ABA Banking Journal: Culture eats code for breakfast: Rethinking AI strategy for banks
February 18, 2025 | Alexandra McLeod and Jay Long
Successful AI adoption isn't just about the technology. Success lies in developing a reinforcing loop among a bank’s culture, AI capabilities and business performance that creates enterprise-wide value, improves top and bottom lines and establishes enduring competitive channels.
Are banks ready for AI? Banks across the United States are grappling with artificial intelligence’s potential impact on operations, customers and competition. While some banks are excited about unlocking new levels of growth through AI, many are rightfully cautious about rushing to embrace technologies they may not fully understand.
The challenge of knowing where to begin is universal. All too often, banks start their AI journey by “buying AI,” confusing large investments in digital platforms with effectively harnessing this transformational technology. As a result, return on investment from AI activities has been limited at banks.
When banks struggle with AI initiatives, it’s tempting to blame the technology vendor or assume they have yet to find the right solution. But here’s what most bank CEOs miss: Successful AI adoption isn’t just about technology. It is about creating a three-way reinforcing loop among culture, AI capabilities and business performance that creates enterprise-wide value, improves topline and bottom line, and establishes an enduring competitive moat.
This insight explains why simply purchasing AI technology, whether an AI-powered credit decisioning system or a chatbot for customer service, rarely delivers the expected results. Instead, the most successful banks recognize that AI readiness begins with their workforce and internal processes.
The hidden engine of AI success
Research from the Massachusetts Institute of Technology’s Sloan School of Management reveals a surprising dynamic: Business culture affects AI deployments, and AI deployments affect business culture. When managed well, these relationships create positive feedback loops where improved performance, enabled by AI, leads to an increasingly data-driven culture, which in turn accelerates future technology adoption.
This virtuous cycle has three key stages in banking:
Cultural readiness: Teams understand and embrace data-driven decision-making;
AI implementation: Technology solutions enhance existing banking processes; and
Performance improvement: Measurable gains in efficiency and effectiveness reinforce the value of the data-driven approach.
This cycle explains why some banks make gains with each AI initiative while others struggle to gain traction. The key difference isn’t their choice of technology. Instead, it is the complementary investment in the cultural and organizational foundations that make AI successful. For many banks, this requires a fundamental shift in how they think about digital transformation.
Starting in the right place: A banking perspective
Before investing in AI, banks must focus on three critical areas relevant to banking operations.
First, they must invest in broad-based data literacy across banking functions. Lending teams need to understand how data shapes credit decisions. Compliance teams must grasp how data patterns can flag potential issues. Branch managers should understand how to interpret customer behavior data. Success in this area can be measured through concrete indicators: percentage of decisions supported by data analytics, number of employees actively using data tools, and improvements in risk assessment accuracy.
Second, bank leaders should focus on aligning their organizations around process improvement, starting with core banking operations. This includes forming cross-functional teams that include credit analysts, branch operators, compliance officers and technologists to map and optimize current workflows. This might begin with something as fundamental as a loan origination process or a customer onboarding journey. Progress should be tracked through metrics like reduced manual processing time and increased straight-through processing rates. The critical requirement is ensuring that team expertise is brought together that can generate solutions that solve the right business problems, nest within the organization’s technology architecture, and create the most financial value.
Finally, it is important to foster a culture that embraces data-driven decision-making, particularly in areas where banking traditionally relies on “gut feel” and relationship-based judgments. For banks, this means creating an environment where relationship managers complement their client knowledge with data insights, where credit committees incorporate both traditional and alternative data sources, and where branch managers blend local market expertise with customer behavior analytics.
Successful banks approach this transformation systematically — identifying early adopters in each department, celebrating quick wins and creating formal channels for employees to suggest process improvements based on their data insights. According to research from Deloitte, companies with strong data-driven cultures are twice as likely to exceed their organizational goals.
“The implementation of AI in banking is not a ‘set it and forget it’ endeavor instead it’s a continuous journey of learning, refinement, and adaptation as the technology evolves and customer needs shift. Crucially, this journey also requires ongoing investment in employee understanding and adoption; without their engagement and expertise, the full potential of AI cannot be realized,” said Ryan Jackson, VP of Innovation Strategy at American Bankers Association.
Unlocking the virtuous cycle in banking
When these foundations are in place, something remarkable happens in banking operations. Each successful AI initiative — whether it’s in credit decisioning, fraud detection or customer service — strengthens the bank’s culture of innovation, which in turn improves the ability to execute future AI projects. Banks that successfully create this virtuous cycle typically see 20-30% reduction in loan processing time, improved risk assessment accuracy, higher customer satisfaction scores, and increased employee retention.
This positive feedback loop manifests in ways that also improve core financial metrics. When experienced underwriters participate in developing AI credit models, their expertise gets encoded into systems that help train new credit analysts. When branch managers help design customer intelligence systems, their frontline insights improve both the AI models and the broader team’s understanding of customer behavior. These collaborations create a virtuous cycle where banking expertise enhances AI capabilities, which in turn empowers bankers to serve customers better, all the while improving the bottom line and the bank’s future competitiveness in the market. MIT researchers also found that 75% of firms report improved team morale, collaboration and collective learning after successful AI adoption.
However, banks must remain vigilant about common missteps, such as rushing to implement AI without sufficient data infrastructure, failing to invest in ongoing training or treating AI as a separate initiative rather than an integral part of banking operations.
The path forward for bank leaders
The message for bank CEOs is clear: The fastest path to AI readiness isn’t through technology investments but through creating a culture where the entire organization feels empowered to solve problems with data-driven strategies.
Before evaluating any AI vendor or solution, start by investing in people and processes. Build cross-functional teams that can identify the right problems to solve in your specific banking context. Develop organization-wide data literacy that respects and enhances traditional banking expertise. When banks eventually invest in AI, they will find that having these foundations dramatically improves results. More importantly, they will have built something far more valuable than any single AI implementation: a banking organization capable of turning each new technology investment into a lasting competitive advantage.
ABA Banking Journal: Bank survey: Lower interest rates, return-to-office policies help spur CRE optimism
February 19, 2025
Three in four commercial real estate professionals believe that falling commercial real estate values will lead to increased investment in 2025, according to a new survey by TD Bank.
More than half of CRE investors (52%) believe future interest rate movement — specifically lowering rates — will have the largest effect on the sector, but just 14% expect that effect to come from changing policies and regulations of the new presidential administration, TD Bank said. The majority (70%) of respondents expect housing material prices to rise in 2025, but only 32% expect it to have an impact on investing in new developments.
TD Bank noted that increased confidence in the sector could also be driven by many U.S. companies implementing return-to-office policies, although many CRE professionals and investors are not expecting office work to match pre-Covid levels. Instead, more than two-thirds (68%) of respondents expect mixed-use properties will garner the most traction in 2025.
CISA News: Gmail And Outlook 2FA Warning—Do Not Use This Sign-In
February 15, 2025 | Zak Doffman
For the billions logging into Gmail and Outlook accounts daily, as well as other major email platforms including AOL and Yahoo, there’s a dangerous new attack to worry about. If you think 2FA always keeps you safe, think again. This attack “bypasses two-factor authentication through session hijacking and real-time credential interception.” The dangerous sign-in page you need to avoid is shown below.
The warning comes courtesy of SlashNext, which has just published a report into a new phishing kit dubbed Astaroth. On an infected device, this deploys a man-in-the-middle attack between user and legitimate account sign-in page, “capturing login credentials, tokens, and session cookies in real time, effectively bypassing 2FA.”
This kit was first advertised last month, and “distinguishes itself by not only intercepting login credentials but also by rapidly capturing 2FA authentication tokens and session cookies as they are generated.” The reason this is so dangerous is that its “real-time interception, enabled by a reverse proxy mechanism, allows attackers to bypass 2FA defenses with remarkable speed and precision.”
SlashNext warns that “in contrast, traditional phishing kits typically rely on static fake login pages that capture only primary credentials, often leaving the 2FA layer intact. By dynamically intercepting all authentication data in real time, Astaroth significantly raises the bar, rendering conventional phishing methods and their inherent security measures largely ineffective.”
As ever, it all starts with a link and a click. Which means it’s completely avoidable if you follow the basic guidelines around not clicking links in emails, messages or on social media posts. This link will redirect you to a malicious server “which mirrors the target domain’s appearance and functionality while relaying traffic between the victim and the legitimate login page.” If you select Google, that’s the sign-in page you’re served.
You will see no security warnings and will assume you’re on the legitimate website, the MITM attack intercepts your data and feeds the real webpage behind the scenes. “The user agent and IP address allow attackers to replicate the victim’s session environment and reduce detection risks during login.”
The sense of security you will take from 2FA is completely undermined by this attack. “Because 2FA is always involved (e.g., via SMS codes, authenticator apps, or push notifications), Astaroth automatically captures the entry of the 2FA token in real time. It also ensures that any token entered by the victim is intercepted immediately—the attacker is instantly alerted through a web panel interface and Telegram notifications.”
2FA has other issues, which is why passkeys are catching on so quickly. But this attack also steals session cookies from your browser, which can replicate your authorized session on an attacker’s device. While there are updates in place to tackle such session cookie theft, it remains a huge issue.
This phishing kit in inexpensive and now available. “For $2,000, users receive six months of continuous updates, gaining access to the latest improvements and bypass techniques. To build trust, Astaroth offers testing before purchase, showcasing its legitimacy on cybercrime marketplaces.”
Remember, while many phishing lures remain rudimentary, AI is changing this and they will become harder to detect. The advice is clear. Do not click links. Do not use sign-in popups for the platforms you use except through usual login methods. If you need to revalidate, navigate to a sign-in page through usual channels, never through a link unless it’s one you’ve just requested from a usual channel.
ABA Banking Journal: Bowman calls for ‘system maintenance’ on Fed supervision, rules, applications
February 17, 2025
The Federal Reserve’s regulations and supervisory process require significant “maintenance” to meet the Fed’s statutory mandate on safe and sound banking, Fed Governor Michelle Bowman said today. In a major speech at ABA’s Conference for Community Bankers in Phoenix—coming as current Fed Vice Chair for Supervision Michael Barr is stepping down
from that post at the end of the month—Bowman laid out her vision for a revamp of the Fed’s supervisory and regulatory system.
Supervisory and regulatory ‘system maintenance’
On supervision, she warned that there is an “odd mismatch” between the financial condition of large banks and the supervisory rating they received, asking “whether subjective examiner judgment—those evaluations based on subjective, examiner-driven, non-financial concerns—is driving the firm’s overall rating.” Bowman argued that Fed supervision may have “de-prioritized” core financial risks and “over-emphasized” non-financial risks like IT, operational risk, internal controls and governance—a shift she noted that been observed in supervision of banks of all sizes.
“We should also be vigilant and deliberate about any shift in supervisory focus from financial risk toward non-financial risks and internal processes, as this shift is not focused on fundamental safety and soundness issues and it is not cost-free,” Bowman explained.
Bowman attributed part of this shift in supervision to a system of diffuse accountability for supervisors across the Fed Board of Governors and the regional Fed banks. “Responsibility for supervisory decisions must be coupled with accountability for these decisions,” she said. “The misalignment of responsibility and accountability limits our ability to conduct effective supervision.” Supervisors must also rely less on opaque expectations that allow them to rely “heavily on discretion and judgment with far lower standards for justifying action.”
Bowman called on the Fed to seize opportunities to maintain the regulatory framework. One opportunity—the decennial Economic Growth and Regulatory Paperwork Reduction Act review, currently in progress—has been “underwhelming,” she said, but she expects regulators to be “responsive to concerns raised by the public” during this round.
Improving the application process
Bowman called for updates to the Fed’s approach to evaluating merger and acquisition applications, which she said does not consider a wide enough range of options. She said that the Fed often analyzes only two potential scenarios—both banks remain standalone entities or two banks merge—while ignoring options like acquisition by a credit union or the alternative that a bank may either close or leave a market due to non-viability.
“This analytical approach to evaluating competition no longer remains appropriate, and it needs to be reformed to better reflect actual market realities,” she said. “This must include competition from credit unions, the Farm Credit System, internet banks, financial technology firms and other nonbanks.”
De novo bank applications are stagnant, but that does not necessarily mean that investors do not want to form new banks, Bowman said, noting demand for banking as a service partnerships and so-called “charter strip” acquisitions. “We should consider whether the applications process itself has become an unnecessary impediment to de novo formation,” she said. “As fewer applications come in, institutional muscle memory for how to deal with new bank charters erodes, and it becomes difficult to navigate and ultimately to overcome institutional inertia.”
Since de novos are handled at the reserve bank level but staff have little recent experience with new bank applications, Bowman recommended creating a “specialized resource” at the Board of Governors to assist them in reviewing applications and to help the Fed coordinate and streamline the process with other regulatory authorities.
“Reform of the de novo applications process should not be thought of as a deregulatory exercise. . . . At the same time, if we want to encourage a pipeline of de novo bank formations, we should also be comfortable with the uncertainty that accompanies any new business, including the risk that some de novo banks will not succeed,” Bowman said. “The cost of eliminating the failure of de novo banks—or really of any banks at any time—is simply too great.”
Monetary policy outlook
Bowman—who dissented from a Federal Open Market Committee decision in September 2024 to reduce the fed funds rate target range—said she now believes the monetary policy rate is in “a good place” aligned with economic data. She said she expects inflation to slow further in 2025 but that she “continues to see greater risks to price stability, especially while the labor market remains strong.”
She also warned that the elevated equity prices over 2024 generated easier financial conditions that “may have slowed progress on disinflation” and said she wants to review additional data to “gain greater confidence that progress in lowering inflation will continue” as the FOMC convenes for its next meeting in March.
Learn more about the economic impact of South Dakota's banking industry. Have questions about unclaimed property? We have simplified it for you and included a downloadable PDF right on our homepage.
Thanks to all of your hard work and hearts for serving others in your community, we had some great content to pull from for this year’s, “Banks Make a Difference” publication. Each branch received a mailed copy this month.
The National School for Experienced Ag Bankers is a seminar for experienced ag bankers who want to further develop their ag lending skills, learn new skills, confirm existing methodology and meet fellow bankers who share the same career path. Taught by a nationally-recognized faculty of bankers, academics and other real-world ag banking practitioners, this program is focused on ag lending opportunities and challenges that are relevant to ag bankers from across the United States.
Participating in learning opportunities outside the bank can be challenging. Take advantage of the SDBA's extensive selection of webinars and on-demand training to enhance your banking expertise directly from your computer.
Q: When we have two customers obligated on the same HELOC – Customer A and Customer B – and Customer A obtains a cash advance over the CTR reporting threshold, do we need to include Customer B in the report as well?
A: Though advances on lines of credit involving multiple borrowers are not directly addressed in the CTR filing instructions, FinCEN's CTR FAQs do discuss a conceptually related question on a similar principle - that is, a withdrawal from an account in which there are joint owners:
"24. How do I properly complete Part I on the FinCEN CTR for withdrawals from a joint account? What amounts do we show in Item 22 for each Part I? For example, John and Jane Smith have a joint account together. During one business day, John Smith withdrew $12,000 from the account.[…]
[…]Since John Smith made a withdrawal from the joint account in excess of $10,000, then the financial institution would list Jane Smith’s information only if it has knowledge that the transaction was also being conducted on her behalf. If the financial institution does not have knowledge that the withdrawal was conducted on behalf of Jane Smith, then it would neither be required to nor prohibited from listing Jane Smith in a second Part I.” Frequently Asked Questions Regarding the FinCEN Currency Transaction Report (CTR) #24
As highlighted, an operative fact in such instances is whether the bank has “knowledge” that the advance was also being conducted on Customer B's behalf. Broadly speaking, absent any other facts, in the question presented (and based only on these facts), the bank can conclude that Customer A and Customer B are (likely) jointly and severally obligated on the line of credit; but, unless there are other facts present that would lead to the bank having knowledge that the advance was conducted on behalf (for the benefit of) Customer B as well, then the bank likely would not be required (nor prohibited) from listing them in a second Part I.
Again, this will require a review of all the circumstantial facts, as well as the bank's own CIP, CDD, and BSA / AML policies and procedures.