> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpmanager.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Financial Services & Banking
> How MCP Manager makes agentic AI examinable for banks and financial institutions — one governed gateway that attributes every tool call to a real identity, keeps NPI and special-category data out of models, and produces the evidence trail GLBA, DORA, SR 11-7, NYDFS Part 500, and the EU AI Act demand.
MCP connects agents to the systems that run a bank: core banking platforms, CRMs, loan-origination systems, payment rails, and the data stores behind them. Banks including JPMorgan, Citi, and BNY have publicly described building agentic systems on MCP, and "agentic banking" is now a recognized category. That reach is what makes an agent useful, and it is exactly what makes ungoverned MCP a non-starter for a GLBA- or DORA-bound institution.
Out of the box, those connections produce no audit trail tying a tool call to an identity, a data category, and an action. Nothing in raw MCP stops an agent from pulling Nonpublic Personal Information (NPI) or special-category data into a model context that was never sanctioned for it. And developers can stand up MCP connections faster than security can inventory them — the shadow-AI problem that DORA's third-party register and model-risk inventories both require you to close on day one.
The result is a familiar squeeze: ban MCP and forfeit the productivity, or allow it ungoverned and lose the ability to answer an examiner. MCP Manager is the third option — a single governed gateway that every agent call passes through, so the bank gets the velocity and keeps the evidence.
```mermaid theme={null}
%%{init: {'theme':'base','themeVariables':{'fontFamily':'Lato, sans-serif','lineColor':'#6a6b76','primaryColor':'#e0e2e8','primaryTextColor':'#12141d','primaryBorderColor':'#6a6b76','edgeLabelBackground':'#ffffff','textColor':'#12141d'}}}%%
flowchart LR
A1["🤖
Employee AI assistants
(Claude, ChatGPT, Copilot)"]
A2["🤖
Autonomous agents"]
GW["🛡️
MCP Manager gateway"]
LOG[("🗄️
Audit log")]
subgraph bank["Your regulated estate"]
direction TB
S1["🖥️
Core banking"]
S2["🖥️
CRM"]
S3["🖥️
Loan origination"]
S4["🖥️
Payment rails"]
end
A1 -->|"identity-attributed
tool calls"| GW
A2 --> GW
GW -->|"inspected & logged"| S1
GW --> S2
GW --> S3
GW --> S4
GW -.->|"every call,
every identity"| LOG
classDef gateway fill:#0086ff,color:#ffffff,stroke:#062b4c,stroke-width:2px;
classDef client fill:#80cbc4,color:#062b4c,stroke:#00796b,stroke-width:1.5px;
classDef server fill:#aed8ff,color:#062b4c,stroke:#0b4880,stroke-width:1.5px;
classDef datastore fill:#062b4c,color:#ffffff,stroke:#0086ff,stroke-width:1.5px;
class GW gateway;
class A1,A2 client;
class S1,S2,S3,S4 server;
class LOG datastore;
style bank fill:transparent,stroke:#9ca1ab,stroke-dasharray:4 3,color:#6a6b76;
```
The gateway sits between every agent and every regulated system, so each call is authenticated, inspected, and recorded at the one place it can be — without changing the agents or the downstream systems.
## The regulatory reality
Across every major jurisdiction, AI is being folded into existing risk, ICT, and data-protection rules, and the demand reduces to one thing: demonstrable control with an evidence trail, at the point agents touch data. Here is what each regime asks of an AI deployment, and what MCP Manager does about it.
* **GLBA Safeguards Rule** — an agent that can reach NPI must meet the same access, transmission, and audit safeguards as a human employee. MCP Manager [brokers identity and scopes access](/security/authentication-and-identity) per agent, encrypts every hop, and writes each NPI-touching call to a [searchable audit log](/security/audit-and-observability).
* **SR 11-7 and the April 2026 interagency model-risk guidance** — supervisors increasingly expect LLM assistants to carry documented oversight, monitoring, and human override by analogy to model risk. MCP Manager gives you the per-identity [record of what each assistant accessed and did](/features/viewing-logs), so that oversight is evidenced rather than asserted.
* **DORA** — you must inventory, govern, and produce evidence for every third-party ICT dependency, AI included, and fail safely under test. MCP Manager makes every agent connection an inventoried entry in [one governed gateway](/mcp-gateway-concepts/mcp-gateways), logs every call, and lets your sensitive-data rules [fail closed](/features/gateway-rules/overview) on error.
* **NYDFS Part 500 and the EU AI Act** — AI must sit inside your cybersecurity program, and high-risk uses such as creditworthiness assessment carry traceability and human-oversight duties. MCP Manager [exports its logs to your SIEM](/enterprise/export-to-siem) and [attributes every decision-relevant call](/security/audit-and-observability) to a real person or agent.
Each framework reduces to the same controls — know the identity, scope the access, gate the data, keep the evidence — which the gateway delivers at the one point agents touch data.
| What regulators demand | What MCP Manager enforces today | What it lets you demonstrate |
| --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------- |
| **Examinable record of AI activity** (DORA, SR 11-7, GLBA audit procedures) | A comprehensive audit log of every MCP call, attributed to the real user or agent behind it, with the tool invoked, the request and response, and the enforcement verdict — searchable and exportable to your SIEM | "We can reconstruct any AI interaction for an examination, a DPIA, or a DSAR." |
| **Keep NPI and special-category data out of models** (GLBA Safeguards Rule, GDPR data minimization) | [Gateway rules](/features/gateway-rules/overview) inspect messages in flight and block, redact, mask, replace, or hash sensitive data before it reaches a model, using regex and Microsoft Presidio detection | "AI cannot see NPI it was not authorized to see. We enforce it at a chokepoint, not by policy alone." |
| **Least privilege and segregation of duties** | [Capability-based RBAC](/deployment/rbac-and-roles/overview) with custom roles, per-team and per-identity tool scoping, and [identity brokering](/security/authentication-and-identity) so a downstream system never sees a raw user token | "Agents have least-privilege, scoped access, the same standard we hold humans to." |
| **Eliminate shadow AI; maintain a third-party inventory** (DORA register) | A single governed control plane through which all MCP traffic is routed, with an inventory of every server, host, agent, and connection | "Every agent-to-system connection is known, governed, and visible. Nothing reaches our systems off the books." |
| **Operational resilience and fail-safe controls** (DORA) | A per-rule choice to [fail closed](/features/gateway-rules/overview) on a rule-engine outage, plus break-glass kill switches that instantly disable a host, connection, or identity | "A classifier outage defaults to denying sensitive data, not leaking it, and we can cut off a connection instantly." |
| **Feed AI activity into existing monitoring** (NYDFS Part 500, DORA) | [Export to your SIEM](/enterprise/export-to-siem) over OpenTelemetry, with pre-built connectors and a self-hosted-collector option | "Our AI governance is inside our control boundary and feeds our existing resilience program." |
The audit-log row is the one to internalize: every MCP call is attributed to the real person or agent behind it, so the record supports non-repudiation rather than pointing at a shared service account.
## How MCP Manager governs banking AI
The gateway enforces each capability below on live traffic today.
* **One control point, every call attributed.** The gateway is the single URL every host and agent connects to. It records the requesting identity, the tool, the request and response, the latency, token counts, and the rule-engine verdict for each interaction. See [Audit & observability](/security/audit-and-observability).
* **Sensitive-data enforcement in flight.** Gateway rules run inbound and outbound. A rule can detect an account number or an SSN with a [regex pattern](/features/gateway-rules/regex) or with [Microsoft Presidio's](/features/gateway-rules/presidio) trained classifiers, then take one of five actions — block, redact, replace, mask, or hash — before the data ever reaches the model. You choose per rule whether an engine outage fails open or closed, so the rules protecting NPI can fail closed by design. See [PII filtering](/features/pii-filtering) and [gateway rules](/features/gateway-rules/overview).
* **Least privilege for agents and people.** Roles are composed from granular [capabilities](/deployment/rbac-and-roles/capabilities), including view-only auditor roles for compliance reviewers. Tool provisioning is allow-all, allow-only-if-conditions-are-met, or block-all per server. The conditional allowlist is fail-closed and a tool passes only while it still meets the conditions you set — so a tool whose definition is altered after approval stops at the gateway rather than passing on a rug pull, and you can keep write or mutating tools off an agent that should only read.
* **Tool integrity.** [Tool-change protection](/security/feature-governance) pins a tool by name, title, or description, so a server that quietly changes a tool after approval — a rug pull — stops at the gateway instead of reaching your agents.
* **Identity done properly.** Every server uses enforced OAuth with PKCE; the gateway brokers identity so credentials never live in the client, and it can [forward the end user's identity](/advanced/agents-passing-identities) to an upstream system so an agent acts as the real user. [SSO through your IdP](/enterprise/sso) and [SCIM 2.0 provisioning](/enterprise/scim) are supported, and [headless agents](/features/api-tokens-and-headless-agents) get their own scoped identity. See [Authentication & identity](/security/authentication-and-identity).
* **Hardened by design.** Stored credentials are encrypted at rest with AES-256-GCM under rotating keys, every connection is re-originated over TLS, and you can lock an upstream to MCP Manager's static egress IPs. For a full org-wide lockdown, see [Enterprise strategy & lockdown](/deployment/enterprise-strategy-and-lockdown) and [Architecture & Trust](/mcp-gateway-concepts/architecture-and-trust).
## Why Usercentrics
A pure-play MCP gateway cannot match the one thing this buyer weighs most heavily: a vendor whose entire existence is built on proving that regulated organizations handle personal data lawfully.
MCP Manager is built by **Usercentrics**, the European market leader in consent management — active in 100+ countries and processing billions of consent signals every month across millions of websites and apps. Financial services is an established Usercentrics vertical, served by a company that has operated inside that regulatory reality at scale for years. The platform runs inside Usercentrics' own audited Google Cloud environment under the security and compliance program of a data-privacy company; you can review its posture and certifications at the [Usercentrics trust center](https://trust.usercentrics.com/).
The strategic fit is direct. Usercentrics governs how consented data is collected and used on the web; MCP Manager extends that same control discipline to how AI agents access and use data. For a financial institution, that means one trusted compliance partner across both surfaces, and a control layer built by people who treat provable, lawful data handling as the core product.
## Further reading
The next industry page — holding the information wall and the books-and-records line for the buy-side.
Authentication, feature governance, runtime protections, and audit.
What every call records, identity attribution, and how the evidence trail is built.
Where MCP Manager runs and what stays in your own environment.
## External sources
The Digital Operational Resilience Act, in force across EU financial entities.
The Federal Reserve and OCC foundational model-governance guidance.
FTC guidance on protecting customer financial information.
High-risk obligations covering creditworthiness assessment (Annex III).