👋 Welcome to the new readers who’ve joined us since last week. You’re joining 176,000+ other subscribers who love fintech.
Presented by:
Hello fintech friends,
Following up on our discussion last week of banks and MCP access, more news dropped this week that Citigroup and Bank of America are moving to block third-party AI agents from customer accounts, following JPMorgan Chase and Charles Schwab amid fears that agents will pull idle deposits into higher-yielding products.
If the growth of agentic internet users continues to outpace that of human users, this won’t be a winning strategy.
But as agents get more sophisticated, they pose new risks for financial services, as shown by this week’s series of hacks and security exploits across the internet. More and more banks are detecting unauthorized agents operating inside of users’ accounts, sometimes executing actions that weren’t permissioned by the account owner or users.
Agents are the immediate threat vector, but they’re not the only one…. most banks and fintechs are also still not quantum-ready.
Almost every security guarantee in financial services rests on public-key cryptography: RSA and elliptic-curve cryptography work because certain math problems, like factoring huge numbers, would take classical computers billions of years to solve.
Not so with quantum computers: A classical computer stores information in bits, each either 0 or 1, and computes by flipping them through logic gates. A quantum computer uses qubits, which follow the rules of quantum mechanics.
Without getting too in-detail for this wirteup (read about quantum states here), a quantum algorithm arranges answers to cryptography questions so that paths leading to wrong answers cancel each other out. That, plus the non-binary nature of quantum states, mean that quantum computers can crack classical encryption through brute force much more quickly.
This creates a problem for public-key cryptography, which finance runs on:
Transport security: The same type of cryptography secures online banking, card networks, SWIFT messaging, APIs between fintechs and bank partners, and payment processor connections. If a computer breaks the key exchange, an attacker can read that traffic.
Digital signatures and authentication: Signatures authorize payments, settle trades, and verify software updates. Forged signatures mean forged instructions that look legitimate.
Blockchains and stablecoins: Bitcoin, Ethereum, and the chains stablecoins run on use ECDSA or similar elliptic-curve signatures. A quantum attacker could derive a private key from an exposed public key and steal funds.
It’s time for banks, fintechs, and their security vendors to spend significant time focusing on emerging threat vectors. Some banks are already trying to future-proof themselves. Bank of America called in over 1,000 contractors to patch security flaws exposed by Claude’s Mythos.
But it’s unlikely that most will commit the resources needed to offset these threats until the first big exposure event catalyzes the industry — not just fintechs and their security vendors, but regulators as well.
On a cheerier note we spent a great week at Money20/20 USA, where we ran the first-ever print edition of This Week in Fintech 📰
We’ll be back next year with more papers, giving you all the hard-hitting news from the show, incluiding (importantly) the best booth winners at the conference and product launches of the week (summarized below).
What else should we include next year?
By the way, now that fintech’s Coachella is over, it’s time for fintech’s Met Gala.
That’s right: The Fintech Formal is back for its fifth year.
Celebrating 250 years of American financial innovation, we’re gathering the leaders shaping modern financial services for an unmissable end-of-year black-tie charity gala in Manhattan.
Step onto the historic floor where Alexander Hamilton laid the foundation of the nation's banking system for a night of timeless style, sharp discourse, and high-volume networking.
- Nik
SPONSORED
Worse than a coin flip?
Banking services provided by Increase Bank, Member FDIC. Technology services provided by Increase Technologies, Inc., a non-bank company.
AI models are being pitched as the fix for AML screening and adjudication. The FinCrime Agent Benchmark shows most of them fail a regulator's bar when run alone. Across nine LLMs (GPT Astra to Muse and everything in between):
Missed risk: AI models missed up to 72% of true positives.
Accuracy: Astra, the most accurate model on its own, got only 71.1% of cases fully correct and Muse got 30.8%, but with Castellum.AI's harness they reached over 99%.
Consistency: Standalone models agreed with themselves only 45.2% of the time on repeat runs.
The full results are published for review, including why the infrastructure around AI matters more than the model and what it takes to build it in-house.
The Rundown
🏦 Financial Services & Banking
Huntington Bank launched The 1866 Studio, an AI operating system for small businesses built on Google Cloud’s Gemini, with agents that help owners start a business, run marketing and get ready for loans.
Visa moved Visa Direct’s stablecoin prefunding out of pilot and into production, with Inyo Global as the first partner to let businesses prefund cross-border payouts in USDC in near real time.
Deutsche Bank deployed Farsight’s AI platform on-premise across its investment banking and capital markets teams to keep its data inside the bank’s own infrastructure.
Barclays announced it will cut 5,000 jobs, about 5% of its workforce, mostly in support functions, as AI made the bank more efficient.
🚀 Product Launches
Visa, BILL and Billtrust kicked off the first live pilot of AI agents paying approved invoices end-to-end through supplier portals, using Visa’s Trusted Agent Protocol in place of shared logins.
Marqeta teamed up with Coinbase to offer stablecoin-backed cards, with Coinbase handling custody and fiat conversion and settling on Base.
Stripe unveiled Treasury for Agents, which lets founders use AI tools such as ChatGPT, Claude and Cursor to pay invoices, move funds and convert currencies from their Stripe accounts, with a human approving any money movement.
zerohash* launched AUTH, which replaces wallet addresses and chain selection with linked accounts across 600+ platforms, including Coinbase, Robinhood and MetaMask.
Homebase rolled out Homebase Assistant, an AI agent that covers call-outs, screens candidates and flags timecard errors for small businesses that run hourly teams.
Gusto launched business formation products, to help entrepreneurs set up their companies and (Gusto-managed) bank accounts from Day 1 in their journeys.
SoFi launched SoFi Earn (SOFIE), billed as the first national bank-issued tokenized deposit for consumers, which pays 4.40% APY with FDIC insurance and converts 1:1 into its SoFiUSD stablecoin.
Tipalti unveiled AP Agent, which runs the full accounts payable cycle under human oversight, along with an MCP server that connects Tipalti’s financial data to enterprise AI tools.
Mercury* launched Mercury Payroll, putting AI-native payroll, taxes and benefits inside its business bank accounts, free through the end of 2026.
Klarna launched Consumer FX, which lets its 120 million shoppers buy from Klarna merchants anywhere in the world in their own currency with no exchange fee.
Betterment added mega backdoor Roth contributions to its solo 401(k), letting self-employed savers contribute up to the plan’s $72,000 annual limit.
World launched a World ID suite for banks that bundles deepfake detection for Zoom calls with identity credentials for AI agents, though it named no bank customers.
BILL rolled out a suite of AI tools that includes risk intelligence to flag unusual invoices before payment, a central hub for controlling its AI, and an external MCP server.
Finastra launched StandbyX, a cloud product that lets regional and mid-sized U.S. banks digitize standby letters of credit without deploying a full trade finance platform.
Outmarket launched Outmarket Lite, a self-serve AI platform that gives smaller insurance agencies proposal, quote comparison and policy review workflows.
Movere launched as an AI-native payments platform for merchants expanding into new markets, with AI agents that handle integration over MCP and no outside funding.
💸 Other News
Revolut went down across Europe for much of Tuesday, knocking out app access, card payments and transfers for millions of customers, in an outage reportedly linked to a power event at Google Cloud’s London data center.
Ramp applied for a national trust bank charter from the OCC to offer investment management and digital-asset custody, a day after raising $1.85 billion at a $60 billion valuation.
🤝 Partnership Corner
American Express teamed up with Airbnb on an exclusive partnership that brought more than 1 million Airbnb listings to American Express Travel. We’ve got a good content series coming out with AmEx soon… watch this space for more!
😞 The Bad News
The Central Bank of Ireland fined Coinbase’s Irish unit €3.25 million (about $3.6 million) over failures in segregating customer funds and in oversight.
Quote of the Week
“More than $10bn has been deposited into so-called crypto vaults, up from $4bn at the start of last year, according to data group Blockworks, as digital asset owners try to earn juicy returns on the stablecoins they hold by lending them out to traders.”
Stat of the Week
Editor’s Picks
A good response to the recent BIS workingpaper evaluating the cost differences in international transfers between fintech, stablecoins, and banks.
See you next week. -Nik
