Two announcements this week describe the same bet from opposite ends. Sutherland and FlowX.AI said on October 20 that they will run AI agents on top of the core systems banks already own. A day later BBVA said it will explore NVIDIA’s OpenShell Reference Architecture, which sets limits on what an agent may do while it runs. Read together, they sketch how banks expect to put agents into production: leave the core alone, and control the agent at the edge of its permissions.
This feature walks through how that arrangement works, what each piece of it is responsible for, and what a finance leader should ask before signing one. Every figure below comes from the companies’ own releases or from a Federal Reserve Bank research briefing, and each is linked where it appears.
The sales pitch: agents without a core replacement
On October 20, Sutherland and FlowX.AI announced a go-to-market partnership. Sutherland, which describes itself as an AI-driven business transformation company, will engineer, deploy and run AI agents on the FlowX.AI platform for banking, insurance and other regulated industries in North America and Europe. The release says the work covers workflows “from onboarding and mortgage underwriting to claims, without replacing core systems.”
Advertisement
FlowX.AI contributes its platform and a library of more than 220 enterprise-ready AI agents. Sutherland contributes delivery teams trained and certified on that platform. According to the release, Sutherland will do five things for a client:
- help define the roadmap for AI deployment and the business case;
- redesign fragmented and manual workflows around AI and human collaboration;
- configure ready-made agents or develop new ones for specific business requirements;
- connect agents with the client’s existing applications, data and core technology systems;
- run, monitor and continually improve the AI-enabled operations against agreed business outcomes.
The commercial structure is part of the pitch. The release says customers get end-to-end support “based on committed, outcome-based pricing.” For banking and financial services, the first joint solutions target customer and commercial onboarding, account opening, lending, mortgage underwriting, KYC and anti-money laundering checks, financial crime risk assessment and customer retention.
FlowX.AI’s co-founder and CEO, Ioan Iacob, framed the market in the release. “Regulated industries hold the biggest opportunity for AI, and most of it is still stuck in pilots,” Iacob said. Andrew Wells, Chief Data & AI Officer at Sutherland, said in the same release: “AI creates value only when it becomes part of how the business actually runs.”
The release is a statement of intent from two vendors. It names no bank, gives no deployment date and publishes no performance result. What it does show is the structure of the offer: the agent layer is sold as a managed service, priced against outcomes, and attached to whatever core the bank runs today.
Why the core stays where it is
The “without replacing core systems” line addresses a cost that banks have weighed for years. A Federal Reserve Bank of Kansas City research briefing, Core Banking Systems and Options for Modernization, published on February 28, 2024 by Julian Alcazar, Sam Baird, Emma Cronenweth, Fumiko Hayashi and Ken Isaacson, set out the problem. It states that many depository institutions still run legacy core systems up to 40 years old on mainframe hardware, a figure the authors attribute to McKinsey & Company (2022).
The briefing lists three options for modernizing a core: full replacement, component-based replacement, and wrapping or augmenting the existing system. It also notes that most of these institutions rely on core banking services providers for their core systems and ancillary services, which means any change has to be coordinated with the vendor that runs the core.
Placed against that list, the Sutherland and FlowX.AI offer sits in the third category. The agents wrap the existing system. They read from its data and act through its applications, and the bank’s core provider stays in place. The briefing predates this partnership by more than two years, and it does not mention AI agents. The mapping is ours: an agent layer connected to existing applications and data is a form of augmentation, and it carries the trade-offs of that option, including continued dependence on the core vendor.
The second half: a boundary around the agent
Leaving the core untouched solves one problem and creates another. An agent that connects to existing applications and core systems is an actor inside the bank’s environment. The question for a risk officer becomes what that actor is allowed to do and who can stop it.
On October 21 at GTC Berlin, NVIDIA announced the OpenShell Reference Architecture, which extends NVIDIA’s OpenShell secure runtime software into a full stack. NVIDIA says the architecture “enables building, containing, observing and enforcing safe agents on enterprise infrastructure and edge systems.” The release describes OpenShell as providing “a secure runtime boundary for autonomous agents.” NVIDIA BlueField-4 DPUs run a security framework called NVIDIA Sentry, which provides continuous out-of-band monitoring of agent behavior and in-silicon policy enforcement. In the release’s words, “if an agent attempts to move outside its software boundary, NVIDIA Sentry quarantines and stops it in milliseconds.”
The release lists banks among the early participants, saying Europe’s BBVA and Santander are working with NVIDIA to explore the architecture as a framework for strengthening agent safety, security and governance. It also names security vendors, including 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI and Zscaler, that are integrating support into their agent security products. NVIDIA says the architecture is available now.
NVIDIA’s release also describes a revocation path. ServiceNow, it says, has an AI Passport authority layer that carries policies to OpenShell and Sentry “so enterprises can revoke an AI agent’s access across software and hardware within seconds.” That is a vendor claim in a product announcement, and the release carries NVIDIA’s standard forward-looking-statements notice.
What BBVA actually said
BBVA’s own announcement, dated October 21, 2026, is narrower than a deployment. The bank “has announced plans to work with NVIDIA to explore the potential of the OpenShell Reference Architecture.” The stated purpose is to explore new approaches to embedding security and governance into AI agents from the design stage, as part of a strategy to industrialize the development and deployment of agents across the organization. BBVA also says it ranks first among eurozone banks for its AI strategy, according to Evident.
The announcement explains why monitoring has to continue after launch. AI agents, BBVA says, “can perform a sequence of actions to complete a task, from retrieving information to using external tools,” so security “also depends on the ability to monitor their decisions and actions during execution.” Controls fixed at design time are one layer, and observation while the agent runs is another.
Two executives are quoted. Valentín Sánchez, Global CSO at BBVA, said: “We are expanding the use of AI agents across our organization, and ensuring their security is a priority.” Aser Blanco, Global Banking Lead at NVIDIA, said: “For banks to put their proprietary intelligence to work with agents, clear boundaries and oversight need to accompany every step toward greater autonomy.”
The word that matters in both the BBVA and NVIDIA texts is “explore.” Neither says BBVA has put OpenShell into production. A reader should treat the BBVA item as a signal about where a large bank’s security team is looking, and not as evidence that the control layer has been proven in a bank.
How the layers fit together
Taken together, the three primary documents describe a stack with three jobs.
The core and its applications
This layer holds the accounts, balances, loan records and customer data. The Kansas City Fed briefing says banks depend on their core providers, and the Sutherland and FlowX.AI release says the agents connect to this layer without replacing it. Whatever access the agents receive here defines what they can read and change.
The agent and its operator
FlowX.AI supplies the agents and the platform that governs them. Sutherland configures, runs and monitors them against agreed business outcomes. According to the release, agents have to “securely access existing systems, follow business rules, explain their actions, manage exceptions, and involve people when judgment or approval is required.” The vendors wrote that description of a production agent themselves, and it doubles as a checklist a bank can hold them to.
The runtime boundary
This is the layer NVIDIA and BBVA describe. It sits outside the agent’s own logic and watches what the agent does while it does it. The design assumption is that an agent’s behavior cannot be fully predicted in advance, so a separate system has to be able to stop it. NVIDIA’s release puts monitoring out-of-band and enforcement in hardware for that reason.
The two announcements come from different companies and cover different layers. Neither says the other’s product is part of the deal, and no document links Sutherland, FlowX.AI or their clients to OpenShell. In our reading, a bank that adopts an agent service on top of its core and a runtime boundary around that service would be assembling these layers from separate vendors, and the seams between them become the bank’s responsibility.
What it means for the finance leader
For a CFO, treasurer or head of operations at a financial institution, the practical consequences sit in contracts and controls.
Pricing follows outcomes. The Sutherland and FlowX.AI model uses committed, outcome-based pricing. That shifts the work of defining the outcome onto the buyer. A target such as faster mortgage underwriting needs a baseline measured before the agents start, or the commitment has nothing to be compared against.
The agents inherit the core’s limits. If the Kansas City Fed’s description holds for a given bank, the agent reads data from systems up to four decades old and coordinates with a core provider. Latency, data quality and vendor change windows in the core will show up in the agent’s results.
Someone must own the stop button. NVIDIA describes quarantine in milliseconds and revocation in seconds. A bank buying an agent service needs to know who holds that authority, whether it is the bank’s security team, the operator or the platform vendor, and what the agent is allowed to finish before it is stopped. The Sutherland and FlowX.AI release assigns running and monitoring to Sutherland. It does not say who can halt an agent.
Human involvement is a design choice. The release lists “involve people when judgment or approval is required” as a requirement. The thresholds that trigger a person, such as a loan size or a flagged AML alert, are set by the bank and should be written down before launch.
Earlier coverage applies. We have followed software that acts for a customer from the outside: Stripe’s report of agent purchases on Link, EMVCo’s draft shared intent layer for agentic card payments, and an opinion piece headed Finance Software Should Ship a Client-Messaging Switch for AI Assistants. Agents inside a bank raise a related question about who authorised an action, and the answer has to be kept inside the institution.
Questions to put to a vendor before signing
The documents suggest a short list of requests to make of any provider selling agents into a regulated finance operation:
- Ask for the list of systems and data each agent can read and write, by agent, in writing.
- Ask which party can stop or revoke an agent, how quickly, and what happens to a transaction in flight.
- Ask what monitoring runs outside the agent’s own logic and who receives its alerts.
- Ask for the outcome baseline and how it will be measured under the pricing model.
- Ask how the vendor’s count of prebuilt agents maps to the specific agents in the contract, since a library of more than 220 does not mean 220 are relevant to a lender.
What is still unknown
Several things are missing from the public record. No bank has been named as a Sutherland and FlowX.AI client in the release. No result has been published for the joint offer. BBVA has described an exploration, and the NVIDIA release does not describe a production deployment at any bank. The OpenShell architecture is available now, and the first measured results from a bank using it have not been published.
The architecture the two announcements imply is clear enough to plan around. Agents attach to the existing core, a managed operator runs them, and a separate runtime layer watches and can stop them. A finance leader evaluating any such arrangement should ask where each of those responsibilities sits, put the answers in the contract, and check them against the vendors’ own published descriptions quoted above.
Source: BBVA
