The agentic data platform for financial services: regulatory reporting, lineage and change evidence on autopilot

Data Workers, the agentic data platform, runs the data operations a bank, fintech or payments firm is examined on: it catches breaks in regulatory reporting feeds, traces them to the line item, proposes the fix and leaves the change evidence your SOX and BCBS 239 files ask for. Changes go to a named approver at the autonomy level you set for each domain, every change leaves a tamper-evident receipt, and the agents run in your own environment.

In financial services a wrong number is a filing, not a dashboard. Here is where agents earn their keep in a regulated finance estate, and how the controls map to the rules your examiners cite.

Key takeaways

• •The work the rules make expensive goes on autopilot. Lineage on demand, finance-to-risk reconciliation checks, change records for in-scope pipelines, access requests and migration waves planned with their parity checks.
• •People keep the decisions. Regulated domains start at L0 manual or L1 observe and climb one domain at a time; production changes wait for a named approver, and no agent can promote its own work.
• •Evidence by default. Every change carries the diff, the approver, the time, the blast radius and the rollback path, written to a SHA-256 hash-chained audit log you can verify.
• •Your data stays in your systems. The agents run in your infrastructure on every tier with your credentials and your model key; the hosted Conductor sees workflow metadata only.
• •Controls mapped to the rule's own text. BCBS 239, SOX, GLBA Safeguards, NYDFS Part 500 and DORA, with your compliance team deciding what satisfies each rule. This page is not legal advice.

The data reality in banking, capital markets and payments

A typical estate runs a core banking platform (FIS, Fiserv, Temenos or Finastra), trading and risk systems such as Murex or Calypso, and a warehouse on Teradata, Oracle Exadata, Netezza or Db2 that is moving to Snowflake, Databricks or BigQuery. Informatica or Ab Initio moves the data, Kafka carries the events and dbt is growing. Collibra, Alation or Informatica CDGC hold the glossary, AxiomSL or Wolters Kluwer OneSumX produce the regulatory returns, ServiceNow holds the change tickets, and SAS and Python run the models.

The data operations that hurt:

• •Filing deadlines. FR Y-9C, FR Y-14 and CCAR/DFAST in the US, COREP and FINREP in Europe, each needing end-to-end lineage the moment an examiner asks how a number was built.
• •Risk data aggregation. BCBS 239 has been expected of G-SIBs since 2016, and the Basel Committee's November 2023 progress report found "significant work remaining at most banks to fully adopt the Principles". The ECB's supervisory priorities for 2026 to 2028 still ask banks to "remedy material weaknesses identified in their risk data aggregation and risk reporting frameworks".
• •Reconciliations and change evidence. Finance and risk numbers that should tie, and SOX IT general controls that want who approved each change to an in-scope pipeline, when, and what changed.
• •Least privilege and migrations. Least-privilege, time-boxed grants on customer and card data, and Teradata or Oracle moves where old and new reports must agree before sign-off.

Three use cases, from first alert to receipt

1. A regulatory report lineage break, three days before filing (worked example). This is an illustration, not a customer incident. A bank holding company's core release adds a nonaccrual status code, NA2, on Monday evening. Informatica lands the new rows overnight, and the dbt model behind Schedule HC-N (past due and nonaccrual loans) filters on the old code list, so those balances fall out of the FR Y-9C draft. Nothing failed, so nobody noticed.

At 04:41 a Data Workers quality check (run_quality_check) flags the nonaccrual balance 18% below the general ledger. The agents trace the column across Informatica's landing table, Snowflake and dbt with trace_cross_platform_lineage, and blast_radius_analysis names the four HC-N line items and two internal reports that read it. At 05:05 Data Workers proposes the fix as a diff for the owner to merge, with the blast radius and rollback path attached, and opens a ServiceNow change request with create_servicenow_ticket. The regulatory reporting domain runs at L2 propose, so nothing changes until the controller approves in Spellbook (in preview) at 08:40. The owner merges, dbt rebuilds, the balance ties to the GL, and AxiomSL reloads a reconciled schedule by 10:00.

The receipt holds the diff, the approver, the timestamps, the lineage path and the rollback plan. One record answers the BCBS 239 accuracy question, the SOX change-management question and the examiner's "show me how this number was built".

2. Card numbers in a new table. A payments team lands card_txn_raw in Databricks for a fraud project, and a free-text memo column carries full card numbers. Data Workers' pull request review reads column names and annotations, not values, so it cannot see card numbers inside a column named memo; the data owner or the team's classification tool flags the column, and the owner records it as restricted. Data Workers proposes column masks as a dry run with the blast radius, and the data owner applies them through Unity Catalog or their own change process; masking is never auto-resolved. Read requests go through provision_access, which grants column-level access with a 90-day expiry, or grants nothing and opens request_governance_review when policy says a person must decide.

3. Warehouse cost on risk models. Stress-testing and risk-model runs are among the heaviest workloads in the estate. Data Workers reads Snowflake metering and attributes credits to the query and the dbt model, project and run behind it through query tags, so a risk model's spend has a name on it. The fix it drafts, from a warehouse setting to a model change, goes to the owner with the model's downstream consumers traced first, so a change to a table that feeds a quarterly CCAR model shows that consumer before anyone approves it. Cost savings of 25 to 40% are a design target, not a measured result; set your own inputs in the ROI calculator.

Governance and regulation: the controls, mapped to the rule's text

Data Workers gives you controls and evidence; your compliance team, auditors and examiners decide how they fit your control framework. The wider mapping is in how Data Workers helps with SOX, HIPAA, GDPR and the EU AI Act.

Two design points matter most to a CISO here. Where things run: the agents hold your warehouse credentials and model key inside your infrastructure, and the context graph, receipts and audit log are written there; Enterprise runs in your VPC, your cloud or on premises, including an air-gapped bundle (deployment options). PII: values in tool output are redacted before anything is written to the context graph (how Data Workers handles PII). For credit scoring models, the EU AI Act lists creditworthiness under Annex III, and the Digital Omnibus on AI moved those high-risk obligations to 2 December 2027.

What changes for your team

Controllers, data owners and engineers keep every decision that matters. What leaves their week is the overnight reconciliation hunt, the screenshot-gathering for the ITGC file and access tickets that sit for days. Who owns the agents covers accountability, and will Data Workers replace my data team answers the question your team will ask first. Sibling pages cover healthcare and life sciences and SaaS and tech, and our guides on data governance in banking, data governance for fintech, BCBS 239 data lineage and BCBS 239 compliance with AI agents go deeper on the rules.

The alternatives teams in financial services weigh (as of Oct 2026)

• •Build it in house with coding agents and MCP servers. Banks have strong engineering teams; the hard part is everything around the agent: approvals, rollback, receipts and context across every system. See build it ourselves.
• •A catalog and lineage tool such as Collibra or Informatica CDGC. They hold the glossary and lineage inventory well; Data Workers acts on that context and keeps it current. See Data Workers vs a data catalog.
• •Data observability. Monitors raise the alarm; Data Workers diagnoses, fixes and verifies. See Data Workers vs data observability.
• •Platform-native agents in Snowflake or Databricks. Strong inside their own platform; a bank's lineage runs from the core to the regulatory return across several. See Data Workers on Snowflake and on Databricks.

Each is a sensible product for its job. Changing production data across systems, with approvals and evidence, is a different job, and it is the one Data Workers does. What is an agentic data platform sets out the category.

The case for your CFO

The outcome is fewer late nights before filing and fewer findings after it. Reporting breaks surface overnight instead of in filing week, change evidence assembles itself, and the data team spends its time on the questions examiners and the business ask.

The risk story is short. Agents act only at the level you set per domain, from L0 manual to L4 autonomous, and regulated domains start at observe. In those domains every production change waits for a named person, an unanswered request expires and escalates rather than turning into a yes, and every change leaves a receipt with the diff and the rollback path. Your data stays in your systems, and there is zero migration: Data Workers works on top of the warehouse, ETL, catalog and ticketing you already run. Is it safe to let AI agents change production data? and where does our data go? cover the detail.

Why now: supervisors are still pressing on risk data aggregation, the NYDFS access-privilege requirements have applied since May 2025, and warehouse spend is climbing faster than team budgets. A good first win is one regulatory feed at L1 observe, where the team reviews the agents' records and receipts against the bar it set, then moves that domain to L2 propose.

Start with a pilot: $7,500 one-time, credited in full against the first year. Scale is from $1,000 a month and Enterprise from $3,000 a month, billed annually, with unlimited seats, no usage meter, no markup on model spend and your own model. Details are on pricing, and the ROI of agentic data operations shows the model.

The sentence for upstairs: "Data Workers catches regulatory reporting breaks before filing and leaves the evidence our auditors ask for, and our data stays in our systems."

FAQ

Does Data Workers make us compliant with BCBS 239, SOX or DORA? No product does that. Data Workers provides controls and evidence: named approvals, scoped access, privacy checks on pull requests, lineage and a hash-chained audit trail. Your compliance team and auditors decide how they map to your control framework.

Can the agents change a regulatory report on their own? Only at the level you set for that domain. We recommend running regulatory reporting at L1 observe or L2 propose, so every fix is a proposal with its diff, blast radius and rollback path, waiting for the controller or data owner.

Where does our customer data go? It stays in your systems. The agents run in your infrastructure with your credentials and your model key. The hosted Conductor receives workflow metadata only, such as table names, proposals with diffs and run records, never rows or credentials. Enterprise can run in your VPC, on premises or air-gapped.

Does it work with Teradata, Oracle and Informatica? Data Workers translates Teradata and Oracle SQL, plans each migration wave with its parity checks and holds the completion gate for the owner's sign-off. It connects to Informatica, AxiomSL and other tools over their APIs or MCP servers today, and Snowflake, Databricks, dbt, Kafka, ServiceNow, Okta and Entra ID connect natively, among 50+ connectors.

How does it help with an examiner's lineage request? trace_cross_platform_lineage follows a field from the landing table through the warehouse and dbt to the report, and generate_audit_report produces access, PII and violations reports from the audit log. The receipt for each change shows who approved it and when.

What does a first quarter look like? One regulatory feed and one access queue at L1 observe in the first month, a move to L2 propose once the team trusts the receipts, then cost and migration work. What a Data Workers pilot looks like and the first 90 days walk through it.

Sources

• •Basel Committee on Banking Supervision, Principles for effective risk data aggregation and risk reporting (BCBS 239), published 9 Jan 2013, accessed Oct 2, 2026: https://www.bis.org/publ/bcbs239.htm
• •Basel Committee, Progress in adopting the Principles for effective risk data aggregation and risk reporting, 28 Nov 2023, accessed Oct 2, 2026: https://www.bis.org/bcbs/publ/d559.htm
• •ECB Banking Supervision, Supervisory priorities 2026-2028, accessed Oct 2, 2026: https://www.bankingsupervision.europa.eu/framework/priorities/html/index.en.html
• •eCFR, 16 CFR Part 314, current as of Oct 2, 2026: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314
• •Federal Register, Standards for Safeguarding Customer Information, Dec 9, 2021 (effective Jan 10, 2022): https://www.federalregister.gov/documents/2021/12/09/2021-25736/standards-for-safeguarding-customer-information
• •Federal Register, Standards for Safeguarding Customer Information, Nov 23, 2022 (314.4(c)(1) through (8) effective Jun 9, 2023): https://www.federalregister.gov/documents/2022/11/23/2022-25201/standards-for-safeguarding-customer-information
• •Federal Register, Standards for Safeguarding Customer Information, Nov 13, 2023 (effective May 13, 2024): https://www.federalregister.gov/documents/2023/11/13/2023-24412/standards-for-safeguarding-customer-information
• •New York State Department of Financial Services, 23 NYCRR Part 500 (Second Amendment text, 500.7, 500.6, 500.22), accessed Oct 2, 2026: https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500
• •ESMA, Digital Operational Resilience Act (DORA), accessed Oct 2, 2026: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora
• •PCI Security Standards Council, Just Published: PCI DSS v4.0.1, 11 Jun 2024: https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1
• •eCFR, 17 CFR 240.13a-15, up to date as of Sep 30, 2026: https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR0336d7a3e8d64e4/section-240.13a-15
• •PCAOB, AS 2201, accessed Oct 2, 2026: https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201
• •European Commission, AI Act regulatory framework (updated Aug 3, 2026): https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
• •Data Workers, Security, accessed Oct 2, 2026: https://dataworkers.io/security/
• •Data Workers, Pricing, accessed Oct 2, 2026: https://dataworkers.io/pricing/