Why banks can’t policy their way out of shadow AI

Employees at financial institutions are using AI tools their employers never approved for tasks that touch sensitive customer data.  This unsanctioned use of AI, often called shadow AI, is not a toothless problem. In May 2026, an employee at Pennsylvania-based CB Financial Services, parent company of Community Bank, uploaded a file containing customer names, Social Security numbers, and dates of birth into an unauthorized AI application while preparing a presentation. The employee bypassed the bank’s approved AI tool for a personal account on a personal device.  The bank caught the exposure quickly enough to get the data deleted before it could be used to train the vendor’s model. Notably, the bank already offered a sanctioned AI tool. The employee simply chose not to use it.  The instinct inside most banks and credit unions is to treat this as a policy failure and respond with tighter restrictions, more monitoring, and firmer language in the acceptable-use policy. But that response gets the diagnosis wrong, according to Corey Gross, VP and Head of Data & AI at Q2 Holdings. “When employees bypass a sanctioned tool, they’re telling leadership teams that the approved option isn’t getting the job done.” In his view, the root cause sits upstream of governance entirely: institutions are buying AI tools without first understanding the workflows those tools are meant to support. Instead of writing stricter acceptable-use policies, Gross suggests the more useful question is why employees felt they needed to go around the tool they were given in the first place. “It’s rarely a governance or compliance issue,” he said.

The distinction sounds subtle, but it points to a different set of priorities for any bank trying to scale AI responsibly. It suggests that starting with the design of the work itself is more critical than the framing of the rules that surround it.

Workflow redesign has to come before the AI rollout

…


Regions Bank chose a modern core. Here’s what that journey looks like.

Paul Weiss has spent decades running large-scale technology transformations. He knows what the complexity curve looks like, how it stops growing arithmetically at a certain scale and starts growing geometrically. When he joined Regions Bank as Chief Transformation Officer and inherited a core modernization already underway with Temenos, he knew what he was walking into.

What surprised him was the partnership.

“Very rarely have I had a partner that was as transparent and willing to collaborate as Temenos has been,” Weiss said. “Everything they’ve committed to, they’ve delivered. They’ve delivered on time.”

That kind of endorsement carries weight at this particular moment. Regions, with assets north of $155 billion, selected Temenos SaaS in 2023 to modernize its legacy systems for customer records and deposits, and is now roughly two years into an implementation that positions it to be one of the first large US banks to complete a move to a modern core.

The decision to go SaaS was deliberate. “We want to be able to focus on our customers and apply the functionality of the platform, rather than spending our focus on operating the platform,” Weiss said. Continuous upgrades, outsourced resilience, and the ability to redirect engineering attention toward customer outcomes rather than infrastructure maintenance drove the choice.

The goals were set before Weiss arrived. Regions is a customer-driven bank, and the legacy environment was working against that identity. Months-long product development cycles, extensive custom coding, friction at every point of the delivery chain. “The biggest thing we were looking for is end-to-end client responsiveness,” Weiss said, “with the flexibility that we can have with a new modern core.”

What Weiss brought to an already strong team was an engineering background and a specific discipline around managing complexity at scale. A core replacement at a bank like Regions means hundreds of integration points, each carrying its own data, compliance, and risk considerations, all of which have to move in concert. “Once you reach a certain scale, the complexity starts to increase geometrically, not arithmetically,” he said. “Thinking very carefully about how to manage complexity within the cost and timeframe that you have is a learned skill over time.”

The complexity is exactly what’s kept many banks on the sidelines. The appetite for multi-year, high-risk big bang replacements has largely evaporated, a change Temenos’s own executives are watching closely. “The large banks have now realized they can’t get on the AI train unless they really do modernize,” said Will Moroney, Temenos’s Chief Revenue Officer. The conversation has moved from wholesale replacement to progressive modernization, introducing new capabilities for deposits or lending while the legacy platform continues to run alongside, then migrating product by product.

Weiss sees AI reshaping the economics of that journey in ways that weren’t available when Regions started. Had the tools existed at the outset, he estimates the project could have been completed with roughly 30% less time and cost, a significant reduction, and one he believes will lower the barrier for other institutions considering similar moves. The areas where AI would have made the biggest difference: data management, data migration, integration, and testing. “These are all areas where generative AI can play a very strong role,” he said.

Regions has also been developing its own AI tools including Cash Flow IQ and Client IQ, but hasn’t fully deployed them yet. Governance, model validation, and the distance between demonstrated functionality and production readiness are all factors. “There’s a long way to go from demonstrated functionality to bringing it in house with model validation and everything else,” Weiss said. “It’s an exciting development and one that we’ll track through an appropriate governance process.”

Temenos has been focused on embedding AI directly into the platform rather than layering it on top — building “less but better,” with a deliberate narrowing of focus to use cases with broad impact across the client base. The FCM AI Agent, already live at a Tier 1 bank for sanctions screening, started at 5% of traffic and has been gradually expanded as the institution built organizational confidence alongside technical confidence.

Technical readiness first, organizational readiness alongside is a sequencing Weiss recognizes from the transformation playbook. The change management dimension of a core replacement is as demanding as the engineering dimension, and it extends well beyond the technology team. “One of the signatures of a core transformation is there’s a huge number of moving parts and pieces, none of which individually are particularly complex, but all those gears have to fit together in just the right way,” said a Temenos spokesperson.

For Regions, the competitive logic is straightforward. Being among the first large US banks to complete a move to a modern core creates flexibility that legacy-bound competitors won’t have. “We have a customer-centric culture,” Weiss said, “and what we’re doing is empowering our bankers with technology to serve our clients.”

The Quarterly Review: How J.P. Morgan Payments’ Prashant Sharma intends to build the trust infrastructure that agentic commerce will need

In today’s edition, we will spotlight Prashant Sharma, Executive Director of Biometric Payments and Agentic Commerce for Merchant Services at J.P. Morgan Payments.

The focus: Building the scaffolding of governance and trust frameworks that the agentic commerce future will need

Prashant: Our primary objective for agentic commerce efforts at J.P. Morgan Payments is to translate questions about this emerging space into practical operating models for merchants. We want to become a convening force in shaping the shared standards and trusted infrastructure the ecosystem will need going forward.

…

How agentic commerce is making execution, intent, and credit actionable inside payments

Agentic commerce is minimizing the distance between execution, intent, and credit within payments. Functions that once operated in separate layers of the stack are becoming more connected and responsive to one another.

And as that happens, the rest of the stack can’t stay passive. Authorization needs to interpret, not just validate. Credit has to be adjusted per transaction, and infrastructure has to carry context, beyond just credentials.

Across the stack, different players are enabling this shift in different ways, using agentic AI to reduce the friction between how decisions are formed and how they are carried out.

Here’s how it’s playing out.

Stripe and the push to make agents transactable

Stripe is addressing the execution layer of this shift, enabling AI systems to complete transactions once a decision is made.

Its product direction, including work around agentic commerce in addition to stablecoin infrastructure, is aimed at making AI systems economically native. The Agentic Commerce Protocol (ACP), developed with OpenAI, is an attempt to define a shared language between merchants and AI agents so transactions can happen without bespoke integrations for every system.

The firm is trying to normalize the idea that agents will increasingly initiate commerce flows, and the system has to treat that as a normal input.

…


How Block built a $200 billion credit operation by seeing customers traditional lenders can’t

The credit system in the US was built on a fundamental assumption: that past borrowing behavior predicts future risk. That assumption has left roughly 100 million Americans essentially invisible to lenders — no score, thin file, or a history that doesn’t reflect who they actually are financially today. The result is a system that compounds exclusion, requiring debt to unlock debt, and pricing risk so conservatively for anyone outside the norm that the cost of capital itself becomes a barrier.

Juan Hernandez has spent the last decade at Block building lending products for exactly those customers. As head of credit and underwriting, he leads the teams behind Cash App Borrow, Square Loans, and Afterpay — three distinct products serving consumers and small businesses that traditional underwriting models consistently misread or ignore. Block recently crossed $200 billion in credit extended to customers globally.

The engine behind that number is a data advantage. By underwriting from first-party signals native to the Cash App and Square ecosystems rather than relying on sparse bureau data, Block has built models that are both more accurate and more inclusive. Hernandez sat down with Tearsheet to talk about how they built a credit operation at that scale, what it takes to serve the underserved responsibly, and where the product suite is heading next.

Watch the episode

Listen to the full podcast

Subscribe: Apple Podcasts I SoundCloud I Spotify

Read the whole transcript (for TS Pro subscribers)

What the $200 billion milestone means for the customers block serves

…


 

In the world of Stripe: Acquisitions, agentic AI, and stablecoins

Stripe has spent the last decade building itself into the backbone of the internet economy. In this piece, we breakdown its most recent moves to track just how deep Stripe’s role could go in the payments space in the future.

PayPal + Stripe?

Reports suggest that Stripe is considering a PayPal acquisition, although negotiations on the subject are in early stages with no guarantee of going through.

In the background of this acquisition news is Stripe’s growth: The firm announced that it was making a tender offer to employees to sell their stock which valued the company at $159 billion, a 74% increase from its valuation last year.

For Stripe, a PayPal acquisition has quite a few advantages:

A pre-made on-ramp to consumers: PayPal currently has 439 million active consumer and merchant accounts along with digital wallet capabilities and brand recognition with Venmo.

…  

What a bank-client relationship looks like when banks control the data behind the UX

The relationship between clients and banks has been structured around a destination model, where businesses log in, navigate dashboards, export data, and piece together insights.

Grasshopper is working to dismantle that model.

In August 2025, the digital bank launched its Model Context Protocol (MCP) server in partnership with enterprise-grade digital banking solutions provider Narmi to address a specific challenge: enabling clients to use modern AI tools with their financial data without compromising banking security and control standards.

Nate Gruendemann, Director of Product at Grasshopper

“We learned people were uploading their bank statements or transaction files to their [external] AI of choice to run AI-analysis on their finances,” says Nate Gruendemann, Director of Product at Grasshopper. “MCP technology is how we close that gap.”

Technically, MCP sits between Grasshopper’s core banking systems and external AI models, managing authentication, permissions, and data structuring before any client-specific bank data reaches the AI model (e.g., Claude or ChatGPT). 

“In practice, this allows us to expose meaningful financial context while keeping the core banking system insulated,” notes Gruendemann.

But the key design choice lies in what MCP doesn’t allow. The system is built on the assumption that AI models are untrusted environments. MCP is fully opt-in, which means clients must authorize Claude or ChatGPT and authenticate with their banking credentials. The server can see only the data the user is permitted to access, and the entire system is currently read-only. This means AI tools and platforms can analyze information, but cannot act on it independently. For example, they cannot initiate transactions or modify account data.

“We secure the banking infrastructure and access layer, while clients maintain control over how they use their chosen AI tools,” adds Gruendemann.

This indicates Grasshopper isn’t focused on owning the user experience, but on controlling the underlying data layer that powers it.

The rationale behind building a user-facing layer outside the core banking system

  …


Tearsheet Pro

Why fintechs are transitioning from partners to principals in banking

Fintech’s core value proposition was that financial services could be delivered without owning a bank charter. That model produced an entire generation of financial companies. But it also created a structural dependency: fintechs could innovate quickly and focus on software, distribution, and user experience, yet the underlying regulatory authority, lending licenses, deposit insurance, and access to the financial system, remained largely with partner banks.

By early 2026, signs of a shift in that architecture have started to emerge. Within the last three months, three prominent fintechs have applied for bank charters. Buy-now-pay-later provider Affirm applied to establish a bank subsidiary, followed by cross-border payments platform Payoneer, which filed for a national trust bank to support stablecoin infrastructure. And this month, AI lending platform Upstart applied to become a national bank.

One quarter, three charters

These charter applications are fueled by different objectives.

Affirm: Owning the lending stack

In January, Affirm applied to establish Affirm Bank, a Nevada-chartered industrial loan company regulated by state authorities and the Federal Deposit Insurance Corporation (FDIC).

Industrial loan companies (ILCs) can be owned by commercial companies while still operating as FDIC-insured banks, allowing non-bank firms to enter banking without becoming traditional bank holding companies.

For Affirm, the charter could change the economics and structure of its lending platform. The firm can reduce reliance on partners and take greater control over the credit lifecycle, better manage funding costs, expand the scope of its products, and align underwriting, funding, and servicing under a single roof.

…


Tearsheet Pro

The Quarterly Review: Wise’s Scott Viohl wins audiences through humor and creator-led marketing

 
 

In this edition we will check back in with Scott Viohl, Regional Marketing Lead for North America, at Wise.

 

Executive summary

When we last checked in with Viohl, he was focused on deepening the firm’s presence in the region and analyzing its campaigns to sharpen future efforts.

Over the past four months, his priorities have centered on scaling Wise’s North American footprint, refining how the team measures campaign performance, and pushing creative boundaries through a new wave of creator-led advertising.

Here is what Viohl accomplished:

  • Scaled Wise’s North American brand presence through its biggest-ever TV campaign, reaching over 80% of adults in key US markets and over 60% in target Canadian regions, while delivering double-digit lifts in brand awareness and measurable growth in new customers and transactions.
  • Launched a creator-led campaign built around the bespoke fictional character “Don T. Overpay,” proving that native, entertainment-first content can drive stronger organic engagement than traditional product-focused advertising.

  …

Coinbase rides the waves of stress and opportunity with its ‘Everything Exchange’ vision

    Coinbase is trying to bridge two financial worlds: crypto and traditional finance, while navigating the challenges of public policy.

    Coinbase [NASDAQ: COIN] is outgrowing its early role as a simple crypto exchange.

    Recent moves suggest that the firm is evolving into a unified platform for multiple financial assets and services, positioning itself as a bridge between traditional finance and the digital asset economy. This transformation is guided by what the company calls its “Everything Exchange” strategy – a term it began emphasizing in late 2025 – aimed at removing boundaries between asset classes and offering trading, financial services, and developer infrastructure within a single integrated platform.

    “Our Everything Exchange vision is about removing artificial boundaries between asset classes and building for the next generation of markets,” the company noted in its recent press release.

    But broadening that scope also exposes Coinbase to new regulatory, competitive, and market pressures: the balancing acts that come with trying to be more than a crypto exchange.

    Everything Exchange comes to life

    …


    subscription wall for TS Pro