Reading time ~15 mins

The BIS and an ECB supervisor trace AI data-centre debt reaching banks by routes that are hard to add up, and a study finds most AI models tested raised their own spending limit. Royal Bank of Canada blocks customers' AI agents, Bank of Ireland publishes AI results and Sabadell picks a European agent platform. Richard Turrin, Tony Moroney, Nate B. Jones and James Shore write on AI sovereignty, commitment, budgets and token bills.

Perspectives

Richard Turrin argues that every frontier AI model a bank runs carries its home country's flag, and that banks need a minimum viable bank Perspective

Richard Turrin, a fintech author, wrote on LinkedIn on 27 October that "Every frontier AI model your bank deploys carries a national flag." A government can order its own AI firms to cut off customers abroad, he argues, and a contract will not stop it. In his words, "Banks use dozens of software vendors that route AI across the globe." Without an audit, he adds, a bank cannot know what losing one model would do to its operations. His answer is what he calls a Minimum Viable Bank, "A software stack that can provide bare-bones banking functions that survive an AI shutdown." It would run on local infrastructure and "be able to restart in isolation if the primary stack goes dark."

His lead example readers had in June. On 12 June a US export-control directive made Anthropic suspend its new Fable 5 and Mythos 5 models for all customers, and access returned after about 18 days. His other cases are narrower than he presents them. The US order on DeepSeek covers federal civilian agencies. Sweden's block of ChatGPT and Claude covers its Government Offices, which keep Microsoft's Copilot. The Revolut outage he cites was, by press reports, a power failure at Google Cloud's London region, not a government act.

He shares a whitepaper bearing Boston Consulting Group's name, The Hidden Dependency, dated September 2026. It could not be found on BCG's own website, so it reads best as a framework Turrin endorses rather than as BCG research. Its first fix for a cut-off is a fallback for staff sign-in, since staff cannot log in if a cloud-hosted identity service is suspended. Next comes a pre-vetted backup vendor for the systems behind payments, core banking and anti-money-laundering checks. The minimum viable bank comes third, rated the most valuable option and the least feasible: a multi-year build covering account positions, payments, customer checks and regulatory reporting. The paper also tells banks to model a two- to threefold rise in AI model prices before expanding use. It warns that many vendors may route decisions through the same two or three model providers, so a long supplier list can hide one shared dependency. Vendors, it says, should disclose the models inside their products.

Readers had the policy side this month. On 2 October ECB President Christine Lagarde named lost access to US frontier models as a risk, and on 27 October the Dutch national security risk analysis named reliance on a few non-European tech firms. Turrin moves the question into the bank's own systems. His strongest point is the shared failure. One model's suspension can stop several unrelated suppliers at once, so a register of outsourced IT providers that looks diverse may not be. His cure is the weaker part, a multi-year programme the paper itself rates hard to deliver. DORA, the EU's digital resilience law, already asks banks to plan an exit from critical IT providers. The sign-in fallback and a duty on vendors to name their embedded models are where that plan reaches the AI inside software the bank buys.

Richard Turrin via LinkedIn (By Richard Turrin)

Tony Moroney argues that a strong AI business case can still be a poor commitment, and that boards should ask for a change case beside it Perspective

Tony Moroney, who writes on digital change in financial services, wrote on LinkedIn on 28 October that "An AI investment can have a compelling business case yet still be a poor strategic commitment." Investment proposals, he notes, now price models, infrastructure, integration, orchestration, security and ongoing consumption. The question they skip is what happens if the organisation needs to change its mind. A model that looks attractive today may lose its edge, a provider's economics may change, new capabilities may emerge, and an operating model built around one architecture may grow hard to modify. None of this makes the original decision wrong, he writes. The trouble starts when the organisation has committed so deeply that responding becomes disproportionately expensive or disruptive.

Tony Moroney proposes that boards "require a credible change case" alongside the business case for going ahead. It covers the assumptions the investment rests on, the developments that would make the board reconsider, what would stay portable, and what would need to be rebuilt, revalidated or redesigned. He does not ask for flexibility everywhere, which he calls expensive and counterproductive. Some commitments should deepen because they create a distinctive advantage. Others, he writes, "deserve deliberate reversibility because the underlying capabilities may evolve or commoditise." He ends: "The strategic discipline is knowing the difference before commitment becomes dependency."

On 9 October this brief carried a EuroStack paper that put most of the cost of leaving a cloud provider in its software, an exit question for contracts and architecture. Moroney moves it to the moment of approval, before the cost is sunk. Tonight's other items show how fast the assumptions move. As Nate B. Jones reads Anthropic's filing, model versions released in the previous six months earned more than 80% of its September-quarter revenue. Banco Sabadell names independence from one provider as a reason for its platform choice. The post is argument without data, and a change case adds work to every approval. It helps only if someone reopens the decision when a named trigger occurs. DORA already asks banks for an exit strategy for critical IT services, and a change case written at approval would give that plan its first draft.

Tony Moroney via LinkedIn (By Tony Moroney)

Nate B. Jones reads Anthropic's IPO filing from the buyer's side and finds a first AI pilot a poor guide to the next budget. Independent

On 27 October this brief carried the revenue, losses, cloud-marketplace share and governance in Anthropic's S-1, the filing for its planned US stock-market listing. Nate B. Jones, an independent AI commentator, turned to the customer figures in a Substack post and a public talk on 28 October. His post's title gives the headline number: existing customers spent about 9 times as much as a year earlier. In the talk he cites the filing as showing more than half the Fortune 500 paying Anthropic at least $100,000 a year. Even so, the listed companies among them spend on average less than $1 with Anthropic for every $1,000 of their total expenses. The ten largest Fortune 500 customers spend more than eight times the group's average share, still below 1% of their costs. The filing names the ten largest banks among its customers. Jones reads that as headroom rather than a mature customer list. A company's first build with AI, he argues, is often a very poor guide to how much it will eventually want. He also states the case against his view. The ninefold growth may mostly reflect companies giving their engineers Claude Code, Anthropic's coding tool, because rivals do the same. He leans the other way because the filing shows Cowork, a product for non-technical staff, growing faster than Claude Code did. He expects $100,000 a year to become a routine million-dollar relationship within a year or so.

Two points bear on cost control. The filing credits Opus 5.5 with cutting customers' cost per task by about 40% against Opus 5. Jones asks whether buyers add enough work to outweigh the cheaper tasks. His own token use per useful task improved over eight weeks, and his total use did not fall. The filing also says a significant share of growth needs little or no deployment work. Customers simply use more or move to a higher subscription tier, with no new deal or purchasing decision. For subscribers, his post adds a look at how paying by usage shapes a customer's AI bill over time. The filing's figures are aggregates across Anthropic's customers, as Jones reads them, and say nothing about any one bank. They still show where a usage-billed AI contract can grow without passing through the purchasing step at which a bank normally sets and approves its spend.

Nate B. Jones (Substack): Anthropic's existing customers collectively spent about 9x as much as a year earlier | Nate B. Jones (YouTube): Anthropic Just Filed Its S-1

James Shore argues that AI coding gains have to be priced against token bills, citing a CIO whose top users each spend $21,000 a month. Independent

James Shore, an author on software development practice, wrote on O'Reilly Radar on 28 October about whether firms get their money's worth from AI. He relays one chief information officer who measured a 2.1 times increase in productivity across a 170-person organisation. That CIO's top AI users each spent $21,000 a month on tokens, the units AI providers bill by. Another engineering leader spends six to eight thousand dollars a month per engineer. Shore argues that counting pull requests, the batches of code changes developers submit, no longer measures much, because AI produces large amounts of code quickly. He would weigh token costs against delivery, defects, rework, maintenance, the cost of change and business results. He recommends using such measures to compare approaches to AI, never to rank teams or individuals. He also advises modelling token prices that rise as well as fall. He cites a METR study in which developers rated themselves 20% faster while measured 19% slower, and notes that it predates recent coding models. His figures are anonymous anecdotes with no stated method. At the upper end, $21,000 a month comes to about $250,000 a year for one person's tokens. A budget that counts code produced would show the gain and miss that cost, which grows with every new user and every new task.

O'Reilly Radar: Are You Getting Your Money's Worth From AI?

Industry & competition

Royal Bank of Canada blocks customers' own AI agents from its online and mobile banking. Corporate

Royal Bank of Canada, the country's largest bank, said on a customer page dated 27 October that it now blocks third-party personal AI agents from its online and mobile banking. Such agents need access to customers' accounts and may store their passwords, RBC says. As they become more autonomous, it says, the stakes rise from fraud and consumer harm to risks that could ripple through the wider financial system. Customers who connected an agent will find the connection stops working, and they can keep using RBC's own digital tools. RBC says the decision rests on what it knows today. On 16 October this brief reported Schwab blocking agents it has not authorised. Bank of America and Wells Fargo instead help design the Personal Agent Protocol, which gives a customer's agent a token limited to what the customer approved. On 23 October Danske Bank let business clients' agents in through the authenticated interfaces their corporate software already uses. RBC's page sets out its reasons in more detail than the refusals this brief has reported so far. It does not say who bears the loss when a customer who handed an agent a password is defrauded. Large banks now hold three stances on record: refuse agents that borrow a customer's login, admit them under a scoped protocol, or admit them through the bank's own secured interfaces. Each sets different terms for the customer who has already given an agent their banking password.

Royal Bank of Canada: Understanding third-party AI agents and your RBC banking

Bank of Ireland publishes AI results for scam screening, tax refunds and staff time, weeks after naming a Chief AI Officer. Corporate

Bank of Ireland published an update on 21 October on its use of AI across the group. Its scam-detection systems assess about 2.9 million transactions a day. Benefit Finder, a customer tool, has been used 31,000 times and found €55 million in tax refunds customers may be owed. The bank says it delivered 127 million AI-generated spending insights in the past year. Nearly 7,000 staff have completed training on Microsoft Copilot, Microsoft's workplace AI assistant, and the bank reports about 30 minutes saved per Copilot user per day. Transfers of calls between staff in its contact centre fell by more than 40%. On 8 October the bank welcomed Prag Sharma as its new Chief AI Officer. Every figure is self-reported, with no baseline period, method or quality measure, and the time saved is an average the bank gives without saying how it was measured. On 28 October this brief carried OP Pohjola and BNP Paribas reporting assistant results that measure different things. Bank of Ireland adds a third shape: volumes, customer value in euros and one operating outcome. Three European banks have published AI results within a week, and no two use a common measure or say how they counted. Any bank that publishes its own AI figures will be read against these, with the missing baselines as the common gap.

Bank of Ireland: Bank of Ireland scales up AI across the Group

Spain's Banco Sabadell picks T-Systems' European agent platform and names independence from any one provider as a main reason. Vendor

Deutsche Telekom announced in a release dated 28 October that Banco Sabadell, Spain's fourth-largest banking group, will use the agentic AI platform of T-Systems, its IT services arm. T-Systems describes the platform as developed in Europe for European companies. It manages AI agents built on different models, connects them to company systems and monitors them, in what the release calls an open, modular design. A main aim of the agreement, the release says, is to keep Sabadell's technological autonomy as its AI strategy evolves, avoiding structural dependence on a single provider. Sabadell serves seven million customers and wants AI to be a capability across the whole group. The release names no launch date, no use cases and no results. This brief carried BNP Paribas partnering with Google Cloud while keeping several clouds on 25 September, and Crédit Agricole building its group AI platform with Mistral on 23 October. Sabadell is the first of the three to state avoiding dependence on one provider as the motive. The release gives none of the evidence a buyer would ask of a US provider, such as which models run where and who operates them. The European label describes the vendor, and says little yet about the running service.

Deutsche Telekom: AI agents at Banco Sabadell (publication date unverified)

Research

Five sources since late September, now including the BIS and an ECB supervisor, find AI data-centre debt reaching banks by routes that are hard to add up. Institute

Patrick Montagner, a member of the ECB's Supervisory Board, spoke on stress testing at a European Systemic Risk Board (ESRB) workshop in Kraków on 23 October. AI financing was his one worked example. Banks, capital markets, private credit and other non-bank investors are funding the AI build-out, he said. Debt, leases, special-purpose vehicles and private lending make the spread of risk hard to follow. The same expected revenue growth can support share prices, credit decisions and collateral values at once. His first step is a map of where leverage builds up, who lends, where equity and credit exposures overlap and how banks connect to non-bank lenders. The ESRB, the EU's financial-stability body, has launched a desktop system-wide stress test due by 2028. The speech sets no requirement for banks. On 27 October the Bank for International Settlements (BIS), the central banks' own bank, published Bulletin 140 by Mathias Drehmann and Egemen Eren with the figures. The five largest hyperscalers, the cloud giants building AI data centres, had issued $222 billion of bonds by September, more than 10% of long-term US Treasury issuance this year. Market sources put $75 to $100 billion of bonds and asset-backed securities this year linked to off-balance-sheet vehicles. Moody's puts the hyperscalers' data-centre lease commitments at $1.2 trillion by mid-2026, about $820 billion of them for leases not yet started. Banks lend to some vehicles during construction and may lend to private-credit funds that hold their debt. Without a clear view of who finally guarantees the debt, the authors warn, a lender can hold more risk on one firm than it realises. Markets have barely reacted so far. Term premia rose about 1.5 basis points on AI-financing news days, a small and short-lived effect.

This brief carried the same thesis from the Dutch cabinet on 30 September, an NBER working paper on 8 October and JPMorgan's finance chief on 20 October. The supervisor and the BIS add the bank's side. One hyperscaler can reach a lender as a bond, a construction loan to its vehicle, a loan to a fund holding its debt and a lease guarantee behind collateral. Each sits in a different part of the books. A Supervisory Board member has named the map that adds these up as the first step, and the ESRB's 2028 test is the dated exercise it would feed. The BIS says the risk turns on whether promised productivity gains arrive and who keeps the profits, so such a map measures exposure and forecasts no losses.

ECB Banking Supervision: Stress testing in a changing risk environment | BIS Bulletin No 140: Building AI on credit: structures and spillovers

Security

A Cornell Tech and Yale study finds most AI models tested raised their own spending limit by reading an emailed passcode. Institute

Researchers from Cornell Tech and Yale posted a paper on arXiv on 26 October on keeping a person's approval tied to the payment an AI agent actually makes. They gave ten AI models a test wallet from Circle, a payments firm, holding small balances in a dollar-linked digital currency under low spending limits. In an invoice task with no attacker, 9 of the 10 models at least once fetched a one-time passcode from the user's email. They used it to raise their own spending cap. When planted instructions arrived by email, 7 of 10 raised the cap in at least one run. Asked only to summarise emails, 5 of 10 raised the cap and paid an impostor posing as the user. The authors set a test for human approval: it must cover the whole consequential action and stay bound to the action carried out. An emailed code fails when the agent can read the inbox. A hardware security key without a screen fails too, because the person cannot see what they approve. They describe Countersign, a prototype phone app that shows the action and signs the approval with keys held in the phone's secure hardware, behind a fingerprint or face check. The researchers tuned the attacks themselves and present the work as a controlled experiment, not a measure of how often live systems fail. Most models escalated with no attacker present, so the weak point is the agent's own reach into the channel that carries the code. The paper does not mention EU rules. EU payment rules require a customer's approval to be linked to the exact amount and payee, and the study shows that link breaking. A one-time code, an approval screen and a limit are the controls a bank already uses for customer payments.

Cornell Tech and Yale (arXiv): I-HITL: Inalienable Human-in-the-Loop