Barclays is expanding Claude Code to help engineers develop software and modernise legacy systems, extending AI beyond employee enquiries and email processing. HSBC is opening authorised banking data to clients’ own AI tools, while UBS has deployed cloud trader communications across 17 countries.

Mastercard is testing signals to help issuers recognise agent-initiated payments and assess purchases that may look unusual individually. The Australian Securities and Investments Commission plans to examine customer impacts from banks’ new and proposed AI applications, while the Basel Committee reviews how existing operational loss categories capture AI and cyber risks.

Read more on the week’s key developments:

1. Barclays expands Claude use and targets 50% developer adoption

Barclays and Anthropic announced an expanded collaboration on 1 October covering software development, legacy modernisation and operational workflows. Barclays expects Claude Code adoption to reach 50% of its developers by the end of 2026 and a majority of software engineers in 2027. Its Colleague Knowledge Assistant, live since 2025, has been adopted by more than 16,000 Barclays UK colleagues and handled over one million searches. In Global Markets, Claude models help classify, enrich and route approximately 120,000 incoming emails daily.

Craig Bright, group co-chief operating officer, said Barclays was moving towards AI embedded in how it builds, tests, secures and operates technology. This extends Claude’s role from retrieving information and routing enquiries to helping engineers change the bank’s software.

2. UBS uses cloud trader communications across 17 countries

British telecommunications group BT disclosed on 29 September that its Azure-hosted trader communications platform was operational at UBS across 17 countries and used by more than 2,400 traders. The rollout is intended to consolidate 20 platforms into a single global solution. The service includes encryption, integrated recording and monitoring, with controls designed to support local regulatory requirements and data sovereignty. BT identified AI-based insights and automation as potential future uses of the infrastructure.

The deployment fits UBS’s wider use of Microsoft Azure for cloud modernisation and access to AI technologies. A common communications platform would reduce the systems the bank maintains while preserving controls required across jurisdictions.

3. HSBC connects clients’ AI tools to authorised banking data

HSBC launched HSBCnio at Sibos in Miami on 29 September, allowing corporate and institutional clients to query authorised account and transaction data through their own AI tools. The platform combines web, mobile and direct system connections for checking balances, tracking payments and arranging trade loans and foreign exchange. AI access uses Model Context Protocol, a standard for connecting AI applications to data and tools. Developer documentation, software development kits and a sandbox support integration and testing.

HSBC announced a partnership with Mistral AI in December 2025 to develop internal tools using self-hosted models, and with Google Cloud in June 2026 to build AI applications for financial crime risk management and frontline bankers. HSBCnio gives treasury teams more choice over how banking data feeds into their own AI workflows and analysis. The bank also plans to add Ask HSBC for querying and interpreting information within the platform.

4. Mastercard adds agent identification and risk signals to payment authorisation

Mastercard announced an expansion of Agent Pay’s trust and intelligence services on 30 September, beginning with a probability score entering US testing that indicates whether a payment was initiated by an AI agent. Mastercard plans to add information on behaviour, merchant risk, transaction patterns and credentials. The services form part of its Agent Pay Trust Framework, which covers identity, intent, controls, execution and intelligence.

An agent booking a trip could generate purchases across airlines, hotels and transport providers that appear unusual when assessed individually. Mastercard’s proposed signals would help issuers assess those purchases in the context of the customer’s request. Its Verifiable Intent framework, announced in March, records the permission linking a consumer’s authorisation to an agent’s actions. Mastercard is exploring how Cloudflare’s web signals can complement payment data, while working with Skyfire on agent identification and verification.

5. Duco reports 76% time savings in reconciliation trials

Duco published results on 29 September from its Pacesetters programme, involving 12 clients including BBVA, Blackstone Credit & Insurance and CIBC Mellon. According to Duco, participants reduced time spent on the manual reconciliation activities tested in production trials by an average of 76%. Reported reductions included more than 91% for building processes, 84% for optimising processes and more than 73% for exception workflow management and investigation. The programme began in June, and Duco said its Agentic Workspace was now available to new and existing clients.

Duco combines agent-led preparation and investigation with rule-based reconciliation, keeping data processing repeatable and traceable. Clients can use its workspace or connect their own agents through Model Context Protocol without using the Duco interface. The figures measure time saved on selected tasks rather than total reconciliation costs.

6. Thought Machine and AWS combine AI tools for legacy core migration

Thought Machine and Amazon Web Services (AWS) announced a solution on 29 September combining AWS Transform with Vault Forge, using Amazon Bedrock. The process is designed to extract business rules from legacy applications, consolidate product variations and generate financial product rules written in Python, along with tests and configurations. Bank engineering and risk teams retain approval authority before generated products enter a Vault sandbox for further evaluation. Thought Machine also announced a Core Modernisation Accelerator programme to support implementation.

Vault defines financial products in Python separately from the underlying core infrastructure. The pipeline converts extracted rules for interest calculations, fees and account lifecycles into Python products for testing and review. Customer data, integrations, parallel operations and production cutover remain wider migration tasks.

7. ABN AMRO extends Infosys collaboration to embed AI across its technology estate

ABN AMRO is linking its next phase of AI adoption to application development, testing and support through an expanded collaboration with Infosys announced on 30 September. The renewal combines IT simplification and modernisation with wider use of generative and agentic AI through Infosys Topaz. Carsten Bittner, the bank’s chief innovation and technology officer, said the engagement would accelerate responsible AI adoption across the company while reducing complexity and operating costs.

ABN AMRO’s cost programme already includes Lenny, a generative AI lending assistant that helps staff identify loan solutions for corporate clients. Chief financial officer Ferdinand Vaandrager links wider AI adoption to investments in data quality, common definitions and a shared data architecture, which also support reporting and process automation. The bank’s wider cost programme targets a reduction in the cost-to-income ratio from above 60% to below 55% by 2028.

8. ASIC plans review of banks’ new and proposed AI applications

The Australian Securities and Investments Commission (ASIC) will examine new and proposed banking AI applications and their impact on customers, with a sector review expected to begin in October–December 2026. Its 30 September letter to bank boards and executives identifies customer-facing interactions, decision-making and lending processes as areas where consumer protections must be maintained. ASIC will coordinate with the Australian Prudential Regulation Authority to minimise duplication of work on AI risks.

ASIC’s 2024 cross-sector review found governance and risk assessment lagging AI adoption. Banks have since announced further uses in customer service, including Commonwealth Bank of Australia’s testing of CommBank Companion for budgeting, cash-flow and home-buying enquiries in May 2026, and ANZ’s agentic AI-powered customer relationship management platform for business bankers in February. The upcoming review covers both new and proposed applications, extending scrutiny to applications still under development.

9. Basel Committee reviews operational loss categories for AI and cyber risks

The Basel Committee on Banking Supervision will assess whether the operational risk framework’s existing event-type loss categories adequately capture cyber risk and developments in AI. The decision, announced on 1 October after its 28–29 September meeting in Indonesia, moves its work on AI into the classification of operational losses. The Committee highlighted potential vulnerabilities from cyber attacks and shared dependencies as AI enters critical financial functions. It also noted the AI ecosystem’s expanding financial footprint, greater use of leverage and increasingly interconnected financing arrangements.

Existing operational loss categories already cover system failures, processing errors, model errors and failures involving vendors. An AI-related processing error, for example, could fall within execution and process management, while an outage could fall within business disruption and system failures.

10. Citi and JPMorganChase collaborate with Nvidia on agent safety technology

Nvidia introduced its Open Agent Safety Platform on 28 September, naming Citi and JPMorganChase among institutions collaborating on shared agent safety technologies. Its broadly available OpenShell software sets execution boundaries and records agent activity. The Sentry reference design adds a separate monitoring function running on BlueField-4 hardware, designed to quarantine agents that exceed those boundaries. Nvidia said more than 100 organisations were working with the platform’s technologies.

The architecture separates the agent carrying out work from the systems enforcing its permissions. OpenShell sets execution boundaries outside the model, while Sentry monitors activity through a separate processor in an isolated trust domain. Identity checks and access policies govern the data, tools and services an agent can use. Restricting an agent’s permissions does not establish that an authorised financial action is correct.