TL;DR: Banking digitalisation, automation, cyber security, AI for AML, and customer experience across life, health, wealth, lending, and payments cluster into a pattern that financial services programmes now have to align operational change with identity and control decisions, according to Comarch. The governance issue is not whether to digitise, but how to keep access, trust, and user experience coherent while processes become more automated.
At a glance
What this is: This is a Comarch content overview that clusters banking digitalisation, automation, AI for AML, cyber security, and customer experience into one finance transformation theme.
Why it matters: It matters because IAM, IGA, PAM, and NHI governance teams in regulated finance have to align access controls with automation, trust, and customer-facing change.
Context
Comarch’s material is not a single product announcement or a narrow how-to. It points to a broader financial services transformation agenda where digitalisation, automation, cyber security, AI-assisted AML, and customer experience are being treated as connected programme decisions rather than separate workstreams.
The core identity question underneath that agenda is governance. As banks, insurers, wealth firms, lenders, and payment providers automate more activity, they have to keep access decisions, customer trust, and operational control aligned across human users, service accounts, and AI-enabled workflows.
Key questions
Q: How should banks govern access for automated lending and payments workflows?
A: Banks should govern automated lending and payments workflows as identity subjects with clear ownership, least-privilege scope, and a defined revocation path. Each service account, API token, or delegated permission should be tied to a specific business process, then reviewed when that process changes. The control objective is lifecycle alignment, not just initial provisioning.
Q: Why does AI for AML still need strong access governance?
A: AI for AML still depends on governed access because model quality is only as good as the data, permissions, and change controls around it. If the wrong people can tune thresholds, move case data, or override outputs, the model can accelerate poor decisions instead of improving detection. Governance makes the output defensible.
Q: What breaks when banking automation is built without lifecycle controls?
A: When banking automation lacks lifecycle controls, access often outlives the workflow that created it. That can leave service accounts, privileged users, or delegated approvals active after a lending, payments, or customer-service process has ended. The result is unnecessary exposure, weak accountability, and harder audit evidence.
Q: How do security and customer experience fit together in digital banking?
A: Security and customer experience fit together when controls are designed around the journey rather than bolted on afterward. Good teams place authentication, step-up checks, and entitlement controls where they reduce risk without creating avoidable friction. In practice, the question is not whether to add controls, but where they belong in the flow.
Technical breakdown
Digital banking transformation changes the control plane, not just the channel
Digitalisation in finance is often described as a front-end change, but the real shift is in how work gets authorised, routed, and evidenced. When banking, insurance, lending, and payments processes move into automated workflows, the control plane expands to include access approvals, data handoffs, exception handling, and audit trails across multiple systems. That changes IAM, PAM, and lifecycle governance because the identity behind an action may no longer be a person at the keyboard. In regulated environments, the operating model has to prove who or what acted, under what authority, and with what boundaries.
Practical implication: Map each digital workflow to the identity type executing it and verify that approvals, logs, and revocation paths still make sense when the process is automated.
AI for AML depends on governed data, not just better detection models
AI in AML is attractive because traditional rule sets struggle with scale, noise, and pattern drift. But the value of an AML model depends on the quality of the underlying data, the permissions that govern access to that data, and the controls around who can tune or override the model. Without that governance, AI can speed up weak decisions rather than improve them. For banks and financial services firms, the identity problem is not only analyst access. It also includes service identities moving case data, model operators changing thresholds, and downstream systems consuming alerts.
Practical implication: Treat AI-enabled AML as a governed access and data flow problem, with explicit ownership for model access, tuning rights, and alert handling.
Customer experience and security have to be designed together in financial services
The article’s repeated emphasis on user friendliness shows the familiar tension in finance: stricter security can easily degrade digital adoption if it is bolted on late. Good control design does not mean removing friction everywhere. It means placing verification, entitlement checks, and step-up controls where they reduce risk without breaking the customer journey or the back-office workflow. That applies to SMEs, wealth clients, international payments, and corporate banking alike. The governance mistake is to separate customer experience from identity control design, as if one is a business issue and the other a security issue.
Practical implication: Review customer and employee journeys together so authentication, authorisation, and fraud controls are built into the process design rather than added after launch.
Breaches seen in the wild
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Banking digitalisation is now an identity governance programme in disguise. The article clusters automation, cyber security, AML, and customer experience because finance transformation now changes how authority is issued and consumed. That means IAM and IGA teams are no longer supporting the business from the side line. They are governing the operational shape of the business itself, especially where workflows span humans, services, and decision systems.
AI-led AML only helps when the surrounding access model is trustworthy. An AI model cannot compensate for poor data entitlement, weak model-change controls, or unclear ownership of alert handling. The problem is not model intelligence alone. It is whether the surrounding identity and access boundaries make the output defensible enough for regulated decision-making.
Process automation creates a lifecycle problem, not just an efficiency problem. When lending, payments, and customer service become more automated, access can outlive the task, the campaign, or the control objective that created it. Financial institutions need to stop treating automation as a static deployment and start treating it as a governed identity lifecycle with clear issuance, review, and revocation points.
Customer experience is now inseparable from trust architecture. The article’s focus on being user friendly reflects a wider market truth: financial services cannot win digital adoption if security and identity controls are introduced as invisible afterthoughts. The winning pattern is not less governance. It is better-timed governance that supports the user journey while preserving auditability and accountability.
Named concept: control coherence across digital finance. The underlying challenge is keeping identity, automation, security, and customer experience aligned as programmes modernise. Practitioners should read this as a warning against fragmented transformation, where each workstream optimises locally and weakens the overall operating model.
What this signals
Control coherence across digital finance: The key governance task is to keep identity, automation, security, and customer experience aligned as finance becomes more software-driven. When those workstreams are managed separately, organisations create local efficiency but systemic control drift.
In regulated finance, the practical test is whether each automated process still has a clear owner, a revocation path, and an evidence trail. If any one of those is missing, the transformation may be visible to customers but not governable by the security team.
For practitioners
- Align automation with identity ownership Inventory the finance workflows being digitised and assign a clear identity owner for each one, including human users, service accounts, and AI-assisted steps. The goal is to know who can approve, execute, and revoke access at each stage of the process.
- Separate model access from model output For AI-supported AML and related controls, define who may train, tune, approve, and override the model, and keep those rights distinct from day-to-day alert review. This reduces the chance that operational convenience becomes governance drift.
- Design customer journeys with security checkpoints Place authentication, authorisation, and step-up controls at points where they protect the transaction without forcing unnecessary friction across banking, lending, and payments journeys. That usually means testing the journey and the control together, not separately.
- Tie automation to revocation and review Build explicit offboarding, review, and exception-handling steps into automated finance processes so access does not continue after the task, campaign, or workflow has ended. This is especially important where service identities touch payment, lending, or customer data.
Key takeaways
- Banking digitalisation is not only a channel shift. It changes who or what is authorised to act across finance workflows.
- AI for AML depends on governed data access and controlled model changes, or it simply automates weak decision-making.
- Customer experience, automation, and identity control need to be designed together if digital finance programmes are going to stay both usable and governable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on controlling access as finance workflows automate and expand. |
| Recommendation — Apply PR.AA-05 to keep automated finance entitlements aligned with the process and role that actually needs them. | ||
| CIS Controls v8 | CIS-5 — Account Management | Automated banking workflows rely on managed accounts, service identities, and revocation discipline. |
| Recommendation — Use CIS-5 to govern account creation, usage, and removal across digitised finance processes. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article’s automation theme depends on managing credentials and authenticators across workflows. |
| AC-6 — Least Privilege | AI-led AML and workflow automation increase the risk of overbroad operational access. | |
| Recommendation — Enforce IA-5 to rotate and retire authenticators used by automated finance services and operators. Apply AC-6 to limit who can tune, approve, and execute automated finance controls. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access Control | The article is fundamentally about keeping access coherent as business processes digitise. |
| Recommendation — Implement A.5.15 so finance automation remains tied to explicit access rules and approvals. | ||
Key terms
- Digital Transformation in Banking: Digital transformation in banking is the redesign of products, channels, and operations so the institution can compete in mobile, online, and data-driven markets. It goes beyond adding apps or new channels. The real test is whether the bank can deliver faster service, simpler journeys, and better economics than its legacy model.
- AI-Enabled AML: The use of machine-assisted analytics to detect suspicious financial activity and reduce false positives. The governance challenge is that model outputs depend on controlled data access, change management, and human accountability for overrides and escalation.
- Control coherence: The degree to which security and identity controls behave consistently across different platforms, identity types, and operational contexts. Coherence matters because fragmented enforcement creates blind spots, audit gaps, and uneven risk, even when individual controls look strong in isolation.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.
Published by the NHIMG editorial team on July 8, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org