Spain's BBVA is working with Nvidia to explore how security and governance can be built into artificial intelligence agents from the design stage. The bank is testing Nvidia's OpenShell reference architecture, which isolates workloads, manages credentials and checks that policy limits are respected. The aim is to set operating boundaries, monitor agents' decisions and actions, and contain violations quickly. According to the Spanish press, Santander is taking part in a similar collaboration.
What it means: Banks want to use AI agents for customer service, checks and internal processes, but an agent with access to systems and customer data is essentially a new kind of user with privileges. If it makes a mistake or is manipulated, the consequences can be serious. The approach BBVA is testing treats the agent like an untrusted program: it runs in an isolated environment, receives only the credentials it needs and is checked continuously. That fits the requirements of the DORA regulation on digital operational resilience and the oversight duties in the AI Act. For Greek banks and payment institutions already experimenting with artificial intelligence, the message is that security has to be designed in from the start rather than added later. The same principles apply to smaller software companies building agents for financial clients: isolation, least privilege, logging and the ability to stop the agent immediately. The participation of two large Spanish banks shows the topic has moved from theory to practice.
Related service: myDATA integrations
Related stories
- Whop raises 200 million dollars at a 5.1 billion valuation for its payments and online business platform
- Skyfire and Forter bring AI agent identity to checkout to tell agents from bad bots
- RBC and BMO warn customers not to give AI agents their banking credentials
- PingPong and Santander's Getnet team up on payments in Spain and Portugal
- Paze, the US banks' wallet, targets the 100 largest merchants