MPs quiz major UK banks on IT vulnerabilities and AI

The chief executives of Barclays, HSBC, Lloyds Bank, and NatWest have faced questions from MPs about IT vulnerabilities and the growing use of AI across the banking sector.

During a Treasury Select Committee meeting on Tuesday, HSBC chief executive Ian Stuart explained that cybersecurity is currently the bank's biggest expense in business, with the organisation investing hundreds of millions of pounds in both legacy and modern systems.

When asked by Conservative MP Dame Harriett whether IT vulnerabilities kept him up at night, he told lawmakers: “It does keep me awake but for a slightly different reason, which is that I think cybersecurity is now very much at the top of our agenda."

He continued: “It does worry me because we can be attacked, and are being attacked, all the time. The defence mechanisms you put in are absolutely critical."

Stuart assured the Committee that the amount of money being spent on systems across the banks attending the meeting is "enormous today" and has to be because of customer reliance on digital technology.

When asked whether AI will reduce the number of employees at NatWest Group following public comments that it could help the bank's workforce become more efficient, chief executive Paul Thwaite told MPs that the bank does not see a direct link between deploying technology and the removal of jobs.

“The way we think about it, and the way I have talked about it publicly, is that we are putting the tools into the hands of our colleagues,” he told MPs. “We think that makes them more effective and more efficient."

He did however say that the profile of the the bank's workforce is "changing a lot."

"We are now recruiting people who are specialists in AI, data scientists and digital experts," added the NatWest boss. "That is a different profile of staff than the bank was recruiting 15 or 16 years ago. It is an addition to staff, rather than a replacement.”

Vim Maru, chief executive of Barclays UK, was also questioned about the bank's legacy systems following a major technical glitch earlier this year which impacted thousands of customers for up to three days.

Shortly after the outage, the Treasury Select Committee wrote to the chief executives of the UK’s top banks to ask for information on the scale and impact of IT failures impacting their businesses over the past two years.

A month after the incident, customers at TSB, Lloyds Banking Group, and Halifax also faced IT issues that hindered access to online banking services.

Speaking at the meeting on Tuesday, Maru said that Barclays has worked "very hard over many years" to ensure that customer disruption is as limited as possible, investing many tens of millions in its systems.

"What we have been seeing is that incident levels have been dropping—for 2024 versus 2023, they are down 63 per cent —and we continue to work hard to reduce the level of disruption there ever is for our customers and make sure we put that right," continued Maru.

He also assured the Committee that the issue at Barclays, which took place on 31 January, was not the result of a cyber-attack or malicious act.

"We have looked very carefully at whether there are any linkages of these issues to anything to do with payday or the last day of the month, or to do with under-investment in any technology and capability," he said. "We do not find any correlation between those things, but we will continue to work hard to make sure that the uptime for our customers remains high."

Charlie Nunn, chief executive at Lloyds Banking Group said that the bank is exploring the use of AI as a way of helping to give extra advice to customers.

"When we look at the latest large language model version that is coming fully into diffusion now, what we are most excited about is that it can help us to interact with customers better," he said. "We can understand them, provide them with more personalised advice and provide them with a more joined-up experience."

He said that this is currently done with a human in the loop, meaning that there will always be an employee supporting customers.

"One of the reasons that I raised AI in the context of advice and guidance is that when you look at the specifics of a customer situation, you have to join up a lot of information, and then customers need a lot of education and support," continued Nunn. "We think that some of the large language model tools could be part of that solution.

"They enable people, in their own time and at their own time of day, to talk to a large language model and get themselves in the right place so that they can make the right decisions."

He added that the technology is moving very quickly.

"Already, when we look at large language models and agentic AI—keep me honest on where the Committee would like to go on this—we typically implement multileveled agents that monitor each other, ensuring very good outcomes," said Nunn. "It will evolve quickly and we are excited about how we can help customers further."

MP questions are continuing this afternoon with the chief executives of Nationwide, Yorkshire Building Society, and Skipton Group, with another meeting set with the bosses Atom, Starling Bank, and Allica later in the day.



Share Story:

Recent Stories


Beyond compliance: Transforming document management into a strategic advantage for financial institutions
In this exclusive fireside chat, John Rockliffe, Pre-Sales Manager at d.velop, discusses the findings of Adapting to a Digital-Native World: Financial Services Document Management Beyond 2025 and explores how FSIs can turn document workflows into a competitive advantage.

Sanctions evasion in an era of conflict: Optimising KYC and monitoring to tackle crime
The ongoing war in Ukraine and resulting sanctions on Russia, and the continuing geopolitical tensions have resulted in an unprecedented increase in parties added to sanctions lists.

Achieving operational resilience in the financial sector: Navigating DORA with confidence
Operational resilience has become crucial for financial institutions navigating today's digital landscape riddled with cyber risks and challenges. The EU's Digital Operational Resilience Act (DORA) provides a harmonised framework to address these complexities, but there are key factors that financial institutions must ensure they consider.

Legacy isn’t the enemy: what FSIs can do to keep their systems up and running
In this webinar we will examine some of the steps FSIs have already taken to rigorously monitor and test systems – both manually and with AI-powered automation – while satisfying the concerns of regulators and customers.