How Banks and Fintechs Can Govern AI Agents

What We Need to Grow, Episode 080: Don't Wait for the Impact. A Founder Talk conversation with Steve Bishop. Cleaned for readability; the words are the speakers' own.

A Conversation with Steve Bishop, President of amBaaSsador and co-author of Know Your Agent

Cleaned and publish-ready. The on-record take only, 6:50 to 35:00 of the Granola capture. Pre-roll and post-sign-off audio excluded.

Caleb Pedosiuk: All right, Steve, you've got a book. kyabook.com, Know Your Agent: The Governance Standard for AI in Financial Services. First of all, I'm really interested to hear what you have to say about this, because I've seen a bunch of stuff going on in the news. You've got crypto way over here, and the Binance stuff, and records being broken that are bad records, and you also see people scrambling to try to figure that out. You've got the big banks, the traditional industry. There was news recently, a couple of weeks ago, about agents and who controls how agents are able to operate. So I feel like you're right at the nexus of a lot of really important decisions that are being made about how money is moved and how we're leveraging these intelligent tools. So by all means, please share a bit about the book.

Steve Bishop: Absolutely. Well, Caleb, it's a pleasure to be here and chatting with you. We're at a phenomenal time. There's so much changing, and we'll look back and say, there, that was the crux of the change in how work is done.

I started writing KYA, Know Your Agent. It's more for financial services and fintech people in that industry. Banks and credit unions have had a bad history of waiting until there is impact before they take action or regulation. If you think of 2007, 2008 with mortgage prices, we waited until there was this huge default on mortgages, and then the regulations came in. Embedded finance was the same thing. More recently a bunch of banks jumped in, missed some steps, and so we saw consent orders and a lot of public actions were taken.

I wanted to get in front of it and try to have a framework so that we can prevent that impact before something negative happens. And you're starting to see it happen.

With Binance, you mentioned that, I don't think that one has as much to do with AI. The scope of what they were able to do, and so quickly. I'm sure AI enhanced it, but AI gives fraudsters a huge toolbox they can go to and attack your finances, your personal life, anything out there. It's just remarkable what they can do. And it also has the upside that we have a toolbox we can use too. So we have to be proactive. The worst thing that you can do is nothing, because the world is evolving right now.

In the spring, when I was finishing the book, no one was talking about governance. By the time I was on the fall conference circuit, everyone was talking about governance. There are a lot of things you have to think through to make sure you are taking care of your institution, of your business. It's relevant to any business, but I focus more on the government side.

I have just rambled for a really long time, but yeah, KYA, it's a book, Know Your Agent. Regardless of what business you're in or who you are, the people you're interfacing with are using AI. Your customers, your vendors, they're all using AI. If you're not using AI you're going to be left behind, and you need to have a way of knowing what's going on and how AI is being used and affecting your company.

Caleb: So what led you to write a book like this? I can't imagine you coming out of the blue. You've got to have some amount of understanding of the technology, you have to have some understanding of the industry, and then you have to have some sense of proficiency to stand up and say, hey guys, nobody's talking about this. I'm going to put a few things on the board, you could take a look, let's have a discussion about it, but we've got to move the needle on this. Was it your background, or what would it have been?

Steve: Yes, it was my background and some other things. I've always been either working for a tech company that provides services to banks and credit unions, or I've been a banker. I've worked at a few different community banks. So my history has always been either tech or banking, on both sides.

That's my background. I built out embedded finance. As I've seen AI evolve and the capabilities grow and grow faster, I've leaned into it. There was that point where I realized that my Excel skills, that I took so much pride in for the past two decades, are no longer relevant, because AI can build an amazing model in a matter of minutes that would take me weeks or days.

So there was that. I started just capturing all of my meetings, my conversations, and feeding it into a repository. With AI, context drives everything. And that's where you're going to see a lot of AI projects fail, because they're trying to deploy a workflow that does not have the proper context. That's a whole separate soapbox I can get on.

But I wanted the bots that I'm working with to have context around Steve. And I was having a conversation with my bot, and he said, you should write Know Your Agent. I think it was probably a different concept than what it was thinking about, but it was based on the hours of conversations I'd had with my co-author, with everyone else, about what I was working on.

So I started diving in. I leveraged AI to come up with the framework, just the outline, and then I edited the book to write it, but it was based on those hours and hours, hundreds of hours of conversation and context I'd fed it. So it was not something I sat down at a keyboard and started writing. It was something where I captured the things I was working on, and all these different aspects were feeding into it.

When you go back and gather that data and look at it, you find those things where you think, holy crap, this stuff is going to change the way that we work and do business. So, as a banker, the examiner is going to come in and ask me what I'm doing. I have to provide a satisfactory answer or I lose my charter, I lose my business. If they ask about AI, I, as a banker, am not going to be the most tech-forward person most likely. How can I explain what the AI is doing? Most bankers need help with that, and that's what I was trying to provide, a tool.

You can go through the book, each chapter is focused on a different aspect and then outlines the approach that I would take to help have that governance and explain it, so you're prepared when the examiner comes in and asks how you're using AI, and then how do you know it's not hallucinating or doing something different. If you can defend that, have that supporting evidence to show that you're taking care of your charter.

Caleb: So does the book give people a step-by-step, zero to one to two approach to take? Is it very practical in terms of the output that people would expect to receive from it, or is it more awareness, theoretical, educational?

Steve: It's evolved. I've probably added 30% since I went to the publisher, so there'll be some more additions coming out. And it's going to continue to evolve.

The idea was to have both. One of the first copies I gave to a chairman of a bank, and he's an elderly gentleman, and he said, Steve, this is all really exciting and good, but I don't know what the heck you're talking about. They don't have Wi-Fi at their bank. They haven't been tech forward. So I added a primer of, what is AI? How is it going to do that? Trying to get the basic blocks. But then, as you're working through it, what do you need to think about? Where do you start? What's the next step? What is the approach?

If you look at banks, you've got third-party risk management, and that's not just banks, but that is no longer TPRM, it's all-party risk management, because there's AI with your customers, with your vendors. You can't stop at, I'm working with this third party, I need to manage risk with them. I have to have a much more comprehensive approach. There are so many different approaches. We've got a ton of appendixes in the back to take processes, procedures, those sorts of things, to help give you a toolkit. So it's kind of a blend of theory, explaining what the scenario is, and then tactical, here's how you execute on it.

Caleb: Is there a digital copy of the book that comes with the purchase?

Steve: We have it on Amazon. I have it digital. We've got hard copy, paperback. Barnes and Noble has it as well.

Caleb: And I'm curious, have you put prompts in it? Does the appendix have certain prompts to say, hey, for example, this is a prompt you could copy and paste, or scan this QR code and it'll take you to this prompt. Basically, you've read this, call it 3,000 words in this chapter about this information, you now have that in your grey matter right now. So rather than you needing to sit down and explain it to Grok or Claude or ChatGPT or whatever, instead, just scan this QR code, take this brief. Here's the summary, this is the overview. Take a look at it, adjust anything you want, but here's a pretty comprehensive, could be 10,000 words if it's needed, or it could be less, to be able to then say, hey, load this in. This would be step one, to say, I've been learning about these things. Ask me any questions, highlight anything. Is there some aspect of that?

Steve: That's a great idea. And yes, we'll have it in the future.

What Tony and I have been working on is having a digital version of it. When I go back to context, I've got my mind mapped out, and then Tony has his. We'll have a KYA agent as well. So you can actually have a conversation with the book. How Caleb thinks about things is different than Steve. And so you have that context. The idea is having my own board of directors to help me. I can get your take on it if I mapped out your mind, so I can go and have the Caleb bot, the Steve bot and the Tony bot. Then all three of them can have conversations, and I can ask questions and get feedback on the best path forward. When I introduce the concepts that are in the book and have that as well, you can just feed that into it. So it's not as much of a prompt, you can just ask directly and get feedback from it immediately. We're close to having that available, but not quite. It's not mainstream yet.

Caleb: Just thinking about that idea of having a board of advisors. I think in Napoleon Hill's Think and Grow Rich he talked about having an imaginary version of that. I think he even talked about some of them disagreeing, which is interesting, because a lot of agentic dialogue is fairly agreeable. It's like, after you, no, after you. I don't know if you get this, I have Claude chief of staff and Grok chief of staff, and sometimes they have handoff notes where they'll say, hey, who should own this part of the workflow? But it'd be interesting to see more back and forth.

Steve: Oh, for sure. That is part of the idea, having the antagonist, if you will. Let's have the grumpy dwarf, who's always like, no, that will never work, sort of chiming in. And we have that. We have these rooms where we'll add these chats with different bots or different minds in there, and you'll see them having conversation with each other. I think it's a pivotal part.

For me, I refuse. I can't use just ChatGPT or Claude or Grok. I want to use all three of them. I think that is something where a lot of people think they're okay because they're using their ChatGPT. Yes, you want your ChatGPT to know you, for it to be more effective. But I think it's equally important, or even more important, to have other tools that know you, so that it keeps that balance from that different perspective.

There's nothing more frustrating than hearing Claude tell you something and then you say, no, that's not right, you left this out. And it's like, oh, sorry, you're right. I don't need you to be polite. I need you to be right.

But having the different models do that, and even more important, is protecting yourself and your data, not being tied to a single model.

Sam Altman was talking about, I saw a lot of headlines this weekend, about people being selfish having their own computing and we should free up all this computing. Let's get down that rabbit hole. I want to control my own destiny. I don't want to just trust the powers that be to have three people that make decisions for how I use AI and live my life. So I disagree strongly with them on that. But the risk, if you have a single model, is that you are then captive to that model, whether that is computing availability, data availability, or pricing availability. All of those things are at risk if you tie yourself too tightly to a single provider.

Caleb: Yeah, it's interesting. I've heard people talk about, just to reflect on some of what was said with that, if you apply the same logic to other aspects of life, then it quickly centralizes. Very quickly centralizes. As you were talking about it, it made me think about money. Apparently there are some people that are sitting with savings. Why aren't those savings flowing through the economy, generating value, GDP, moving? Why do we allow, why is it a shame that people have money sitting there in savings accounts? And I don't mean this disrespectfully, I think it actually marks an economic theory. The idea of, I'm not sure who the economist was, is it Friedman? I don't know. Don't quote me on who the economist is, but I think part of the reason to go off the gold standard was this idea that you would then give a central bank the ability to turn up or down, like quantitative easing, so you could stimulate an economy, or rein it back. But the idea with that is what you're actually doing to a store of value when it comes to the money. If someone has $100 sitting here, if you inflate more of it, you're actually devaluing that currency. So in this case, if it was compute power, by printing more money in this sense, you're metaphorically reducing their ability, their compute power. You're actually taking it down. And I know that it's not a one-for-one analogy, but it is this idea that, hey, if somebody's sitting on compute, or money under their mattress, that money under the mattress is not helping the economy.

And so I think some people could look at that and be like, hey, that's bad. And other people might be like, well, what if all the decisions being made upstream, that are centralized, are not necessarily good for everyone riding along this train later? What if you needed that compute? What if, God forbid, there's a big bump in the road? What if decentralizing some of that compute is really important? So I saw something pop up recently where someone was showing a little tutorial on how to take all those seemingly worthless little two-megabyte thumb drives, those little SD cards that have 256 megs, all of those things. And they were saying you can actually load onto them really valuable information, text files. So you can take a number of things, whether it's first-aid related, whether it's gardening related, whether it's maps or other things. You can actually use those pieces to create what would essentially be, in a small envelope, the equivalent of a library's worth of information, and make use of that stuff, offline.

Steve: Yeah. The economics, the money flow, is a great analogy. Just like people want to have their own savings, you're not going to trust the, you're looking at, let's not get too theoretical, like communism. Does communism work? Everything sounds great until everyone wants stuff for free, but then who wants to pay the bill? Savings is a good analogy. And the SIM cards you were talking about are the data storage.

Absolutely. I think we had, what was it, the PHP vulnerability that came out? And the FBI came out with all these things that you should do to protect yourself and your data because of this exposure, and most of it was fixed relatively quickly. But AI exposes these things.

And I'll never forget, I was speaking at a conference probably a year and a half or so ago, and I got done, and a janitor had been cleaning the back of the room, and he stopped me as I was walking out and he said, Steve, what you said, you're onto something, but I took my family and you should do the same thing. And we drove our car, we all got out, we left everything in the car except us, and we walked out into the woods and we came up with a code word. So that we would know, if anything goes wrong, we have this, because there are no phones to eavesdrop, none of these electronics. And that's a super paranoid approach, but there's also this truth to it. Having things written down, having your two-factor authentication codes written down, having a physical copy, or having your SD card that's in an envelope like you were talking about. You're spot on. That is a great approach, because you're going to have to protect yourself more and more, because of the ability to replicate it. You could be a completely different person coming across on screen right now, or your voice, because those tools exist now. And so the way to protect yourself, you need to have that physical form of information and records.

Caleb: Yeah. I remember thinking about some of this, not necessarily from a personal statistical probability, but from a collective. Meaning out of a complete, instead of a sample size. Like when people put their seatbelt on. When seatbelts were new, someone might see someone put a seatbelt on and go, really? We're driving the same route you've driven a million times and you've never had an issue. Really? We all need our seatbelts on. And you could look at that and that argument kind of stands. If you're just making this decision based on statistical probability, you could say, I think you're actually right, and maybe you would feel a bit silly. But then if you adjust the view and say, but hold on, it's not a practice for one instance. It's saying, if you took this practice and carried it to the power of everybody willfully choosing to do this, would it make a difference? And would it make a meaningful enough difference to have it be worthwhile? Yes, of course.

And that's the point where I was like, oh, okay, well, we put more rebar in foundations or in buildings because, God forbid, an earthquake or a big storm happens. So you do that. You want to have building code that does it across the board. Same with locks on doors, same with seatbelts in vehicles. So in that sense, I remember thinking, with certain things like even gardening and other pieces, if there was a global culture where everyone had even 5% of their food sourced through backyards and hobbyist gardens, and if there was just enough of that flame stewarded, saving some seeds, enough heirloom seeds floating around everywhere, people have here and there, they would gift them to people at Christmas and they sit somewhere in the basement, you forget about them, but that there was a culture, globally, that everybody has, that it's normal to have a Grail water filter. People are like, I got one when I was 12 when we were hiking, and you forget about it. Would that carry to the power of everyone help? And if the answer is yes, then maybe we should have it as part of our culture that we do a bit of gardening here and there, that we have some outdoorsy gear, that we have some digital libraries that are offline on weird SD cards and old thumb drives, or have some of the open source models that are sitting on hard drives, and at least one person in the family knows how to boot up an open source model, if you need to access Wikipedia or something like that.

Steve: Yeah, you're spot on. I think it's easy to say that I myself can't change the world, or I can't have that impact. I was thinking of the old Garth Brooks song, The Change, where he's basically saying, they say that I can't change the world, I'm not going to let the world change me. I'm going to do good for the world. And me alone, putting my seatbelt on, it's never saved my life in the decades I've been driving, right? But everyone wearing a seatbelt, it does save lives every day. Or gardening, contributing to that. I think that was really spot on. So yeah, I hate to be an echo chamber, Caleb, but yeah.

Caleb: Cool, man. Well, let me ask you, I love asking this question, it's kind of a final question. If you could put your finger on the thing that you need most right now. So I'm thinking about this book, Know Your Agent. You've done some speaking, you've built businesses in the past. What do you feel like you need most right now with this?

Steve: You know, I think it's having people be curious, to be willing to take action. I've always been an advocate for this space and tried to help others and want to be a resource to folks. So if there's someone that just wants to reach out, send me a message, I'm happy to help and answer questions. I see the world evolving, and there have been times where I woke up in the middle of the night like, I'm so far behind, and then a few hours later I'll be in a meeting and think, I've got five bots running right now on multiple machines, I'm probably going to be okay.

I think we're at this critical point of humanity. There are two sides. It's going to be way too far or not enough, and obviously it's going to be somewhere in the middle. But it's just happening so fast, and I don't see enough folks taking action to protect themselves, protect their company on it. So I want to be an advocate for change and helping people.

Caleb: Very cool, Steve. Thank you very much. kyabook.com. If people want to engage with you, is LinkedIn best, or what would be best?

Steve: Yeah, I'm on LinkedIn. I've got a couple of newsletters that come out weekly there. But shoot me a message, reach out. I'm happy to connect. So Caleb, thanks for having me. It's been a lot of fun.