BBVA and Nvidia test security built into AI agents
BBVA is working with Nvidia on embedding governance into AI agents at design time. The disclosed detail is thin, so the signal matters more than the result.
BBVA's work with Nvidia signals that large banks now treat agent security as a design requirement rather than a later patch. Finextra reports the two are exploring how governance can be embedded from the design stage. No deployment figures or timelines were disclosed, so the practical effect on bank controls remains unproven.
The Ledger Desk · 3 min read- BBVA is reported by Finextra to be collaborating with Nvidia on security and governance for AI agents from the design stage.
- The reported work is exploratory; no deployment scale, cost or timeline has been disclosed.
- Nvidia's wider agent-security push, including a CrowdStrike blueprint, places enforcement in the runtime and infrastructure layer, not only in the model.
- For payments and banking teams, the open question is whether agents that can move money are governed by enforced policy or by prompts alone.
BBVA is working with Nvidia on a question every bank deploying AI agents will face: how to make security and governance part of the agent's design rather than a layer added afterwards. Finextra reports the collaboration as exploratory. It gives no deployment scale, cost or timeline, so this is a direction of travel, not yet a measurable control.
What was actually reported
The only confirmed substance is narrow. Finextra says BBVA is collaborating with Nvidia to explore how security and governance can be embedded into AI agents from the design stage. The report does not name a product, a business line, a pilot size or a go-live date. Until BBVA or Nvidia publish technical detail, readers should treat the work as research intent, and should not infer that agents are already handling customer money.
Why design-stage governance matters for money movement
An agent that can read accounts or trigger payments is only as safe as the limits enforced around it. Controls added after launch tend to rely on monitoring and clean-up, while controls built in at design time can restrict permissions before anything runs. For payments teams the practical test is whether an agent's authority is bounded by enforced policy, with logs an auditor can follow, or by instructions the model might ignore.
Nvidia is pushing enforcement below the model
Nvidia's broader agent-security approach, as described in a CrowdStrike release, integrates security into its OpenShell runtime so that governance, visibility and control span development through runtime. That framing puts enforcement in infrastructure rather than inside the model. The BBVA report does not say whether the bank is using these components, so the link is context for the direction of the industry, not a confirmed detail of this project.
What to watch next
The signals worth tracking are concrete ones: a named pilot, the permissions agents are given over accounts and payments, and whether any regulator or audit output describes the controls. Absent those, announcements of this kind show intent, not risk reduction. Banks, fraud teams and payment processors should ask vendors how agent actions are limited, logged and revoked before approving any agent that can move funds.
- What are BBVA and Nvidia doing together?
- Finextra reports that BBVA is collaborating with Nvidia to explore how security and governance can be embedded into AI agents from the design stage. The report describes exploration, not a launched product.
- Why does agent security matter for banks and payments?
- Agents that can query accounts or initiate payments need enforced limits on what they can access and do. Building those limits in at design time is easier to audit than adding them after an incident.
- Has any result or rollout been disclosed?
- Not in the source reviewed. No metrics, customer deployments or dates were reported, so any claim of impact would be speculation.