AI agent training for payments operations staff in retail banking in Italy

Italian retail banks moving payments exceptions to agents should train operations staff in three things: supervising what the agent allows, holds and refuses; deciding the refunds, recalls and fraud cases that stay human; and meeting the EU AI Act's literacy duty alongside DORA, PSD2 and the payee checks now required on instant transfers.

What does a payments operations analyst do at an Italian retail bank?

The work spans old and new rails. Analysts handle SEPA credit transfers and instant transfers that were rejected, recalled or sent to the wrong IBAN; SEPA direct debits that customers dispute or ask to have refunded; commercial collections that Italian small businesses still run through bank receipts; and tax payments made through the bank that failed or were applied to the wrong code. Cheques are fewer but not gone, and unpaid items still need handling.

Branches matter more in Italy than in many markets. Older customers bring problems to the counter, and the branch relies on operations for an answer in clear Italian. Fraud has shifted towards customers being persuaded to authorise transfers themselves, which puts analysts in the middle of disputes about who should bear the loss.

Where can agents help, and at what depth?

• Depth 1, read. The agent reads a rejected or recalled transfer and the account history and explains in plain Italian what happened and why.
• Depth 2, draft. It drafts the recall request to the receiving bank, the customer letter on a direct debit refund and the reply to the branch. An analyst approves and sends.
• Depth 3, execute within bounds. It processes direct debit refund requests that meet the scheme's conditions exactly and fall inside the bank's own limits, and closes the ticket.
• Depth 4, held. Crediting a customer for a disputed transfer, or releasing an instant payment held after a payee name mismatch, moves money. The agent prepares and holds it for a named analyst.

Provenance matters on every item. The core banking ledger is sealed. The receiving bank's answer is signed. A customer's account of a phone call from "the bank" is declared. A forwarded message with new account details is external, and an external claim cannot authorise a payment.

What stays with the analyst, and why?

Fraud disputes stay with people: whether the customer authorised the transfer, whether strong customer authentication was properly applied, whether the bank should refund. So do decisions to release payments after a name mismatch warning, credits before a recall succeeds, and suspicious activity reports. Each carries legal weight and needs a named decision.

The argument is made in why payments operations staff are the real control in an AI agent deployment. It also answers the concern in whether AI agents will replace payments operations staff: matching and drafting move to the agent, and the judgement concentrates with trained people.

What must analysts learn?

Analysts at an Italian bank should first share the vocabulary in AI agent skills by role, following the order in what payments operations staff should learn before working with AI agents. The local emphasis is the authentication trail: a held fraud credit should be approved only after the reviewer has seen how the customer authenticated the disputed transfer and whether the bank's warnings appeared. Where the agent misreads a scheme reason code, the fix belongs in its sources, as banking corrections that improve an AI agent explains.

Instant transfers run outside branch hours, so cover matters. If the agent's 90-day certificate lapses or a run fails, direct debit refunds stop processing on their own and wait for people; a rota that extends into evenings and weekends, built as described in how to build a reviewer rota for a payments operations team, keeps them moving.

Which rules in Italy shape oversight and AI literacy?

The EU AI Act applies directly. Article 4 asks deployers to ensure sufficient AI literacy among staff who deal with AI systems. Article 26 sets deployer duties, including assigning human oversight to people with the necessary competence, training and authority, and Article 14 sets out what oversight must make possible. Article 12 requires automatic logs for high-risk systems, a useful benchmark for any agent's record.

DORA applies to banks and covers ICT risk management, incident reporting, resilience testing and ICT third-party risk, which includes the providers behind an agent. PSD2 strong customer authentication is central to fraud disputes, and the EU Instant Payments Regulation requires payment service providers to verify the payee's name. Banca d'Italia supervises, with ECB banking supervision for significant banks and the EBA setting EU-wide guidelines. GDPR governs customer data, with the Garante as the Italian authority; a data protection impact assessment under Article 35 is the usual starting point. The EU AML Authority (AMLA) is being established in Frankfurt, and FATF Recommendations frame AML duties meanwhile.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How should the first 90 days run?

1. Days 1 to 30. All analysts and branch liaison staff learn the vocabulary and the bank's red lines. The agent explains rejected and recalled transfers at depth 1.
2. Days 31 to 60. Recall requests, refund letters and branch replies move to depth 2. Corrections are logged with reasons and shared with the ICT risk function for DORA evidence.
3. Days 61 to 90. Direct debit refunds within scheme conditions move to depth 3. Team leads sample the record and confirm every fraud credit had a named approver. Pryme Intelligence Academy's Operator track is one route for certifying the approvers.