Published
8 MIN READ
AI for Fintechs: What Your App Needs in 2026
AI for fintechs is the use of artificial intelligence in a financial company's credit, fraud and customer service. Since October 15, 2026, the topic has an international benchmark: the 12 final sound practices from the Financial Stability Board (FSB). In the app, they become requirements: inventory, logging per agent, explanation, human review and a contract with the vendor.
The report is not law or a Brazilian regulation, and the FSB itself says it does not create an international standard. Even so, the board recommends that the boards and senior management of financial institutions use the practices as a reference when reviewing AI governance, risk management and controls. Anyone in the fintech app development phase gains a lot by designing these pieces together with the first screens, not after the first incident.
At Wama, AI comes into code and automation, with Claude Code and Framer's agents, and every output goes through human review before it reaches the client. It is the same principle the FSB asks of fintechs: the machine proposes, and someone with authority checks before the decision affects the customer.
What did the FSB publish in October 2026?
On October 15, 2026, the FSB published the final report on sound practices for the responsible adoption of AI, with 12 practices for financial institutions. The FSB press release states that the final version incorporates the public consultation held on the June 2026 draft.
The practices come in two groups. The first four deal with governance across the whole organization: a strategy aligned by senior management, defined roles, AI risk within risk management and the capacity to adapt. The next eight cover the lifecycle of each AI use, from the risk assessment at the start to dependence on vendors.
Two points change the reading for a smaller fintech. The report calls for proportionality: a less complex institution and lower-risk use can apply only the relevant practices. And it treats agentic AI as a source of its own risks, such as unauthorized actions and wrong actions.
What do the 12 practices require from the product?
For whoever builds the app, the lifecycle practices become six product pieces, which go into the database, the contract and the fintech UI/UX.
FSB practice | What it becomes in the product |
|---|---|
Materiality and risk (5) | a record for each AI use, with purpose, risk, owner and approval |
Data governance (7) | training and usage data checked: accurate, complete, consistent and secure |
Explainability and transparency (8) | a readable reason for the decision, for the customer and for the audit |
Performance (9) | a dashboard of accuracy and human correction per use case |
Human oversight (10) | a review queue with real power to change the outcome |
Third parties (12) | a contract with the model vendor, with audit and exit rights |
The record for each use is the starting point. The report describes banks with a central AI inventory: purpose, scope, risk level, dependencies, owners and approvals. In a fintech, that fits on one dashboard screen, planned in fintech software development from the first version.
Logging and traceability for every AI agent
Every AI agent in the app needs its own identity and a complete trail. The FSB asks for each agent to have a unique identifier, separate from human users and other systems, so the institution knows which actions it took and who configured and supervised it.
Traceability answers four questions about each action: what triggered it, what information and tools the agent accessed, what steps it took and whether it stayed within its permissions the whole time. The PDF report also mentions prompt versioning, with version control to roll back to a previous configuration.
In the product, that becomes an event table nobody edits, with the agent, the prompt version, the tool called and the result. When the AI writes to internal systems, the same discipline applies as in connecting an AI agent to company systems: read before write and permissions per tool. The FSB recommends risk-based logging, without piling up volume nobody can analyze.
When does a credit decision need explanation and review?
A credit decision needs explanation and review whenever it is made by the machine alone and affects the customer. Article 20 of the LGPD, Brazil's data protection law, gives data subjects the right to request review of automated decisions that define their credit profile and requires the controller to disclose, upon request, the criteria and procedures used, subject to trade secrets.
The FSB separates two things that often come mixed together. Explainability is how well one understands how the model reaches its output; transparency is the information delivered to each audience, from the board to the customer. A less explainable model can work in some uses, with compensating controls.
The review also needs to be real. The report calls oversight effective when the person has the capacity, authority and incentive to intervene, not box-ticking review. The product helps by recording when the reviewer overrules the AI and why. What the law requires from a product with AI is in the article on LGPD and artificial intelligence.
What to require from the AI model vendor
When a fintech uses a third-party model, the FSB treats that dependence as a risk managed by contract. Practice 12 lists what the contract with the AI vendor needs to guarantee:
the right to monitor the service and receive information about it;
access and audit, including by an independent auditor;
rules for data access, quality and security, with who updates what;
the countries where the data is processed;
business continuity if the service fails;
the right to terminate the contract.
The report makes a warning that catches many people: AI embedded in a tool that is not sold as AI also counts. The CRM, the anti-fraud system or outsourced customer service may have a model inside. In Wama's reading, this list goes into the scope before design, next to the first screens: with a single person from brief to deploy, the contract requirement and the screen that fulfills it do not get lost between teams.
Common mistakes when putting AI in a fintech app
Treating the FSB report as law. It does not create obligations; use it as a list of good practices and check the rule that applies to your license.
Turning on the agent before logging exists. Without an identifier and a trail, nobody can reconstruct what it did after an incident.
Token human review. A queue that only approves in bulk is not effective oversight, and the report says so in no uncertain terms.
Forgetting the knowledge base. Malicious data injected into the base the agent consults changes its behavior over time; the FSB calls this memory poisoning.
Expecting AI to shorten the decision. At Wama, AI sped up building, not deciding, and the total timeline of our projects did not change.
Putting AI in customer service without looking at the channel's rules. Automated service is also subject to the SAC (customer service) rules in the fintech app.
Frequently asked questions
Is the FSB report mandatory for fintechs in Brazil?
No. The FSB itself states that the 12 sound practices do not create an international standard or prescribe how each institution should act. They serve as a reference for boards and senior management to review AI governance and controls. The concrete obligation comes from law and regulation, such as the LGPD in the case of automated decisions.
Does a small fintech need to apply all 12 practices?
It needs to apply what is proportional. The report says a smaller, less complex or less interconnected institution, and lower-risk AI use, can apply only the relevant practices or adapt them. In practice, start with the record for each use, agent logging and human review on decisions that affect the customer.
What is agentic AI in a fintech?
Agentic AI is a system designed to work as an autonomous agent: it decides steps, interacts with other systems and optimizes processes without direct human intervention. In a fintech, it could be the agent that analyzes fraud alerts or answers customers. The FSB asks for a unique identifier, a trail of every action and oversight proportional to the risk.
How much does it cost to put AI in a fintech app?
It depends on scope, and there is no off-the-shelf price for an AI feature. As a reference, a SaaS MVP built by Wama costs between US$ 4,000 and US$ 20,000, depending on complexity. Model usage is a recurring cost, paid to the vendor. The ranges are detailed in how much an MVP costs.
Has Wama built a fintech app before?
Yes. Wama designed and developed the app for Cappta, a payment institution with payment acquiring and white-label digital accounts, with design in Figma and AI support in the build workflow. It also delivered the Milhas Pix platform, from the acquisition page to the offer management and transaction tracking screens.
If your fintech is going to put AI in its app this cycle, design the record for each use, the agent log and the review queue together with the first screens. It is cheaper than rebuilding the trail later. Talk to Wama about your product.
