In the age of application programming interfaces (APIs) and artificial intelligence (AI), data governance is becoming harder for banks than perimeter defense.
After all, the infrastructure powering vital advances like instant payments and personalized financial services is also creating sprawling new security risks as banks connect to AI tools, FinTech solutions and third-party APIs for the thousands of financial software integrations on offer in today’s landscape. Information that once lived inside monolithic core banking systems now flows continuously across interconnected software layers designed for speed, personalization and real-time decision making.
A recent disclosure filed with the U.S. Securities and Exchange Commission (SEC) this month by U.S. commercial bank Community Bank illustrates the growing challenge of data sprawl for banks, particularly smaller and mid-size lenders looking to stand up digital innovation in order to compete with larger peers. The bank, a wholly owned subsidiary of CB Financial Services, voluntarily disclosed that an amount of sensitive customer information determined to be “material” had been exposed through an unauthorized AI application used within its environment.
The filing underscored an uncomfortable reality facing the industry: the modern banking perimeter is no longer clearly defined. The issue is not simply that banks are adopting more technology. It is that the architecture of modern banking increasingly depends on constant data mobility.
Read more: The End of the Artisanal Hack: How AI Industrialized Cybercrime
Why Banks Are Losing Sight of Their Data
For decades, banks operated on a relatively simple security premise: protect the perimeter, secure the core and tightly control access to customer data. Sensitive information largely stayed within institution-owned systems, moving slowly through carefully managed channels and governed by rigid internal protocols. That model no longer exists.
Advertisement: Scroll to Continue
Open banking frameworks, embedded finance partnerships and real-time payments have accelerated API adoption across the industry. Financial institutions now routinely integrate with FinTech providers for everything from fraud prevention and lending to customer onboarding and treasury management. At the same time, generative AI tools are rapidly becoming embedded inside employee workflows, customer service operations and internal analytics platforms.
Each integration creates value. Each integration also creates another potential exposure point. The challenge of defending, and even just governing, these exposure points is particularly acute for mid-sized and regional banks operating with leaner compliance and cybersecurity resources than the largest national institutions.
For example, across the credit union (CU) landscape, PYMNTS Intelligence research found that fraud now occurs across the full CU member life cycle, from account opening and onboarding to authentication and transaction activity. CUs must now defend every interaction point rather than a single stage, and 77% of CUs have experienced unauthorized network access in the past year.
The same technologies driving operational efficiency and customer personalization also increase organizational exposure. AI systems require data access to generate value. APIs require connectivity to function effectively. Modern banking infrastructure is inherently designed for openness and interoperability.
See also: The Enterprise Security Stack Is Moving to the Edge
The End of the Closed-Core Era
The real question is whether banks can establish governance models sophisticated enough to match the complexity of the ecosystems they now depend on. What has changed is the scale, speed and opacity of modern data movement. As customer data becomes increasingly distributed across external systems, governance itself is emerging as a competitive differentiator.
Rather than attempting to seal off every endpoint, many smaller institutions are shifting toward continuous monitoring models built around identity management, behavioral analytics and real-time visibility into data movement. Increasingly, the focus is less about defending a fixed perimeter and more about understanding how information flows across interconnected systems.
Data in the report “Embedding Security: Designing Fraud Risk Out of Business Transactions,” a March PYMNTS Intelligence Business Payments Tracker Series report in collaboration with WEX, reveals that nearly a quarter of banking CEOs (24%) are prioritizing AI investments for cybersecurity.
The broader banking landscape is also hoping that a rising security and data governance tide can lift all boats. PYMNTS covered Tuesday (May 12) how JPMorganChase is making nearly $14 million in philanthropic investments to support seven organizations that are combating fraud and scams through consumer awareness and real-time prevention.
Ultimately, the institutions succeeding in this transition are generally not those attempting to halt technological change. They are the ones redesigning governance around the assumption that data mobility is now permanent. Because in the API economy, the most important security question is no longer whether data leaves the bank. It is whether the bank still knows where the data went.
