Operations is the value pool, not the demo
End-to-end operations represent an estimated 60-70% of a bank’s cost base, which is why reusable “operations transformer” agents beat one-off pilots.
Banks do not have an AI problem; they have a deployment problem. The models work. What breaks is core-system access, model risk sign-off, lineage for a regulator and a cost per case nobody measured. This specialisation takes you through the banking value chain, the architecture that actually gets approved, and the use cases that move a P&L line.
Before you design an agent, you need to know which decision you are automating, who owns it today, and what it costs when it is wrong. Part 1 maps the banking value chain end to end, the people accountable at each stage, and what the strategy houses are seeing in 2026.
Six stages, each with its own decisions, failure modes and owners. Select a stage.
Prospecting, application, KYC, identity and account opening.
Credit assessment, limits, pricing, documentation and disbursal.
Servicing requests, disputes, payments exceptions and back-office operations.
Fraud, AML transaction monitoring, sanctions and investigations.
Credit, market and operational risk, stress testing, provisioning and capital.
Regulatory reporting, controls, audit evidence and disclosures.
A SCDAI engineer deploys into someone’s week. These are the five people whose week changes. Select one to light the stages they own.
The 2026 read from McKinsey, BCG, Bain and HBR — functional and firm-wide.
End-to-end operations represent an estimated 60-70% of a bank’s cost base, which is why reusable “operations transformer” agents beat one-off pilots.
Banks that rewire a single frontline domain — not the whole bank — report materially higher revenue per relationship manager and lower cost to serve.
Gen AI could add $200-340bn annually in banking, equivalent to 9-15% of operating profits, overwhelmingly from productivity rather than new revenue.
The firms capturing returns redesign core processes around AI capability. Bolting an assistant onto a process built for humans reliably underdelivers.
Value accrues where AI is embedded behind the few tactics that matter, rather than spread thinly across a portfolio of pilots nobody scales.
In regulated decisions, adoption tracks explainability and recourse far more than raw accuracy. The reviewable agent beats the marginally better one.
Consulted when this program was written, in July 2026. Each entry names the claim on this page that it backs, so the pairing stays checkable if the copy is later edited.
Part 2 is the half most training skips. A banking agent lives or dies on which systems it can reach, which data it is allowed to see, and whether every action it takes can be evidenced two years later.
Six source families, each with its own access path, latency and political owner.
Accounts, balances, postings. Batch-oriented, jealously guarded, rarely queryable in real time.
Finacle, Temenos T24, FIS, MambuISO 20022 and SWIFT MT flows, repair queues and settlement state.
ISO 20022, SWIFT, SEPA, RTPRelationship, KYC profile, interactions. The golden-record problem in its purest form.
Salesforce FSC, MDM hubsExposures, provisions, capital. Governed, reconciled and slow to change.
Data warehouse, BCBS 239 martsPolicies, credit files, contracts, memos, regulatory text. Where most of the answer lives.
SharePoint, ECM, loan filesAlerts, cases, investigations, SAR history. The system of record for “what did we do”.
Actimize, case managementA banking agent that cannot tell a party from a counterparty, or an exposure from a balance, will produce confident nonsense. These are the domains, the graph and the definitions the agent must be grounded on before it is allowed to answer anything.
Six subject areas, each with the entities it holds, its critical data elements and the function accountable for it.
Every person and legal entity the bank deals with, and the roles they play.
The contracts the bank holds with parties: accounts, loans, facilities, limits.
Movements of value and the messages that carry them.
What the bank stands to lose, by counterparty, product and scenario.
Alerts, cases, investigations and the regulatory filings they produce.
What the bank sells and the rules governing how it is sold and serviced.
The entities and the typed relationships between them — what the agent traverses instead of guessing joins. Select any entity.
A person or legal entity known to the bank.
A party in a servicing relationship with the bank.
An arrangement holding value or credit for a customer.
A committed lending arrangement with limits and covenants.
An asset pledged to secure a facility.
A transfer of value in or out of an account.
A monitoring hit requiring disposition.
An investigation opened from one or more alerts.
Amount at risk to a counterparty at a point in time.
An internal or external assessment of credit quality.
The offering an arrangement instantiates.
The governing rule set an arrangement must comply with.
The classification hierarchies that make records comparable across systems.
Retail → Deposits → Savings account → Notice saver
High → Jurisdiction → Sanctioned country exposure
Money laundering → Layering → Rapid movement through multiple accounts
The definitions an agent must use rather than invent. Most wrong answers in this industry are a term used loosely.
The layers a deployment needs, what each one holds, and what the engineer owns there.
Seven layers. Click one to see what it holds and what the engineer owns there.
Core, payments, CRM, case and document stores — reached read-mostly, never bypassed.
Nothing. This is the upstream edge — everything downstream is derived from here.
Read-mostly access paths, change feeds and document streams, under an agreed latency budget.
The book of record for accounts and balances. Every posting is final here and nowhere else, which is why agents read it and never write to it.
ISO 20022 and SWIFT flows in and out of the bank, plus the domestic scheme rails. Message-shaped, not table-shaped, and replayed rather than queried.
Origination, servicing and the limit structures behind a facility. Where committed and drawn diverge, and where most exposure questions are actually answered.
Onboarding records, beneficial-ownership structures, sanctions and PEP screening, and the alert queue investigators work in.
The rating models, provisioning and capital calculations. Outputs are governed numbers with a model behind them, not raw data.
Credit papers, agreements, policy manuals and correspondence — the unstructured half of the estate, and where the answer to a coverage question usually lives.
Negotiating access paths and latency budgets before you promise a workflow.
Promising a real-time workflow over a core that batches overnight. Agree the access path and the latency budget before you agree the use case, not after.
Batch and change-data-capture into a governed landing zone with lineage from the first hop.
Read-mostly access paths, change feeds and document streams from the systems of record.
Replayable, resolved, quality-checked records with their lineage back to the source row.
Reads the source’s own change log rather than polling it, so the platform sees every state a record passed through instead of only where it ended up.
Every extract kept as it arrived, immutable and timestamped. The thing you replay from when a downstream definition turns out to have been wrong.
Layout-aware extraction over the unstructured half of the estate: sectioning, tables, signatures, and the page reference every later citation depends on.
Decides that two records are the same real-world thing, with a survivorship rule and a confidence, so downstream joins are a decision rather than an assumption.
Schema, freshness and volume expectations asserted at the boundary, so a bad load fails loudly here rather than quietly two layers later.
Idempotent pipelines and a watermark strategy that survives a replay at quarter end.
Snapshot loads instead of change capture. It looks identical in a demo and it silently loses every intermediate state, which is exactly what an audit later asks you for.
Catalogue, glossary, governed metrics, entitlements and the knowledge graph that carries meaning.
Replayable, resolved records with lineage from ingestion.
Typed, classified, defined data an agent can be grounded on without inferring meaning.
One agreed definition per term, owned by a named person, so the number an agent quotes means what the business means by it.
The typed entities and relationships the domain actually has, so an agent can traverse "which customers are exposed to this" rather than guess from adjacent text.
Metrics defined once, in one place, with their filters and grain. Removes the class of error where the agent computed something plausible and wrong.
Sensitivity labels and the purpose each classification permits, applied at the field level and inherited by everything downstream.
Where a value came from and what it touched on the way. The layer that makes an answer defensible rather than merely correct.
BCBS 239 lineage and completeness evidence on the numbers that reach a risk report, because the regulator asks how the figure was assembled, not only what it is.
Making sure “exposure” means one thing before an agent is allowed to say it.
Letting the model infer meaning from column names. It will, it will be plausible, and nobody will notice until the number reaches a regulator or a board pack.
Hybrid search over policy and credit corpora, graph traversal for relationships, reranking for precision.
Typed, classified, defined data from the governance layer.
Ranked, permission-trimmed, citable evidence scoped to the caller and the moment.
Vector and lexical retrieval together, because exact identifiers, codes and clause numbers are the thing semantic search is worst at.
Splits on the document’s own structure and carries effective dates, version and source into every chunk, so a retrieved passage knows when it was true.
Applies the caller’s permissions inside the query rather than filtering results afterwards, so the model never sees what the user may not.
Traverses the knowledge graph for questions that are joins rather than similarity — exposure, genealogy, ownership, causation.
Reorders candidates on relevance and returns the passage identifier behind every sentence, so the answer can be checked rather than trusted.
Measured recall on a labelled set — not a vibe check on ten questions.
Filtering results after retrieval instead of constraining the query. The model has already seen the rows you removed, and it will use them.
Tool-calling agents, MCP servers over bank systems, supervisor patterns and human approval gates.
Ranked, permission-trimmed, citable evidence from retrieval.
Actions taken or proposed, each with the evidence, the identity and the trace behind it.
Plans, calls tools and holds the loop. Where the step budget, the timeout and the stopping condition are enforced rather than hoped for.
Typed, permissioned tools with declared schemas. An agent’s real capability surface is this list, which is why the list is a security artefact.
Durable task state with checkpoints, so a run that dies mid-way resumes instead of restarting and re-doing side effects.
Approval steps on the actions that need one, carrying enough context for the approver to actually decide rather than rubber-stamp.
Writes back into the systems people already work in, under a service identity with its own audit trail.
Autonomy boundaries: what the agent may do alone, and what it may only propose.
An agent that acts under a service account rather than on behalf of the user. It will eventually do something the requesting user had no right to do, and the log will not show it.
Input/output policy, PII handling, action allow-lists, model documentation and challenger review.
Proposed actions and drafted responses from the agent layer.
Permitted, grounded, logged output — or a refusal with a stated reason.
The rules that decide whether an action is permitted at all, evaluated before the action and independently of the model that proposed it.
Injection detection on the way in, and on the way out the checks for leakage, unsupported claims and content the domain forbids.
Verifies each assertion resolves to retrieved evidence, and fails the response rather than shipping the sentence that does not.
Model inventory, intended use, validation evidence and the sign-off that lets a model be used for a purpose. Not optional in a regulated estate.
Immutable record of what was asked, retrieved, decided and done — the artefact a reviewer reads when they do not take your word for it.
SR 11-7 / SS1-23 model inventory, validation and ongoing monitoring — a language model used in a decision process is a model, with everything that implies.
The evidence pack that gets the deployment through model risk, written as you build.
Treating an LLM as software rather than as a model. Model risk will disagree, late, and the remediation is architectural rather than cosmetic.
Offline eval sets, online scoring, OpenTelemetry GenAI traces, drift watch and cost per case.
Permitted, grounded, logged output from the guardrail layer.
Measured quality, cost and latency — and the evidence to change any of the three.
Held-out sets and graded runs on every change, so a prompt edit is a measured change rather than a hopeful one.
Blocks a release when quality drops, in CI, on the same evidence for everyone. The difference between a system and a demo.
End-to-end spans across retrieval, model and tool calls, so a bad answer can be opened and read rather than argued about.
Cost per task and per tenant, against throughput and quota. The number that decides whether the pilot can become the rollout.
Watches quality against production traffic rather than the test set, and routes real corrections back into the eval suite.
Proving month three is better than month one, with numbers the CRO accepts.
Evaluating once, before launch. Quality moves with the data, the model and the traffic, and a system with no live measurement has no idea which of the three moved.
SR 11-7 style validation applies. If you cannot document intended use, limitations and monitoring, it does not ship.
Bank secrecy and residency rules often forbid the obvious architecture. Design for in-region inference from day one.
Adverse decisions need a reason a customer can be given and a human can defend.
Assume every prompt, retrieval and action must be reproducible years later. Retention is an architecture decision, not a log setting.
Part 3 is where Parts 1 and 2 meet. Every use case below names the value-chain stage it changes and the architecture layer that carries the weight — then you build it, evaluate it and hand it over.
Filter by stage or by how much autonomy the use case has earned. Selecting a use case jumps the value chain and the architecture to the stage and layer it depends on.
No use cases match that combination.
How a Senior SCDAI Engineer actually runs a banking deployment, week by week.
Sit with the queue. Count the volume, the handle time and the rework. Pick the one decision where volume × error cost is highest and access is achievable.
Build end to end on a real, messy sample under an NDA sandbox. No synthetic demo. The goal is to discover the data truth early, not to impress.
Build the retrieval layer properly, label an eval set with the business owner, and publish a baseline the team agrees is fair.
Start at assist. Move to approve. Only automate the band where evals and human review agree, and write the model risk pack as you go.
Runbook, rollback, on-call, eval suite in CI and a named owner. Success is that they change it next quarter without calling you.
8 modules, 80 taught hours, 40 hands-on labs and 8 assessments — every lab provisioned and graded by the SCIKIQ Agentic AI Playground. Open a module to see its labs.
End-to-end agent design, development, deployment and testing, 10 hours each. Reviewed by a Senior SCDAI Engineer against a published rubric.
Build an agent that triages an AML alert, assembles evidence across four systems, drafts a narrative with citations and routes it for investigator sign-off. Prove recall on known true positives.
Build an agent that spreads statements, extracts covenants, checks policy and drafts a credit memo with page-level sources — then evidence it against a model risk checklist.
Every lab in this program follows the shape below. This is lab 04 in full — the brief you are given, the environment that is provisioned for you, the code you start from and the assertions that decide whether you passed.
Answer a question vector search cannot: which customers are exposed to a delayed counterparty.
You are given a seeded graph of parties, ownership links, facilities and collateral, plus a policy corpus. A counterparty has just been downgraded. Return every customer with direct or indirect exposure to it, the path that creates the exposure, and the aggregate amount — with each hop citable.
def exposed_customers(graph, counterparty_id, max_hops=3):
"""Return [(customer_id, path, amount)] for every exposure route."""
# 1. traverse ownership and guarantee edges outward from the counterparty
# 2. collect facilities whose obligor sits on any returned path
# 3. aggregate committed - drawn, and keep the path for citation
raise NotImplementedError
Every module ends with a timed, randomised assessment delivered through the SCIKIQ Agentic AI Playground. The certificate requires a pass on all of them plus two reviewed capstones.
What each test covers, how long it runs, and how many items are currently in the versioned bank behind it.
| # | Assessment & coverage | Items | Time | In bank |
|---|---|---|---|---|
| 01 | Operating model & discoveryDelivery mandate and boundariesDiscovery techniqueValue sizingScoping and non-goals | 25 | 35 min | 4 |
| 02 | Banking data landscapeCore and payments dataEntity resolutionLineage and BCBS 239Entitlements | 25 | 35 min | 4 |
| 03 | Context engineeringContext designStructured outputsNumeric fidelityRefusal and scope | 25 | 35 min | 4 |
| 04 | Retrieval & groundingChunking and indexingHybrid retrievalGraphRAGRetrieval metrics | 25 | 40 min | 4 |
| 05 | Agent design & autonomyWorkflow vs agentTool and approval designMulti-agent patternsContainment | 25 | 40 min | 4 |
| 06 | Systems integrationMCP tool designIdentity and least privilegeResilienceWrite-back safety | 25 | 35 min | 4 |
| 07 | Risk, fairness & securityModel risk managementFairness testingLLM securityExplainability | 30 | 45 min | 4 |
| 08 | Production & operationsEval gatingObservabilityDrift managementUnit economics and handover | 30 | 45 min | 4 |
Real items, drawn from 32 in this program's bank — weighted toward the scenario and diagnosis types, because those are the ones that predict field performance. Instant feedback, nothing saved.
Four sample items — one attempt each, then the reasoning is shown.
Q1A bank asks you to "add AI to onboarding". What do you establish first?
The engineer sizes volume × error cost before choosing anything technical. That number decides whether the work is worth doing and which decision inside onboarding to target.
Q2Core banking systems are typically batch-oriented. What does that mean for your design?
Promising a real-time workflow on top of a batch core is the classic banking integration failure. Negotiate the latency budget before you promise the workflow.
Q3Your extraction agent returns confident answers for fields that are absent from the document. What is the fix?
Structural constraints beat instructions. Requiring a resolvable span makes absence detectable instead of inviting invention.
Q4A question asks which customers are exposed to a delayed counterparty. Why does vector search struggle?
Vector search finds similar text; a graph encodes who is connected to whom. Multi-hop exposure questions need traversal.
The same ladder whichever specialisation you enter through — what changes is the domain you go deep in. Below: how the program is delivered, the skills it moves, the roles it leads to, and the specialisations closest to this one.
The same labs, assessments and capstones, delivered to an enterprise cohort or to individual professionals.
Cohorts of 20 to 2,000+ on your own tenancy, with your data patterns and your cloud. Skill-gap baselining up front, per-team mastery reporting throughout, and capstones scoped against your real backlog so the output is deployable work.
The same labs, assessments and capstones for individual engineers and analysts, run on shared infrastructure with a fixed cohort calendar. You leave with a graded portfolio, not a certificate of attendance.
Find your row and aim one column right. The Playground scores you against this after every module.
| Skill | Beginner | Intermediate | Advanced |
|---|---|---|---|
| Banking domain fluency | Knows the products. | Maps a workflow to decisions and owners. | Sizes value and designs the operating change. |
| Regulated deployment | Aware of model risk. | Writes model documentation as they build. | Gets deployments through model risk first time. |
| Financial data | Reads a core extract. | Resolves entities and evidences lineage. | Designs the governed data path for agents. |
| Context engineering | Writes clear prompts. | Structures retrieval, tools and state deliberately. | Designs context strategy for reliability and cost at scale. |
| Retrieval & grounding | Builds basic vector search. | Tunes chunking, hybrid search and reranking. | Designs graph + vector grounding with measured recall. |
| Agent orchestration | Runs a single tool-calling agent. | Builds supervised multi-step and multi-agent flows. | Designs autonomy boundaries and failure containment. |
| Tool & system integration | Calls a documented API. | Writes an MCP server over a system of record. | Designs a least-privilege tool estate across systems. |
| Evaluation | Eyeballs outputs. | Builds labelled eval sets and regression gates. | Runs online evals with drift and judge calibration. |
| Observability & cost | Reads logs. | Traces runs, tracks tokens and latency. | Owns cost per task and capacity planning in production. |
| Security & guardrails | Adds output filters. | Mitigates the OWASP LLM Top 10 in a build. | Threat-models an agent estate and proves controls. |
| Client delivery | Takes notes in a workshop. | Runs discovery and scopes a thin slice. | Owns the account technically, from scope to handover. |
The SCDAI ladder is the same whichever specialisation you enter through — what changes is the domain you go deep in.
Skill a team, or join a cohort
B2B cohorts run on your tenancy with capstones scoped to your backlog. B2C cohorts run on a fixed calendar.
Stated plainly enough to rule yourself in or out without a sales call: the prerequisites, how the program runs, exactly what the credential is worth, and the questions everyone asks.
Stated plainly so you can rule yourself in or out without a sales call. Nothing here is a formal qualification — it is what the first lab assumes you can already do.
You should already be able to do these
What we assume, and what we teach
What the program asks of your week
Cohort dates and pricing are confirmed on enquiry rather than printed here, because both move with the intake.
The credential is awarded per specialisation, so it names the domain or stack you were assessed in rather than claiming general competence. On this program the badge reads SCDAI — Banking & Financial Services.
A certificate that cannot be checked is decoration. Every award resolves to a record showing the specialisation, the award date and the assessments passed.
This is the credential the program awards, shown exactly as it is issued — with the specialisation named, the assessment record attached and a verification link anyone can check without an account.
This is to certify that
Your name
has been assessed and certified as
SCIKIQ Certified Data and AI Engineer
Banking & Financial Services
Not “Data and AI Engineer” but the domain or stack you were actually assessed in. A general claim would be a weaker one.
Modules passed, labs graded and both capstones reviewed — so the credential states what was measured rather than that you attended.
The credential ID resolves to a public record showing the specialisation, the award date and the assessments passed.
Add it to your LinkedIn profile in one step. The link pre-fills the certification fields from the credential record, so the entry on your profile matches the record a reader can check.
Add to LinkedIn profile The button is live on your real certificate; here it opens LinkedIn pre-filled with this specialisation so you can see exactly what the profile entry will say.A certificate that cannot be checked is decoration. Every award resolves to a record showing the specialisation, the award date and the assessments passed.
The objections that come up in every conversation about this program, answered without the brochure voice.
Both, and the second is the point. Eight timed assessments and two reviewed capstones stand between you and the credential, so a pass means someone measured the skill rather than recorded your attendance.
Every lab is provisioned, graded and unblocked by the Playground rather than by an instructor. That is what lets a cohort of 2,000 cost the same faculty time as a cohort of 20 — and why you are never waiting on someone to mark your work.
Two retakes are included per assessment, each drawing a fresh item set from the bank, so a retake is a genuinely new paper rather than the same questions again.
For the domain specialisations, no — labs run in provisioned sandboxes. For the four tech-stack programs you will want access to that platform, since deploying into a real subscription is much of the point.
Yes. B2B cohorts run on your own tenancy with your data patterns, a skills baseline before kick-off, per-team mastery reporting, and capstones scoped against your actual backlog so the output is deployable work rather than an exercise.
Take the domain you deploy into. If you move across industries, take a tech-stack program instead and pick up domain context on the engagement. The chooser on the programs page will narrow it.
The trends, platform capabilities and regulatory positions are reviewed each quarter, and every external claim on these pages links to its source so you can check the date yourself.
A graded portfolio: forty machine-graded labs, two reviewed end-to-end agent builds with measured evaluation and cost per task, and a verifiable credential naming your specialisation.
Still deciding?
Tell us the systems you deploy into and we will say plainly whether this specialisation is the right one — or which of the 21 is.