AI and agile training for banks, insurers and financial firms

What financial firms ask us for

Between March and September 2026, 12 banks, insurers and other financial firms asked us about training for their people, and at least four went on to book. The most common requests were agile project and delivery management, portfolio management, product management, enterprise and systems coaching, and AI-enabled roles such as the AI-enabled product owner and scrum master. Several asked to pay by invoice for a group of seats, which we support.

Financial institutions we have trained or worked with include NCBA, Qatar National Bank, CSC, Deutsche Bank and DBS.

Courses that fit financial services

ICAgile certification courses can be booked per seat on public cohorts or run as a private cohort. The other courses run as private cohorts for one company.

What regulators expect, by region

These are short summaries of the official texts as they stood on 27 September 2026. They describe what each text says. They are not legal advice, and none of our courses is approved by a regulator.

European Union: DORA and the AI Act

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. Article 13(6) requires financial entities to run ICT security awareness programmes and digital operational resilience training as compulsory modules in staff training, for all employees and senior management, at a level that matches each role. Article 5(4) asks members of the management body to keep their knowledge of ICT risk current, including by following specific training on a regular basis. Small, non-interconnected investment firms and some exempt institutions follow a simplified framework instead (Article 16). DORA covers EU financial entities only. It does not apply in the UK or Switzerland.

The EU AI Act adds a duty on AI literacy. Since the amendment that entered into force on 27 July 2026, providers and deployers of AI systems must take measures to support the AI literacy of their staff, without having to guarantee any specific level. Our AI literacy training page explains what changed and how to plan it by role.

Sources: Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2026/1744.

United Kingdom: PRA operational resilience

The Prudential Regulation Authority's Supervisory Statement SS1/21, Operational resilience: impact tolerances for important business services, is relevant to UK banks, building societies and PRA-designated investment firms, and to UK Solvency II firms, the Society of Lloyd's and its managing agents. The current version has been effective since 31 March 2022. It sets expectations for resilience rather than a training syllabus, but it shapes the change work that delivery, product and technology teams carry out. UK buyers pay in pounds sterling: see agile training in the UK.

Source: Bank of England, SS1/21.

United States: model risk guidance changed in 2026

On 17 April 2026 the Federal Reserve, the OCC and the FDIC issued SR 26-2, revised guidance on model risk management. It supersedes and replaces SR 11-7, and also SR 21-8 on model risk for Bank Secrecy Act and anti-money laundering systems, and it is expected to be most relevant to banking organisations with over $30 billion in total assets. It says generative AI and agentic AI models are not within its scope, so each bank's own risk management and governance must decide the controls for those tools. The NIST AI Risk Management Framework 1.0 (January 2023) is voluntary and is being revised; NIST added a Generative AI Profile, NIST-AI-600-1, on 26 July 2024. For teams that need a shared understanding of how AI works and how to govern it, ICP-FAI and AI Governance, Ethics and Responsible Use are the natural starting points. See also agile training in the United States.

Sources: Federal Reserve, SR 26-2; NIST AI Risk Management Framework.

Singapore: MAS

The Monetary Authority of Singapore published its FEAT principles (fairness, ethics, accountability and transparency) on the responsible use of AI and data analytics on 12 November 2018. It consulted on Guidelines on Artificial Intelligence Risk Management from 13 November 2025 (the consultation closed on 31 January 2026). On 3 July 2026 it published an information paper, Safeguards for Agentic Finance at Runtime. Singapore banks can see our AI agile training for banks in Singapore.

Sources: MAS, FEAT principles; MAS, consultation paper on AI risk management; MAS, Safeguards for Agentic Finance at Runtime.

Malaysia: Bank Negara Malaysia

BNM's Risk Management in Technology (RMiT) policy document, reissued on 25 September 2026 and in effect since 28 November 2025, applies to licensed banks, investment banks and Islamic banks, insurers and takaful operators, prescribed development financial institutions, e-money issuers, designated payment system operators, merchant acquirers and remittance institutions. It expects the board to participate in relevant cybersecurity awareness and training programmes, and it has a section on security awareness and education (Section 15). BNM's discussion paper on artificial intelligence in the Malaysian financial sector (August 2025) is a non-binding publication. Programmes delivered by Agile Visa Sdn Bhd are HRD Corp claimable under SBL-Khas for eligible employers, subject to HRD Corp approval and the Allowable Cost Matrix, and the employer must apply before training begins. See training for banks in Malaysia and financial services in Malaysia.

Sources: BNM, RMiT policy document; BNM, AI discussion paper.

India: RBI FREE-AI report

The Reserve Bank of India's FREE-AI Committee Report, Framework for Responsible and Ethical Enablement of Artificial Intelligence (13 August 2025), sets out seven principles, which it calls sutras, with recommendations, including capacity building across the entire workforce, starting from the Board level. It is a committee report, not binding RBI directions. See agile training in India.

Source: RBI, FREE-AI Committee Report.

Gulf, Africa and other markets

We have not yet verified central bank AI or training rules for the UAE, Saudi Arabia, Kenya or Azerbaijan, so this page does not summarise them. Teams in those markets join the same live online cohorts or run a private cohort. Buyers in the UAE, Saudi Arabia, Qatar, Oman, Bahrain and Kuwait pay in UAE dirhams at checkout. See UAE, Saudi Arabia and Kenya.

What a private cohort for a financial firm looks like

1. Training Needs Analysis. A short discovery step on your teams, current ways of working, the change portfolio and the outcomes you want. It sets the level for each audience, because a delivery team and a leadership group need different things.
2. Your cases, not textbook ones. Exercises use your products, customer journeys, controls and backlog, within whatever your information security rules allow in the room.
3. Live sessions. Online across sites and time zones, or on site by arrangement, usually split across several days so people can keep up with their day jobs.
4. Credential and follow-up. ICAgile courses lead to a lifetime credential; other courses award an Agile Visa Certificate of Completion. We then check the learning is landing in practice.

How the training runs

You can run a private cohort for one team, built on your own products, controls and change portfolio, and add seats on public cohorts for individuals. Private cohorts run live online across sites and time zones, or on site by arrangement. Delivered in English. Trainers for Arabic, Spanish, Bahasa Malaysia, German or French can be arranged for company cohorts on request.

Financial firms usually buy through procurement. We quote, accept purchase orders, complete your supplier onboarding forms (including W-8BEN-E on request), and share tax, insurance and data protection documents directly with your procurement team. See how to buy.

Engagement types

These case studies are archetypes. They describe typical engagements, not named clients.

Further reading: AI and agile in banking transformation.