Embedded finance and AI fraud are reshaping banking trust

At a glance

What this is: A recorded Money20/20 Europe discussion shows senior banking leaders reframing trust as a live governance problem across fraud, embedded finance, cloud infrastructure, and compliance.

Why it matters: IAM, PAM, and NHI teams need to read this as a signal that banking trust increasingly depends on continuous access governance across people, systems, and payment workflows.

Context

Embedded finance and AI-driven fraud are changing what banking trust means in practice. As institutions move credit, payments, and risk decisions into faster digital flows, access governance has to keep pace with machine-speed decisioning, cloud-native infrastructure, and regulated operational models.

This episode from Money20/20 Europe brings together leaders from banking, payments, compliance, and risk to describe that shift. The common thread is not a single tool or vendor strategy, but the operational pressure to preserve trust while shortening the distance between customer request, system decision, and regulatory accountability.

Key questions

Q: How should banks govern embedded finance journeys that rely on partner access?

A: Banks should treat embedded finance as delegated access, not just integration. Every partner journey needs an owner, an approval path, and a revocation process so the institution can see who can initiate value-bearing actions and remove access when the relationship changes.

Q: Why do AI-enabled fraud operations increase risk for organisations that rely on human review alone?

A: AI-enabled fraud raises risk because it lowers the skill barrier, increases message quality, and lets attackers run campaigns at greater volume and speed. When organisations depend on manual review alone, they struggle to keep pace with coordinated abuse that can mimic legitimate business processes. That combination creates more successful deception, faster escalation, and less time to intervene.

Q: What breaks when cloud-native banking does not govern service accounts like privileged users?

A: The bank loses visibility into which machine identities can alter data, move funds, or change workflows. That creates hidden blast radius, because a compromised operational account can affect customer outcomes even when human access looks well controlled.

Q: Should compliance teams prioritise speed or control in modern banking platforms?

A: They should optimise for both, but only if control is continuous rather than periodic. In fast-moving banking environments, trust depends on whether access, monitoring, and delegation still match the live operating model after each change, not on quarterly evidence alone.

Technical breakdown

How embedded finance changes trust boundaries

Embedded finance moves banking capabilities into third-party journeys, which means the trust boundary no longer sits neatly inside the bank perimeter. Identity decisions are distributed across partner applications, payment flows, and API-mediated services, so authorization and monitoring must extend beyond the core banking stack. That creates governance complexity because the institution remains accountable for activity that is partially executed elsewhere. In practice, the bank has to know which identities can initiate value-bearing actions, which partners can delegate those actions, and how quickly access can be withdrawn when the relationship changes.

Practical implication: map every partner-facing payment or lending flow to the identities that can initiate, approve, or modify it.

Why AI fraud changes identity risk decisions

AI-driven fraud increases the speed and plausibility of attacks, which weakens controls that depend on human review alone. Fraud teams now have to distinguish legitimate automation from adversarial automation, especially when requests, account changes, or payment instructions arrive at machine speed. This is not just a detection problem. It also changes how confidence is assigned to identity signals, how step-up verification is triggered, and how exceptions are governed when user behaviour no longer looks obviously anomalous to a person in the loop.

Practical implication: align fraud controls with identity assurance signals that can be evaluated in real time, not only after review.

Cloud-native banking depends on governance of service access

Cloud infrastructure gives banks agility, but it also multiplies the number of services, integrations, and machine identities that can affect customer-facing trust. In cloud-native environments, access is not only about employee sign-in. It also includes service-to-service permissions, deployment credentials, and operational accounts that can alter data, move funds, or change workflows. When those privileges are loosely governed, the institution may move faster while actually widening the blast radius of a compromise or configuration mistake. Continuous inventory and lifecycle control become central to risk management.

Practical implication: treat cloud service accounts and operational permissions as part of the same governance model as human privileged access.

Threat narrative

Attacker objective: The attacker objective is to exploit fast-moving financial workflows so fraudulent actions pass as legitimate customer or partner activity.

1. Entry occurs through trusted digital banking channels, partner workflows, or automated payment paths where legitimacy is assumed at the start of the interaction.
2. Escalation happens when fraudsters or abusive automation exploit fast decisions, embedded journeys, or cloud-connected services to push requests beyond intended controls.
3. Impact appears as compromised lending, payment abuse, or monitoring blind spots that erode trust while the organisation continues to process business at speed.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Embedded finance turns trust into a distributed identity problem: when banking functions are exposed through partner journeys, the control plane is no longer limited to the core institution. Authorization, delegation, and revocation now span banks, platforms, and payment workflows. That means the real governance question is not whether a bank owns the account, but whether it still controls the action path end to end.

AI fraud compresses the time available for trust decisions: fraud models built around user hesitation, manual review, or obvious behavioural anomalies lose effectiveness when requests arrive at machine speed. The result is a governance gap between the pace of attack and the pace of decision. Institutions need assurance models that can evaluate intent, context, and risk in the same transaction window.

Cloud-native banking increases identity blast radius unless service access is governed like customer access: operational accounts, deployment roles, and machine permissions can change customer outcomes as directly as a human banker can. The practical implication is that identity governance can no longer stop at workforce IAM. It has to include service accounts, privileged workflows, and revocation discipline across the delivery chain.

Compliance is shifting from periodic control evidence to continuous trust maintenance: the article’s leaders describe a market where regulatory pressure, fraud pressure, and innovation pressure arrive at the same time. That changes the governance baseline. Banking programmes that only prove control existence will not be enough; they have to prove that access, monitoring, and decisioning still match the current operating model.

Modern banking now requires a unified access model across people, systems, and partners: the embedded finance pattern makes fragmented governance too slow to be safe. A bank that cannot see who can act, through which channel, and under what delegated authority will keep trading speed for assurance. Practitioners should treat cross-domain identity governance as a core operating requirement, not a back-office control.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Embedded finance raises the cost of incomplete delegation mapping: if partner journeys can initiate money movement or account change, identity governance has to extend into the external workflow rather than stop at the bank boundary. Programmes that cannot trace delegated authority end to end will struggle to prove control over real business actions.

AI fraud pushes verification closer to the transaction boundary: the more adversarial automation shapes banking interactions, the less useful it is to rely on after-the-fact review. Security and risk teams should expect assurance models to move toward live signals, continuous monitoring, and faster exception handling.

Cloud-native banking makes service accounts part of the customer trust story: operational identities now influence the same outcomes that human users do. That means access governance, privileged review, and revocation discipline need to cover service accounts, deployment roles, and partner-linked system access together.

For practitioners

• Define trust boundaries for embedded finance flows Inventory every partner journey that can initiate payments, lending actions, or account changes, then assign an owner for each delegated decision path.
• Align fraud signals with live identity assurance Use real-time checks for device, session, and behavioural context where AI-driven fraud can outrun manual review and standard step-up steps.
• Bring cloud service accounts into privileged governance Include deployment roles, operational accounts, and service-to-service permissions in the same review cycle used for high-risk human access.
• Test revocation across partner and cloud dependencies Validate that delegated access can be withdrawn cleanly when a partner relationship changes, a service is retired, or a workflow is reconfigured.
• Calibrate compliance evidence to continuous operations Shift from point-in-time attestations to evidence that shows who can act, what they can change, and how quickly controls adapt when the banking model changes.

Key takeaways

• Embedded finance and AI fraud are forcing banks to rethink trust as a live governance issue rather than a static control problem.
• The central risk is not only customer deception but also delegated access paths and machine-speed decisioning that outpace manual oversight.
• Practitioners should extend identity governance to partner workflows, cloud service accounts, and continuous assurance signals.

Key terms

• Embedded Finance: Financial services delivered inside another product or customer journey rather than through a standalone banking channel. The governance challenge is that identity, risk, and accountability spread across multiple organisations, making delegated access and assurance controls just as important as the customer experience itself.
• AI-Driven Fraud: AI-driven fraud is deception carried out with artificial intelligence to scale, adapt, or conceal malicious activity. It includes synthetic identities, deepfakes, automated social engineering, and fraud workflows that learn from defenses. In practice, AI increases speed, personalization, and volume while reducing the human effort needed to execute and refine attacks.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Cloud-Native Banking: Banking platforms built on cloud services, APIs, and modular delivery patterns rather than fixed monolithic systems. Identity governance must be designed into this model because access paths, operational roles, and service trust relationships change more quickly than traditional audit cycles.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.