For most of my career, core banking modernization meant one painful question: when do we replace the system of record? In October 2026 the question changed. Between 13 and 21 October, one vendor partnership offered to run AI agents on top of the cores banks already own, a US bank chose an AI-native core to replace its old one, a core banking vendor put generative AI inside its own platform, and Spain's BBVA said it would explore a new architecture for controlling AI agents while they run. Read together, these announcements say the real decision is no longer only "wrap or replace". It is where authority over money and data should live once software agents start doing the work.
Why legacy core banking systems are still the bottleneck
A core banking system is the back-end platform that processes daily transactions and keeps accounts and records. A Federal Reserve Bank of Kansas City research briefing from February 2024 is still one of the clearest summaries of the problem. It notes that many depository institutions still run legacy core banking systems up to 40 years old, on mainframe hardware coded in outdated programming languages, and that most rely on core providers, so any modernization requires close coordination with those vendors.
The briefing describes three options:
- Full replacement, the most risky and expensive path, which can take several years and cost millions, if not hundreds of millions, of dollars. Industry experts liken it to "open heart surgery".
- Component-based replacement, one component at a time. The briefing cites Zions, which upgraded lending before deposits, ran old and new systems simultaneously and migrated branches one at a time.
- Wrapping or augmenting the legacy core with a next-generation layer connected through APIs, which keeps the legacy data and processes intact and is often less risky, but adds the cost of maintaining multiple systems.
None of this mentions AI agents; the briefing predates them. But each October announcement maps neatly onto one of these options, and that is the useful lens for an executive.
Path 1: AI agents on top of the existing core
On 20 October 2026, Sutherland and FlowX.AI announced a go-to-market partnership in which Sutherland will engineer, deploy and run AI agents on the FlowX.AI platform for banking, insurance and other regulated industries in North America and Europe, "without replacing core systems". FlowX.AI brings a library of more than 220 enterprise-ready agents; Sutherland connects them to clients' existing applications, data and core systems, then runs and monitors them against agreed business outcomes under committed, outcome-based pricing. In banking, the first joint solutions target onboarding, account opening, lending, mortgage underwriting, KYC and anti-money laundering checks, financial crime risk assessment and customer retention.
FlowX.AI says that in earlier production deployments a European commercial lender removed 80% of the manual handoffs in its credit flows, and an institution serving more than four million clients lowered its lending operating cost by 40%. Neither institution is named, so I treat these as vendor claims rather than benchmarks.
The release also contains a sentence I would copy into any requirements document: to work reliably at scale, agents "must securely access existing systems, follow business rules, explain their actions, manage exceptions, and involve people when judgment or approval is required."
The same pattern is appearing elsewhere. PYMNTS reported that Kastle, an agentic AI platform for consumer lenders, describes agents as an "action layer" over legacy cores: banks start them on narrow tasks and widen access as performance warrants, and a collections agent can process a payment but cannot reverse it. PYMNTS also reported that agents can reach cores through APIs, Model Context Protocol (MCP) connections or computer use, and that core provider Mambu offers an MCP connection through which agents can search and run more than 300 API operations, with banks setting which operations each agent may use.
In the Kansas City Fed's terms, this is wrapping. It is the fastest route to value, and it inherits everything about the core underneath: its batch windows, its data quality and its dependence on the core vendor.
Path 2: replace the core with an AI-native platform
Emprise Bank in Wichita, Kansas, took the opposite view. On 15 October 2026 it announced a design partnership with Maximum, an AI-native banking infrastructure company, to transform its core banking system. Emprise argues that adding AI to infrastructure built for a different era is not enough, and says the investment should let it scale its customer count tenfold in the next 24 months while improving efficiency margins. According to FinTech Futures, Emprise had used an FIS core for the last decade.
Two design choices stand out. First, "core banking functions will remain deterministic, secure and fully auditable," while the operations around them become more intelligent and automated, and AI agents operate within clearly defined permissions and governance frameworks. Second, the migration is phased: Emprise expects to move its first traffic onto the platform by the end of 2026, with existing systems running alongside the new one throughout the transition. Emprise has total assets above $2.8 billion and about 450 employees, and Maximum closed a $30 million seed round.
Even the "replace" path, in other words, does not let AI touch the ledger directly. The AI sits around a deterministic core, and the migration uses the parallel-run discipline that the Kansas City Fed described for Zions. Conventional replacement is also continuing: FinTech Futures' October round-up included MyState Bank's deal to consolidate on TCS Bancs after its merger with Auswide, and Chorley Building Society completing its migration to TCS Bancs.
Path 3: AI inside the core vendor's platform
A third option is to let the core provider bring the AI. On 13 October 2026, SBS launched SBS AI Foundation, which it calls the first sovereign AI platform built for generative and agentic AI in core banking. It runs on NVIDIA infrastructure, with NIM microservices for the AI layer and NeMo Guardrails to keep responses within the bank's regulatory boundaries, and lets banks deploy AI on a private cloud, a managed cloud or fully on-premises without data leaving their environment. SBS says the platform is live in production at Scottish Building Society on Amazon Web Services, delivering approximately 30–40% faster response times, and that agentic workflows are coming "in the near future".
SBS cites a Gartner figure that frames the whole debate: 84% of finance organizations have implemented or plan to implement AI, but only 7% report high or very high impact. For banks under strict data residency rules, a vendor-embedded, sovereign deployment can be the fastest way past that gap, at the cost of deeper dependence on a single provider's roadmap. I covered the build-it-yourself alternative, and its real costs, in self-hosting LLMs.
The missing layer: AI agent runtime security
All three paths share one gap. An agent connected to core systems is an actor inside the bank. Design-time controls are necessary, but they are not enough for software that chooses its own sequence of actions.
That is the problem NVIDIA's OpenShell Reference Architecture, announced at GTC Berlin on 21 October 2026, is meant to address. It builds on NVIDIA's open-source OpenShell runtime, which provides a secure boundary for autonomous agents, and adds BlueField-4 DPUs running a security framework called NVIDIA Sentry for continuous out-of-band monitoring and in-silicon policy enforcement. NVIDIA says that if an agent tries to move outside its software boundary, Sentry quarantines and stops it in milliseconds, and that ServiceNow's AI Passport layer can revoke an agent's access across software and hardware within seconds. Those are vendor claims in a product launch; the press release lists BBVA and Santander among banks working with NVIDIA to explore the architecture.
OpenShell's documentation is more concrete about the software boundary. Each agent runs in an isolated sandbox; kernel controls restrict file access and system calls; every network connection passes a policy check before it leaves the sandbox; and agents never see real credentials, which are added only to requests bound for approved endpoints. A policy prover uses formal verification to flag risky new access, such as reaching a new host with credentials or calling a new API method, so those changes wait for human review.
BBVA's own announcement, also dated 21 October, is careful: the bank plans to work with NVIDIA to "explore" the architecture as part of its strategy to industrialize AI agents across the organization. It also states the principle clearly: because agents perform sequences of actions, security "requires more than just controls built in at the design stage; it also depends on the ability to monitor their decisions and actions during execution." As BBVA's Global CSO Valentín Sánchez put it, "As these systems become more autonomous, we need to strengthen the mechanisms that allow us to monitor their activities and maintain control."
Nobody has yet published production results from a bank using this layer, and, as FinTech Edition pointed out, no document links the Sutherland and FlowX.AI offer to OpenShell. A bank that buys an agent service for its core and a runtime boundary around it will be assembling these layers from separate vendors, and the seams between them become the bank's responsibility. Still, the direction is clear: the boundary around an agent is becoming infrastructure, not a prompt.
My view: the question is where authority lives
Having spent years close to mainframe banking systems, I read these announcements less as a technology race and more as a redesign of authority. The core ledger earned its trust by being deterministic: the same input produces the same posting, every time, with an audit trail. AI agents are valuable precisely because they are not deterministic. The architecture that works keeps those properties apart: agents propose, the core disposes.
Whether a bank wraps, replaces or buys AI from its core vendor, the same questions decide whether AI agents in banking are safe at scale:
- Map permissions to core transactions, not to systems. For every agent, list in writing which core operations it may call and which it may never call. Mambu's per-agent operation lists and Kastle's "process but not reverse" rule are the right granularity.
- Keep money movement deterministic. Agents can prepare a loan file, a KYC decision or a payment instruction; posting should go through the same validated, idempotent transaction paths a human would use, with the same limits. This is the agent-side version of the authorization problem I described in Agentic payments in 2026.
- Put the boundary outside the agent. Credentials, network egress and policy changes should be controlled by a layer the agent cannot modify, along the lines of OpenShell's supervisor and policy prover.
- Decide who owns the stop button. If an operator runs your agents under outcome-based pricing, the contract must say whether the bank, the operator or the platform vendor can halt an agent, how fast, and what happens to a transaction in flight.
- Measure a baseline before you sign outcome-based pricing. Without pre-agent numbers for cycle time, handoffs and error rates, an outcome commitment has nothing to be measured against.
- Test agents on your own core. Vendor figures from unnamed institutions are not evidence for your environment. Evaluate the exact agents, tools and integrations you will run, as I argued in AI agent benchmarks in 2026.
- Migrate in parallel, one component at a time. The Zions and Emprise approaches point the same way: run old and new side by side and move scope only when the numbers hold.
- Plan for sovereignty and exit. Know where prompts, retrieved data and logs are processed, and make sure data ownership and portability are explicit in core and AI vendor contracts.
Closing thought
October 2026 did not settle the wrap-or-replace debate; it made it less important. Banks will keep doing both, often at the same time. What will separate the leaders is whether their AI agents operate inside clearly written permissions, enforced by a layer they cannot change, on top of a ledger that stays deterministic and auditable. Modernize the core if you must, but modernize authority first.
References
- Core Banking Systems and Options for Modernization, Julian Alcazar, Sam Baird, Emma Cronenweth, Fumiko Hayashi and Ken Isaacson, Federal Reserve Bank of Kansas City, 28 February 2024
- Sutherland and FlowX.AI Partner to Deliver Enterprise-Grade AI Solutions for Complex, Regulated Industries, Sutherland and FlowX.AI via GlobeNewswire, 20 October 2026
- Banks Add AI Agents, Keep Their 40-Year-Old Cores, PYMNTS, 22 October 2026
- Emprise Bank Selects Maximum to Power Its Next Generation of Banking Infrastructure, Emprise Bank, 15 October 2026
- October 2026: Top five banking technology stories of the month, Tyler Pathe, FinTech Futures, 30 October 2026
- SBS Launches Banking's First Sovereign AI Platform, SBS, 13 October 2026
- NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents, NVIDIA Newsroom, 21 October 2026
- OpenShell Architecture, NVIDIA OpenShell documentation
- BBVA explores new approaches to AI agent security with NVIDIA, BBVA, 21 October 2026
- Bank AI Agents Are Being Sold on Old Cores, With Boundaries Set at Runtime, Faizan Kalemundase, FinTech Edition, 23 October 2026