A few years ago, a founder pitching a personal finance app was mostly describing a nicer interface layered over the same spreadsheet logic everyone already used. In 2026, the pitch usually starts with what a large language model can do with a customer’s transaction history, a loan application, or an investment portfolio that a human adviser would otherwise take hours to work through properly. Generative AI has changed what a two-person financial services startup can credibly promise a customer.
It has changed very little about how the sector is regulated, and that gap is where most of the actual work sits. Financial services is one of the categories in Australia where the upside from building something good is significant, and the cost of building something careless lands fast, publicly, and with a regulator’s name attached to it.
This piece works through what is driving the shift into generative AI across financial services, what the regulatory picture looks like heading into the back half of 2026, where AI-generated prototypes tend to fall over once customer money and financial data are involved, and what a build sequence that survives scrutiny looks like in practice.
The adoption numbers, and why they undersell the story
Global research backs up what founders describe anecdotally. The University of Cambridge’s 2026 Global AI in Financial Services Report, produced by the Cambridge Centre for Alternative Finance with the Bank for International Settlements, the IMF and the World Economic Forum, surveyed more than 600 financial institutions, AI vendors and regulators across 151 jurisdictions. 81% of financial services firms reported adopting AI at some level, with fintechs consistently ahead of the incumbent banks and insurers they compete against on every maturity measure the report tracked.
EY’s Generative AI in Banking survey tells a similar story from inside the banks themselves. In the 2025 edition, 77% of banks had actively launched or soft-launched a generative AI application, up sharply from two years earlier, with 90% at least at the beta-testing stage.
The scale of the opportunity has been quantified for a while now. McKinsey Global Institute’s often-cited estimate, first published in 2023 and still the reference figure most of the industry works from, put the value generative AI could add to global banking at $200 billion to $340 billion a year, largely through productivity gains rather than new revenue. That figure represents a ceiling for the whole industry rather than a forecast for any single business. The more useful signal for a founder is the direction every one of these reports points in: appetite for AI in financial services keeps climbing, and the businesses actually capturing value from it tend to be smaller and faster moving than the household names funding the research.
Where the intelligence is actually landing
The word “smarter” gets used loosely in this space, so it is worth being specific about what it means inside an Australian financial services business. ASIC’s own review of AI use among licensees gives a locally grounded picture, since it was pulled directly from what banks, insurers, credit providers and financial advice businesses were actually running, not from vendor marketing.
Across the 624 use cases ASIC examined in that review, five categories stood out.
- Credit decisioning and management. Predicting default risk to support a decision, monitoring existing credit holders to inform contact and collection strategies, and prioritising which customers to follow up first.
- Fraud detection. Transaction monitoring, identifying fraudulent documents or claims, spotting mule accounts and account takeovers, and flagging customers who may be vulnerable to scams before money leaves their account.
- Customer engagement. Cash flow forecasting and budgeting tools that help customers understand their own finances, and generative AI summarising customer complaints so staff can respond faster and more consistently.
- Business efficiency and compliance. Document indexing to speed up loan and insurance processing, triaging incoming complaints, and picking up signs of financial hardship in conversations a stretched staff member might otherwise miss.
- Pricing and insurance. Predicting which customers are likely to switch providers to inform retention offers, and using AI to extract and summarise key information from insurance claims and underwriting documents.
The pattern across nearly all of these use cases: AI supports a decision a person still makes, rather than making the decision on its own. That lines up closely with where regulators want the technology to sit, and it is also where the efficiency gains actually show up, in the document-heavy, judgement-adjacent work that used to eat a disproportionate share of a financial services team’s week.
Financial services plays by its own regulatory rulebook
Most product categories let a founder build first and think about compliance once the idea has proven itself. Financial services rarely allows that order of operations. Once a product touches money, credit decisions, or someone’s financial data, four separate Australian regulators can have a legitimate interest in what it does, no matter how early stage the business behind it is.
The Australian Securities and Investments Commission (ASIC) oversees conduct and licensing across financial services and credit, including Australian Financial Services (AFS) licences and credit licences. The Australian Prudential Regulation Authority (APRA) supervises banks, insurers and superannuation trustees for stability and operational resilience. The Office of the Australian Information Commissioner (OAIC) administers the Privacy Act. AUSTRAC sits across anti-money laundering and counter-terrorism financing obligations. All four have made it clear that existing obligations apply in full to AI-powered products, whether a licence application is filed or not.
That “technology neutral” framing matters more than it sounds. ASIC’s Report 798, Beware the gap, released in October 2024, reviewed 624 AI use cases across 23 financial services and credit licensees and found 92% of the generative AI use cases sampled had launched in the previous year or were still in development. Nearly half of the licensees reviewed had no policy addressing consumer fairness or bias in their AI systems, and fewer still had considered whether AI use needed to be disclosed to the customer at all. ASIC chair Joe Longo put the risk plainly: governance was not keeping pace with adoption, and the gap widens the faster competitive pressure pushes AI use forward.
Both ASIC and APRA sharpened that message again in the first half of 2026. APRA’s 30 April letter to industry called for a step-change in how banks, insurers and superannuation trustees manage AI risk, pointing to boards leaning on vendor presentations instead of examining model risk directly, and to entities that had grown dependent on a single AI provider across multiple functions with no plan for what happens if that provider fails. Eight days later, ASIC followed with an open letter from Commissioner Simone Constant warning that frontier AI models were intensifying the cyber threat environment for every AFS licensee and market participant, describing the situation as “a minute to midnight.” The letter arrived within a fortnight of a $2.5 million Federal Court penalty against AFS licensee FIIG Securities for cyber security failures, the first civil penalty of its kind handed down under general AFS licence obligations.
For anyone building here, APRA’s CPS 230 standard on operational risk management is worth understanding early rather than late. It has applied to all APRA-regulated entities since 1 July 2025, and it requires those entities to treat AI vendors the same way they would treat any other material service provider: identified, risk assessed, and under a contract that meets CPS 230’s requirements by the earlier of the contract’s next renewal or 1 July 2026. A financial services founder building on top of a large language model provider should expect an APRA-regulated customer to ask about precisely this.
The Privacy Act adds another layer, separate from licensing altogether. From 10 December 2026, new transparency requirements around automated decision-making come into effect, requiring anyone using AI to influence a decision about an individual to explain, in plain language, what the system does and why. Anti-money laundering obligations sit on top of all of this again for anything that moves money. None of these rules was written with a two-person AI startup in mind, and none of them cares that the founder currently is one.
The Consumer Data Right, Australia’s open banking framework, adds a cost that catches plenty of pre-revenue fintech founders off guard. Hyper’s own submission to the 2021 Senate inquiry into financial technology and regulatory technology put CDR accreditation costs at $50,000 to $100,000 a year, for a business that might not yet have a single paying customer. Five years on, that structural problem, where a fintech needs revenue to unlock capital and capital to reach revenue, has not gone away. It belongs in the first budget conversation of any financial services build, well before a line of AI-assisted code gets written.
Strabo: an AI dashboard for wealth management
The clearest example in Hyper’s own portfolio of a founder building an AI-native product inside financial services is Strabo, an all-in-one AI dashboard for wealth management founded by Michael Magdongon.
Strabo’s early challenge sat underneath the AI layer rather than inside it: a strong idea that had not yet been pressure-tested against how people actually manage their investments day to day. Working through Hyper’s Accelerate process, the priority became refining that business model and validating the assumptions underneath it before development time went into the product itself. Strabo has since raised $1.9 million and is live, with Magdongon crediting the willingness to stress-test the idea early as the difference between something that looked good on a slide and something that holds up for the people using it daily.
It is one example, and a solid one, rather than a stretched fit. Financial services is a category where Hyper’s portfolio of AI-native examples is still growing, and pointing to the one that applies felt more useful than reaching for a comparison that does not.
Where AI-generated prototypes fall over once customer money is involved
A pattern we see often: a founder arrives holding a working prototype of a financial product, built over a weekend using a tool such as Lovable, Bolt, or Replit Agent, describing what they wanted in plain English and getting something clickable back the same day. That is a useful step. Testing whether people want the product before committing serious money to a build is exactly the sequencing we encourage, in financial services as much as anywhere else.
What these tools hand back is a prototype. A prototype is a different thing entirely from a financial product built to hold account balances, transaction histories, or credit decisions at scale. Veracode’s Spring 2026 GenAI Code Security Report found that 45% of AI-generated code introduces known security vulnerabilities, including SQL injection flaws and cryptographic weaknesses. In a category where the product might be holding a customer’s bank connection, income data, or entire investment portfolio, that kind of gap is far cheaper to catch in a code review than in a live incident.
Conversations across fintech-focused forums and newsletters this year keep circling back to a similar worry, usually framed around a large language model producing a confident, wrong answer to a customer’s question about their own finances. That concern shows up for good reason, and it explains why the AI activity landing hardest in financial services right now tends to sit behind the scenes rather than in front of the customer. Rulebase, a Y Combinator-backed startup that raised a $2.1 million pre-seed round in 2025, built its product around exactly this insight: an AI agent supporting dispute resolution and compliance workflows behind a human back-office team, rather than a customer-facing chatbot dispensing financial advice unsupervised. Treating AI as a co-worker working behind the scenes, with the adviser role staying firmly human and customer-facing, is a useful frame to hold onto while scoping a financial services product.
Before handing a financial services build to any development partner, our guide to what to look for in an AI app development agency is worth reading first, since the questions in it carry extra weight once customer money and financial data enter the picture.
What a defensible financial product needs before launch
Building a defensible AI financial services product in Australia generally means addressing the following before a customer’s data or money enters the system.
- Work out your licensing position early. Whether your product needs an Australian Financial Services licence, a credit licence, or sits under someone else’s licence through a representative arrangement belongs in product scoping, well before development begins.
- Assume the Privacy Act applies in full. Build a genuine privacy policy, a documented data breach response plan, and clear consent flows before launch. If your product uses AI to influence a decision about a customer, prepare a plain-language explanation of what it does and why, ahead of the December 2026 transparency requirements.
- Treat your AI vendor as a material service provider. If you work with, or plan to work with, an APRA-regulated business, expect to be asked how your AI supply chain holds up against CPS 230. Document it before the question arrives.
- Build security architecture that would survive an audit. Encryption at rest and in transit, role-based access control, audit logging, and an incident response plan need to sit in the foundation of the build from day one.
- Keep a human in the loop for anything resembling advice or a credit decision. ASIC’s own review found licensees relying on AI to support human decisions rather than replace them, and regulators have stayed consistent that this remains the safer default.
- Budget for compliance inside the build. The CDR accreditation costs and licensing pathways covered above are actual figures. They belong in the first financial model, alongside development costs, from the very start.
The order that keeps a financial build standing
The strongest financial services products we have seen share a common foundation: a founder with a specific, well-understood grasp of the financial problem they are solving, paired with regulatory and technical groundwork laid before development starts rather than added afterwards. A beautifully designed budgeting app sitting on an unclear licensing position, or a slick lending chatbot with no documented human oversight, tends to come apart the moment an investor, a regulator, or a customer complaint puts it under pressure.
This is the reasoning behind how Hyper’s Accelerate and Launch Ready processes are sequenced for founders building in regulated categories. Product and business strategy get worked through properly first, including a clear look at what the product’s intended purpose means for its regulatory position, before a single line of production code gets written. AI-assisted development sits inside that build once the plan is in place, used to move quickly without skipping the steps a financial product cannot afford to skip. AI app development sits alongside fundraising strategy and go-to-market planning as one of the areas we work through with founders every week, and financial services is one of the categories where getting that sequencing right matters most.
Frequently asked questions
Does every financial app need an AFS or credit licence? It depends on what the product does rather than what it is called. A budgeting tool that only displays a customer’s own transaction data sits in different territory to a product that recommends a specific financial product or makes a credit decision. Get this assessed early, since it shapes almost every other decision in the build.
Can I use tools like Lovable or Bolt to build a financial services app? They are a useful way to test an idea and put together an early prototype. That prototype is not ready to hold account data, pass a security review, or survive an investor’s technical due diligence on its own. Building a fully working, licensable financial product generally needs a properly resourced development process behind that first prototype.
How much does it cost to build a compliant AI financial services app? It varies considerably depending on your likely licensing position, whether AUSTRAC or CDR obligations apply, and the sensitivity of the data involved. Our guide to AI app development costs covers the variables that shift a quote before compliance work is even factored in.
What is the biggest mistake founders make in this category? Treating compliance as a final step rather than part of the product’s foundation. Licensing position, privacy obligations, and security architecture are considerably cheaper to build in from the start than to retrofit once a customer, an investor, or a regulator asks about them.
The trust a financial product has to earn
Financial services rewards a founder who understands the specific financial problem deeply, and who lays the regulatory and technical groundwork carefully enough that the AI feature sitting on top of it can be trusted with a customer’s money. Michael Magdongon built Strabo this way, treating the business model and the compliance position with the same seriousness as the AI dashboard itself.
If you are working on an idea in this space and want to talk through what building it properly would involve, a free strategy session with our team is a reasonable place to start.
Book a confidential session with a strategist
Sasha Reid is the co-founder and CEO of Hyper, an Australian startup studio. Since 2015, he has helped more than 1,528 founders turn early ideas into viable products and businesses. Founders supported by Hyper have raised $482 million in capital.
Sasha writes about validating app ideas, defining an MVP, app development costs, AI-built products, early traction and preparing startups for investment.
