AI in Banking and Capital Markets: Underwriting, Wealth, Trading, and the Vendor Landscape

Banks and capital-markets firms are among the heaviest AI adopters in the US economy, but 'AI in banking' is not one decision. It is at least four — underwriting, wealth, trading, and risk — each with its own regulator, latency profile, and build-versus-buy default. Treat them as one platform purchase and you will satisfy none of the four gatekeepers.

Four workloads, four gatekeepers

The single most useful framing for a CIO or chief risk officer is that each banking AI workload answers to a different authority with a different tolerance for opacity. Underwriting answers to fair-lending law, where an unexplainable decision is an illegal one. Wealth answers to fiduciary duty under the Investment Advisers Act. Trading answers mostly to the market itself, which arbitrages away any signal that works. Stress testing answers to the Federal Reserve, which runs its own models and does not care how good yours are. Your stack architecture, vendor shortlist, and governance budget should differ accordingly.

Credit underwriting: explainability is law, not a feature

Machine-learning underwriting — often enriched with alternative data such as cash-flow, rent, and utility payment history — is the most mature of the four workloads and the most legally constrained. Regulation B, which implements the Equal Credit Opportunity Act^[5], requires a creditor to notify an applicant of action taken within 30 days of receiving a completed application, and an adverse-action notification must carry either a statement of specific reasons or a disclosure of the applicant's right to one^[3].

The regulation is blunt about the quality of those reasons: the statement 'must be specific and indicate the principal reason(s) for the adverse action,' and statements that the action was based on the creditor's internal standards or policies, or that the applicant 'failed to achieve a qualifying score on the creditor's credit scoring system,' are explicitly insufficient^[3]. That sentence is the design spec for your underwriting stack. A gradient-boosted or deep model whose feature attributions cannot be mapped to specific, accurate principal reasons is not a compliance gap you can paper over with a disclosure template — it is a model you cannot lawfully use for consumer credit decisions.

Layered on top of fair lending is model risk management. The Federal Reserve's SR 11-7 guidance, issued April 4, 2011^[10], defines model risk as the potential for adverse consequences from decisions based on incorrect or misused model outputs, and makes 'effective challenge' — critical analysis by objective, informed parties who can identify model limitations and produce appropriate changes — the guiding principle of managing it^[9]. In practice that means every underwriting model, vendor-supplied or in-house, needs independent validation, documented assumptions, and a challenger process. Specialist vendors — nCino on the loan-origination side, Zest AI and Upstart in ML-driven decisioning — compete in this segment, but the validation obligation stays with the bank regardless of whose model runs. The full supervisory frame is covered in /guides/model-risk-management-guide, and the sector rulebook in /guides/sectoral-ai-regulation-regtech.

Wealth management: personalization under fiduciary duty

Robo-advisors are not a regulatory gray zone and have not been for years. The SEC staff's February 2017 guidance (IM Guidance Update 2017-02) treats robo-advisors as what they typically are — registered investment advisers under the Investment Advisers Act of 1940 — and flags three areas where automation strains the traditional obligations: the substance and presentation of disclosures, the obligation to gather enough client information to support suitable advice, and compliance programs designed for the particular risks of automated advice^[6]. A questionnaire-driven onboarding flow that under-collects client information does not shrink the adviser's duty; it just makes the duty harder to meet.

The frontier issue is conflicts of interest embedded in the optimization itself. On July 26, 2023, the SEC proposed rules that would require broker-dealers and investment advisers to evaluate whether their use of predictive data analytics and similar technologies in investor interactions creates a conflict that places the firm's interest ahead of investors' — and to eliminate, or neutralize the effect of, any such conflict, backed by written policies and recordkeeping^[8]. Whatever the proposal's final fate, it names the design question every wealth platform now has to answer: what is your recommendation engine actually optimizing for, and can you prove it?

For the buyer, the wealth segment splits into retail-direct platforms (Betterment and Wealthfront are the familiar names), advisor-facing personalization layers, and institutional portfolio-and-risk platforms such as BlackRock's Aladdin. The differentiation that matters in an RFP is rarely the optimizer — mean-variance math is a commodity — but the auditability of the advice chain: can the platform reconstruct, for any client on any date, what was recommended, from what inputs, under which fiduciary logic? That is the artifact an examiner will ask for, and the one a conflicts rule would make existential.

Trading: LLM signals are real, and really perishable

The honest evidence on LLMs in markets is more interesting than the hype. Lopez-Lira and Tang, in a study first posted in April 2023 and since revised, found that GPT-4 could score news headlines for stock implications without financial fine-tuning, capturing the initial market response at roughly 90% portfolio-day hit rates — but that initial reaction is non-tradable, and the exploitable part is the subsequent drift, strongest in small stocks and after negative news^[4]. Two of their other findings should anchor your expectations: forecasting ability generally increases with model size, and strategy returns decline as LLM adoption rises, consistent with the market simply becoming more efficient as everyone deploys the same tools^[4].

That decay dynamic is the strategic point. An LLM sentiment signal is not a durable asset; it is a temporary information-processing advantage that erodes as the capability commoditizes. Domain-specific pretraining follows the same curve at higher cost: BloombergGPT, a 50-billion-parameter model trained on a 363-billion-token financial dataset augmented with 345 billion general-purpose tokens, reported in 2023 that it outperformed existing models on financial tasks by significant margins without sacrificing performance on general benchmarks^[11] — and general frontier models have been competing for exactly that ground ever since. So the build-versus-buy call on trading NLP is really a refresh-rate call: whatever you build, budget to re-evaluate it against the current frontier model every quarter.

Architecturally, desks that use LLM-derived signals treat them as features feeding conventional quantitative models, not as autonomous decision-makers — the latency of a large model is incompatible with the execution path, and its opacity is incompatible with trade-surveillance and best-execution obligations. Keep the LLM in the research and signal-generation loop, keep deterministic risk checks in the order path, and log the prompt-to-signal lineage the same way you log any other model input. Do not expect vendor backtests to survive contact with your own data; and treat any pitch quoting a specific alpha figure without a published methodology as marketing, not evidence.

Stress testing: the supervisor runs the model that matters

The Federal Reserve's stress test assesses whether large banks are sufficiently capitalized to absorb losses during stressful conditions while continuing to lend; it runs annually with a minimum of two scenarios, its results set each bank's stress capital buffer requirement, and bank-level results are publicly disclosed^[7]. The 2025 exercise covered 22 banks and projected, under the severely adverse scenario, $549 billion in aggregate losses and cumulative pre-tax net income of negative $80 billion over nine quarters^[2].

Under that scenario the aggregate common equity tier 1 ratio falls from an actual 13.4 percent to a minimum of 11.6 percent before recovering to 12.8 percent^[2] — and the dispersion across banks is wide, driven by differences in portfolio composition and business mix. The strategic implication for an AI roadmap: you cannot 'AI your way' out of the supervisory number, because the Fed's projections come from the Fed's models. Where machine learning earns its place is in the surrounding work — internal scenario expansion beyond the supervisory pair, satellite models that translate macro scenarios into portfolio-level losses, challenger models that pressure-test the incumbent regression stack, and NLP over macro and geopolitical text to inform scenario design. Every one of those models lands inside the SR 11-7 perimeter^[10], so each needs examiner-grade documentation and effective challenge, which is why neural-network satellites often lose to simpler models that validators can actually interrogate.

Customer service: the highest-volume, lowest-drama workload

Banking chatbots and voice agents are the workload where hyperscaler platforms are genuinely the default: Amazon Lex V2 provides natural language understanding and automatic speech recognition for building voice and text interfaces^[12], and Google's Dialogflow CX models a virtual agent that translates end-user text or audio into structured data, with conversations designed as explicit state machines of flows and pages^[13]. Microsoft and specialist banking-conversation vendors such as Kasisto and Personetics round out the shortlists. The state-machine detail matters more than it looks: in a regulated contact center you want the deterministic flow to own account actions and disclosures, with generative language confined to intent understanding and phrasing.

Evaluate on your own transcripts, not vendor demos: containment rate on your top intents, escalation quality, and auditability of every automated utterance. And treat the voice channel as a fraud surface — the same conversational interface that authenticates customers is the one that deepfake audio attacks; the adjacent defenses are mapped in /use-cases/ai-fraud-financial-crime.

Reading the vendor landscape by segment

The financial-services AI market does not reward a single-vendor strategy, because the four workloads buy differently. A more durable map is by segment and by what actually differentiates within it.

Two cross-cutting lessons from firms that run this at scale. First, the operational pattern that works is boring: one fintech pattern worth copying is a lender running more than 50 models in production on a shared container-orchestrated platform, with DAG-based pipelines for training and promotion, event-driven retraining triggered by drift signals, and monitoring and governance artifacts generated by the same pipeline that deploys the model. The specifics vary; the principle — one paved road for all models, with governance as a pipeline output rather than an afterthought — is portable to any institution juggling underwriting, marketing, and risk models simultaneously. Second, vendor concentration is a real risk in this sector: when your underwriting, servicing, and risk vendors all resell the same upstream foundation model, a single deprecation or repricing event propagates across workloads you thought were diversified.

Honest objections

• 'The adoption number overstates reality.' Fair: the BTOS asks whether a business used AI in any business function in the past two weeks — not whether it runs AI at production scale — and even in finance roughly two-thirds of firms reported no AI use as of May 2026^[1]. The competitive question is whether the third that does includes your direct competitors.
• 'LLM trading signals are already dead.' Partly right — the same study that documented the signal documented its decay with adoption^[4]. That argues for treating LLM capability as infrastructure with a depreciation schedule, not for ignoring it while competitors compress their research cycles.
• 'Regulatory direction is uncertain, so wait.' The proposals may move — the SEC's predictive-analytics rule remains a proposal^[8] — but the binding constraints in this article are not proposals: Regulation B's notice requirements^[3], the Advisers Act duties the 2017 guidance restates^[6], and SR 11-7^[10] are current law and guidance. Waiting buys no relief from any of them.
• 'Buying governed vendor models transfers the risk.' It does not. Under SR 11-7's frame, vendor models sit inside your model inventory and your validation obligation^[9]; a vendor's fair-lending white paper is an input to your testing, not a substitute for it.

The read

Fund the four workloads as four programs with one shared platform layer. Underwriting and risk deserve the heaviest governance investment because their constraints are statutory and supervisory; wealth deserves conflict-of-interest engineering before the rules force it; trading deserves fast, disposable experimentation with a quarterly re-benchmark against frontier models; servicing deserves a deterministic core with generative language at the edges. Across all four, the durable in-house asset is not any model — models commoditize and decay — but the governance pipeline that lets you swap models quickly and prove, per decision, what ran and why. That capability is what regulators examine, what M&A diligence prices, and what the next model generation cannot obsolete.