The State of Client-Facing GenAI in Financial Services

01The study: scope & respondents

The corpus is 16 conversations with 17 participants — 15 substantive structured interviews (~30–40 minutes, discovery format: open questions about the respondent's own practice, no product pitching). Respondents were sourced through warm professional networks, professional communities, and a paid expert-network screening that specifically delivered in-role practitioners at large institutions.

Why the sample supports conclusions

• It spans the entire maturity spectrum — from a bank with no AI deployed (tender in progress) to a digital bank running hundreds of risk-assessed LLM use cases and a live voice assistant.
• It spans contrasting regulatory regimes — mature (US, UK, EU), transitional (Turkey), emerging (E. Europe, Central Asia) — turning regulation into an observable variable, not a constant.
• It covers both demand and supply, plus advisors who see dozens of institutions at once — allowing self-reported claims to be cross-checked.

Limitations: largely one respondent per organization; a skew toward practitioners over budget-holders; all data self-reported. Where a finding rests on a single voice, we say so.

02Current state of adoption

Every retail-facing institution in the sample either runs a customer chatbot or is procuring one — but GenAI in front of the customer is still the exception. Legacy scripted/NLU bots still carry much of the traffic; GenAI has reached production at digital natives and some large incumbents; voice is live at exactly one respondent institution. Crucially, adoption maturity correlates with segment and operating culture, not with market size: a mid-size Eastern-European bank runs well ahead of a tier-1 bank, and a top digital bank estimates it is roughly four years ahead of the general market.

A second pattern: at conservative institutions, internal AI runs years ahead of client-facing AI. One global tier-1 group deliberately suppressed conversational AI toward customers for ~2 years — unwilling to hand control of client communications to AI — while pouring AI into coding, email and research. A B2B lending bank runs a multi-agent analytics system for ~100 analysts with no customer-facing plans at all.

Text chat is the universal first channel; voice is the frontier — live at one digital bank, secondary at one EU tier-1, and the declared top priority (but a 2027 reality) in a voice-dominant emerging market. The most advanced player measures ~88–89% of dialogues resolved without human escalation — a benchmark for what mature GenAI support achieves. Two institutions quantified automation share: >15% of all client traffic, and 5–10% of support.

03Technology & build-vs-buy

At the mature end a consistent architecture appears: frontier commercial LLMs behind an in-house orchestration and control layer. Institutions buy the models (OpenAI, Anthropic, Google Gemini) through governed cloud marketplaces with versioning and rollback — often under contractual zero-retention — and build the application wrapper, routing and guardrails themselves. In on-prem-only markets, banks self-host open-source models entirely inside the bank perimeter.

Build-vs-buy is a segment-determined default, not one market norm

• Build-first — digitally native, engineering-led organizations build the whole stack (even their own guardrails) and buy almost nothing. For any external oversight vendor, in-house build is the primary competitor here.
• Buy models, build the wrapper — large incumbents in mature markets. The logic is time-to-compliance: pre-built capability shortens the path by years versus internal development.
• Vendor / tender-led — emerging markets buy through formal tenders (3–5 months plus group approvals), valuing vendors precisely for pre-built local regulatory content.

What institutions require of technology and suppliers

• Data perimeter & residency — the hardest gate: strictly on-prem in some markets (cloud banned in banking), EU-resident data on hyperscalers, or contractual zero-retention with GDPR deletion fan-out.
• Certifications & vendor due diligence — SOC 2, ISO 42001, PCI DSS, data-processing agreements: procurement-blocking, and scrutiny extends to the vendor itself, not only the product.
• Governance gates — multi-function approval committees (legal, compliance, data protection, model risk, security, business). The bottleneck is not launching a pilot; it is reaching production — which needs an internal champion.
• Operational — model versioning & rollback, multi-year retention of predictions, staged rollouts, independent model-risk review, local-language capability, and vendor-agnosticism (avoiding single-vendor dependence, incl. geopolitical access risk).

04Use cases

Across the corpus, use cases follow a consistent progression: institutions start with informational FAQ, advance to transactional actions, and only then approach advice-like territory — which conservative incumbents currently suppress and only one US tier-1 has entered in production. Voice follows text with a one-to-two-year lag everywhere except the voice-first emerging market, where it leads the roadmap for cost reasons.

Two structural contrasts. Digital natives run the widest, deepest estate — informational, transactional, voice, internal and autonomous use cases in production simultaneously. Conservative incumbents and B2B players invert the order: internal copilots and back-office agents reach production first, using internal deployment as a controlled environment to build trust before facing the customer. Where support volume is low and human service is the premium, client-facing AI has no business case at all.

05Problems: ranking & classification

The problems reported across the corpus fall into seven classes, ranked below by how often each was named unprompted, whether it produced real incidents, and how central respondents said it is.

Spotlight: regulatory compliance behaves differently

Unlike the content of one dialogue, regulatory compliance operates at the level of the system and the process: framework overlap, speed of implementation, demonstrability to supervisors, and incoming legislation. It is today mostly an anticipated problem — but the only one with dated forcing events, and therefore the most likely to rise in priority over the next 12–24 months.

06Regulation, control & evaluation

Regulation is an observable variable across the sample. In the EU the difficulty named is the overlap of data-protection, conduct and model-risk regimes rather than any single act; roadmaps are paced by the EU AI Act — yet one EU payments provider is driven instead by payments re-licensing. The UK is a sector-driven regime where the conduct regulator sits on top of the data regulator. The US runs on model-risk supervision plus consumer-protection law, with no dated deadline, so adoption is competition-paced. In transitional and emerging markets, the operative constraint is often data localization and cross-border restrictions ahead of any AI-specific law.

Who owns the AI risk

A consistent structure: compliance is a second line and does not own the controls — first-line business/channel owners hold the budget and the controls, and accountability for failure lands on the business-line head. Large institutions run multi-function gate committees; the most advanced digital bank has institutionalized an independent model-risk function as an internal regulator, with a deliberate barrier between builders and reviewers. Where no AI-governance seat exists, engineering owns the controls by default.

How dialogues are evaluated today — a maturity ladder

The market's core deficit is the gap between L3–L4 and L5: the institutions with the largest volumes run the least scalable oversight — and they know it. Oversight priorities converge on prevention over detection ("seeing a hallucination is not enough if intervention is impossible") — yet only the most advanced digital bank actually operates an inline preventive check in production.

07Decision-makers & participants

Decisions follow a two-level model. The strategic decision — permission to put AI in front of customers at all — is a risk-appetite call taken at executive-board level (this is how one global group maintained a de-facto ban for ~2 years; competitive pressure, not readiness, is now forcing the review). The tactical decision — the specific deployment — is funded and commissioned by the first-line business or channel owner.

A second regularity: the more digital the organization, the more the buyer shifts to technology roles — head of data science, Chief AI Officer, head of model risk. Where no dedicated AI roles exist, engineering becomes the default owner of the controls. In emerging markets the decision is formalized through a tender with parent-group approvals.

Who sits on a deployment project

• Business / product owner — commissions the use case and holds the budget.
• Engineering / AI team — orchestration, guardrails, integrations; the principal executor in build-first organizations.
• Customer service / operations — owns the contact centre, quality KPIs and escalations; leads the project in some banks.
• Compliance (second line) — specifies control requirements ("compliance by design").
• Model risk / validation, security & data protection, legal — gate functions: model acceptance, perimeter/PII/certifications, model-provider contracts.
• Procurement, the parent group, and the regulator — tender and due diligence; at the most advanced player, the regulator is a party to proactive dialogue.

The practical implication: multi-party approval makes organizational risk the main project risk. At one provider, deciding who owns the responsibility consumed more resources than the development itself — and without an internal champion prepared to carry the product through internal procedures, deployments do not reach production.

08Development plans & horizons

Roadmaps diverge by segment — from tier-1 plans explicitly conditioned on the EU AI Act, to a digital bank executing an AI-first program (assistant as the main entry point, concierge and wealth assistants, voice already live), to an emerging-market bank with the most concrete calendar in the corpus (platform selection in 2026, voice + chat launch in Q1–Q2 2027, outbound calling the year after, an AI-governance stream within 12–28 months). Vendors forecast mass voice in 1–1.5 years and see guardrail/verification demand as the next step of market maturity.