Su Yang (BNP Paribas): "Agentifying a bad process just burns tokens"

‍Everyone's talking about AI. Where does BNP Paribas actually stand?

The hype dates back to ChatGPT in late 2022, but the bank started around fifteen years ago, with credit scoring and fraud detection. Today three families of projects coexist: classic, generative, and now agentic. The Evident AI Index, the reference on the AI maturity of the world's 50 largest banks, puts euro-zone banks at the top in 2025, with a clear gain over the year. BNP Paribas is one of only three banks in the world, with JPMorgan and DBS, to publish a real return on investment: an AI portfolio valued at €635 million in 2025, €750 million targeted this year. What changes with agentic AI is the scale. The infrastructure investment is heavier, the expertise moves very fast. That's why the AI Transformation department was created in 2024, to pool efforts and deploy generative then agentic AI at the most cost-efficient level. At bottom, it all comes down to four directions: client experience, augmenting employees, automating operations, and securing banking operations.

"We're one of only three banks in the world to publish an ROI on AI."

Fifteen years of transformation, what really moved adoption?

Adoption is the key. A tool you build to be used is worthless if it isn't. The turning point came when we moved from diffuse adoption, left to local teams, to structured programs: a dedicated team, Doctolib-style booking where anyone reserves a slot for their usage questions. The result, nearly 60 NPS points gained in a year on those tools. In parallel, an internal AI assistant is available to every employee, plus a few dozen Copilot licenses where the gain is clearest.

You work with Mistral. Why them, beyond the French flag?

Mistral is, in practice, the only one selling the weights of its models, downloadable, with full control, where US or Chinese players don't. That's what makes our internal layer possible, the "LLM-as-a-Service": any application can call a model without having been designed for AI, and we orchestrate models we update regularly. About fifteen models in production, a hundred in experimentation. The contract was renewed for three years at the start of the year. Early on, the French models were more performant and more frugal. On software and services, US big tech is now on par, so that's no longer the differentiator. What we want is a trusted partner to co-build with, not off-the-shelf tech. A French player, for us, is natural.

Going full OPEX in a sector where the model providers don't make money is exposing yourself to rising prices.

On costs, how does a bank keep a grip on the AI bill?

The IT operating budget is around €8 billion a year, of which roughly 10 % goes to cybersecurity. On AI, most of the tokens run through the LLM-as-a-Service, with orchestration built in-house and GPUs bought directly from Nvidia, sitting in our own datacenters. That gives far better cost control than banks, US ones especially, that rely on hyperscalers: we're talking orders of magnitude. There's a pullback on that, in fact. Going full OPEX in a sector where the model providers don't really make money is exposing yourself to rising prices. Better to invest in CAPEX and cut OPEX over the long run. Agentic AI costs more than classic industrialized AI, but it stays within manageable orders of magnitude.

And the infrastructure, how long does it take to build?

Running datacenters is a craft, it doesn't happen overnight. BNP Paribas is 200 years old, with about fifty years of IT behind it. Every large player, JPMorgan included, has internalized infrastructure, simply because on M&A deals, investment banking or financial communication, you handle secret data. On top of the European AI and data rules come financial regulations that require control over the data. For a startup, it all depends on its backing from existing infrastructure players.

Does AI change the game in cybersecurity?

On four fronts. First, attackers use it: since ChatGPT, our clients have been targeted by 1,300 % more social-engineering fraud attempts. Not 1,300 % more losses, because we deployed defenses. Second, AI helps defend. Third, you have to learn to organize differently, to work with agents, in defense, red teaming, observability. And fourth, deploying AI means securing it: guardrails on personal data, toxic interactions, prompt injection, so agents can run at scale without harm.

You can always scold an agent after the fact. Which gets us nowhere.

Where do you draw the line between the agent and the human?

The human is there by design. An agent isn't a super-developer: if an employee does something unplanned, someone is accountable; an agent, you can always scold it after the fact, which gets us nowhere. Hence the legal, organizational and governance topics handled in a dedicated program. One example: a sales team given Microsoft's Agent Builder built around twenty agents on its own, and wondered whether IT was still needed. A few months later, the same person is buried under support requests from colleagues, forgets the order to chain the agents in, discovers the mental load of orchestration and the meaning of the word production. The final decision stays human. Regulation, the AI Act as much as GDPR, actually requires being able to switch from an automated decision back to a fully human one whenever a client's financial health is at stake.

Which roles will be most affected by year-end?

The back office and middle office, with KYC as the main target, because it sits between efficiency and client experience. Every product with a long processing time too: mortgages, credit granting, transaction banking. Software development is the most mature use case, already deployed to all developers, and we're moving to more complex agents. And M&A and investment banking roles, heavy on research and synthesis, where agentic AI adds a great deal. The real message: the use shows up almost everywhere, front, middle, back, business, support.

One last point?

We've talked a lot of tech, but an AI transformation rests as much on processes as on models. No point agentifying what already exists: agentifying a bad process just burns tokens. And above all, there's data, the neglected child of these transformations. An agent answering a client has to name the right product, with up-to-date figures, not the one next to it. Without clean data, the rest doesn't hold.