risk awareness into specific operational testing.
Why it matters: This is not a conceptual exercise. Regulators are telling you that AI agent governance is now an examination topic, and they are showing up with specific questions. If your AI deployment program does not include documented shutdown protocols, clear audit trails, and defined human escalation paths, you have an examination gap, not just a governance gap. The banks that built their AI programs with controls as an afterthought are going to feel that pressure first.
Why it matters (operating model): The deeper issue is that most AI agent deployments inside banks were designed by technology teams, not operations or compliance teams. The question of who owns the shutdown decision, and under what conditions, is fundamentally an operating model question. It requires clear accountability across lines of business, technology, risk, and legal. Many institutions have not had that conversation yet. Now would be a good time.
This connects to broader findings from Evident’s 2026 AI Index, which surveyed 50 of the largest global financial institutions and found that governance and responsible AI use are now the fastest-growing focus areas as AI deployment accelerates. The Evident data also highlights a specific example worth noting: at one institution covered in the index, David Griffiths took the helm as group head of AI and rolled out a platform called Arc, designed to industrialize how the bank deploys agentic tools across its lines of business. The framing from that institution was explicit: “We’ve built industrialized infrastructure to make AI agents a core part of how we serve our clients.” That is a very different posture than a bank that has been running pilots.
What I’d be asking if I were in the room: Do we have a documented shutdown procedure for every AI agent currently operating in production? Who owns that decision? Has it been tested? Does our audit trail give examiners what they would need to reconstruct what an agent did and why? And honestly, does our board understand what we are actually running?
The ABA Banking Journal published a board-level AI governance framework this week that is worth circulating to your directors. The fact that the ABA felt it necessary to publish that framework tells you something about where most boards currently stand.
MARKET MOVES
MyState Bank selects a global core banking platform for post-merger transformation
MyState Limited, an Australian financial institution headquartered in Hobart, selected the TCS BaNCS platform to support its core banking transformation. The decision follows MyState’s recent merger activity and is aimed at consolidating operations onto a single platform. TCS BaNCS is a globally deployed core banking platform with implementations across multiple continents.
Why it matters: This is a straightforward post-merger consolidation play, and it follows a pattern we have seen repeatedly: mergers accelerate core decisions that institutions had been deferring. The interesting thing is the timing. MyState is making this move in an environment where, as reported this week by finews.com, roughly two-thirds of Swiss banks surveyed expect to still be running their current core banking system a decade from now. Two very different postures on the same underlying question. The institutions that use merger moments to consolidate and modernize tend to come out of those transitions with cleaner architecture and lower operating costs. The ones that bolt systems together and move on tend to carry that complexity forward for years.
The composable architecture shift
As reported this week by IDC Financial Insights, banks are increasingly moving away from full core replacements toward composable, cloud-native architectures designed to accelerate product launches and reduce operating costs. Jerry Silva, Program Vice President for IDC Financial Insights, led the analysis behind that report.
Why it matters: Full core replacement is expensive, risky, and slow. Composable architecture lets banks modernize in layers, wrapping or replacing components without taking down the whole system. That is a more pragmatic path for most institutions, and it is gaining traction. The question worth asking is whether your current vendor contracts and integration architecture actually support that kind of modular approach, or whether you are locked into a monolithic dependency that makes composability harder than it sounds on a slide.
VENDOR SIGNALS
Kastle raises $24 million to deploy AI agents across legacy bank infrastructure
Kastle, an AI workforce platform built specifically for banks and lenders, closed a $24 million Series A this week. The company’s proposition is direct: rather than replacing core infrastructure, Kastle deploys AI agents capable of operating across existing systems and gradually transfers increasingly complex work from human employees to digital ones. The founder, Choudhary, framed it as a different model from the core modernization path.
This is worth paying attention to, and not just because of the funding. Kastle is betting that most banks will not replace their cores in any reasonable timeframe, and that there is a large and durable market for AI agents that can operate on top of what already exists. That bet is probably right for a significant portion of the market. The risk is that agents layered on top of fragile or poorly documented legacy systems create new operational dependencies that are hard to govern and even harder to shut down, which brings us back to exactly what regulators were asking about this week. The operating model question of who owns those agents, and what happens when they fail, does not get easier just because the underlying core did not change.
Thought Machine, 10x Banking, and Mambu: core modernization becomes a procurement line item
Thought Machine’s commercial momentum, 10x Banking’s fresh capital raise, and Mambu’s agentic AI capabilities are collectively shifting core banking modernization from a strategic aspiration into an active procurement conversation at a growing number of institutions. These three vendors are increasingly showing up in the same shortlists.
The cloud-native core vendors are no longer selling a vision; they are selling a track record. Thought Machine has live deployments at scale. 10x Banking has institutional backing. Mambu has been embedding AI capabilities directly into its platform. For banks that are actively evaluating core options, the competitive set has matured considerably in the last 18 months. For banks that are not yet in that conversation, the gap between their current platform and what these vendors offer is widening.
Standard Bank and Huawei expand into core banking modernization
Standard Bank Group, one of Africa’s largest financial institutions, expanded its partnership with Huawei to include core banking modernization, announced at HUAWEI CONNECT 2026 in Shanghai. The deal builds on a strategic relationship established in 2024, with AI applications described as still exploratory at this stage.
The Huawei dimension is worth flagging in the context of this week’s regulatory signals. The joint supervisory questions from the Fed, OCC, and FDIC specifically referenced concerns about Chinese-developed models in bank AI deployments. Standard Bank operates primarily in African and emerging markets, so U.S. regulatory exposure is limited here. But for any U.S.-regulated institution watching this space, the regulatory signal is clear: model provenance, including where the underlying technology was developed, is now an examination consideration.Kastle raises $24 million to deploy AI agents across legacy bank infrastructure
REGULATORY PULSE
Regulators ask the shutdown question
The Fed, OCC, and FDIC issued joint supervisory questions this week asking banks to document AI agent shutdown procedures, audit trail integrity, and oversight of model provenance. The questions reference SR 26-2 and represent a meaningful escalation in the specificity of AI supervision. This is covered in depth in the Deep Dive above.
The Spring 2026 Semiannual Risk Perspective, released in May, noted that banks using AI tools for cybersecurity and vulnerability monitoring are better positioned against AI-enabled attacks. That finding is worth keeping in your back pocket for board discussions: AI governance is not purely a compliance burden; it is also a risk management capability.
Community banks signal tokenization intent
The Conference of State Bank Supervisors released its 2026 community bank survey this week, and one data point stood out: a double-digit share of community bankers intend to offer tokenized deposits and stablecoin solutions within the next 12 months.
That number is higher than most people would expect, and it suggests that the tokenization conversation is no longer confined to the largest institutions. Whether community banks have the infrastructure, legal clarity, and operational readiness to actually deliver on that intent is a separate question. The gap between “intend to offer” and “can actually execute” is where most of the risk lives in any technology adoption cycle, and community banks attempting to move into tokenized products without the right architecture and legal framework in place are going to encounter friction quickly.
TALENT SIGNALS
U.S. Bank builds an AI operating model, not just an AI team
As reported this week by Forbes, U.S. Bank has been building out its AI capabilities through a federated model: a shared platform, an internal AI marketplace, and a workforce training program focused on enduring principles rather than point-in-time tool familiarity. The approach is designed specifically to prevent fragmented technology stacks from forming across business lines.
What stands out here is not the technology. It is the operating model discipline. U.S. Bank is treating AI deployment as an organizational design problem, which it is. The federated model with a shared platform is one way to balance central governance with business-line flexibility. The internal marketplace is a mechanism for reuse and accountability. The workforce training emphasis on principles over tools reflects an understanding that the tools will keep changing. Banks that are still thinking about AI staffing as a headcount exercise are going to find themselves rebuilding this from scratch every 18 months.
AI governance roles are becoming a distinct organizational function
Across the industry, banks are actively building out dedicated AI governance functions, roles that sit at the intersection of model risk management, compliance, and AI operations. The creation of these roles, distinct from traditional model risk management, reflects growing recognition that AI agent oversight requires a different skill set and a different organizational home than what most banks built for pre-AI model governance.
AI governance roles are rising because institutions are deploying AI at a pace that has outrun their existing oversight structures. The demand for people who can build those structures from scratch, and who understand both the regulatory expectations and the technical realities, is real and is not being met by the existing talent pool. Banks that are still trying to staff AI governance through their traditional model risk function are likely to find that the fit is imperfect.
CB RADAR UPDATE
The CB Radar picture this week reflects a market that is splitting into two distinct camps. One group is actively modernizing: selecting new platforms, expanding vendor partnerships, and building composable architecture. The other group is deferring, with the Swiss survey data suggesting that deference is not always reluctance; sometimes it is a deliberate choice to extract more life from existing systems while deploying AI on top. What is worth watching is whether the Kastle model, AI agents on legacy infrastructure, gives the deferring camp enough runway to delay core decisions indefinitely, or whether the governance and operational complexity of that approach eventually forces the conversation anyway.
RICK’S STRATEGIC TAKE
➜ The shutdown question is the right question. When regulators ask how you would turn off an AI agent, they are really asking whether you are in control of your own operations. That is not purely a technology question. It is a governance question, an accountability question, and an operating model question. If your answer is not crisp, that is the most important thing to fix right now, before an examiner asks it in a formal context.
➜ I think people are underestimating the complexity of the Kastle model. The idea of deploying AI agents across legacy infrastructure without replacing the core is going to be attractive to a lot of institutions, and it will work in the short term for many of them. But layering autonomous agents on top of systems that were not designed for that kind of interaction creates dependencies that are genuinely hard to govern. The regulatory questions this week are going to apply just as much to AI-on-legacy deployments as they do to modern platform deployments. Possibly more, because the audit trail on legacy systems is often weaker, and the operating model accountability for those agents is rarely well defined.
➜ The community bank tokenization signal deserves more attention than it is getting. A double-digit share of community bankers intending to offer tokenized deposits and stablecoin products within 12 months is a significant number. The legal framework is still evolving, the infrastructure requirements are real, and the operational readiness of most community banks for this is, to put it gently, untested. If you are advising a community bank board, I would want to understand exactly what “intend to offer” means in practice, and whether the institution has actually done the work to back that intention up.
For a deeper framework on what AI-ready core architecture actually requires, see CSP’s CB Architecture Series at coresystempartners.com.
Want the Full Picture?
Subscribe to BIS, the Banking Intelligence Service from Core System Partners, for the full breakdown including Rick’s Strategic Take on the governance gap, the CB Radar vendor tracking signals, and the regulatory pulse analysis covering what SR 11-7 does and does not cover for agentic deployments, delivered weekly. Banking Intelligence Service
For CSP’s full analysis of what the Fed and Treasury are actually concerned about—and a framework for what AI-ready architecture requires—visit Core System Partners.
Continue With Core System Partners
- Contact Us: https://coresystempartners.com/#contact
- The Strategic Flywheel (book): https://coresystempartners.com/resources/strategicflywheel/
- Core Insider (weekly newsletter): https://coresystempartners.com/resources/newsletter/
