The Foundation Gap: Notes from WFIS Philippines 2026

The fifth edition of the World Financial Innovation Series ran at the Manila Marriott on 25 and 26 August, bringing over 600 banking, insurance and fintech leaders into one room. LUMIQ was there as Gold Sponsor alongside AWS. Two days of sessions, a crowded exhibition floor, and a conversation that had noticeably changed shape since last year.

The change is this. Nobody in Manila was asking whether AI belongs in a bank. They were asking what has to be true before it works.

The regulator got there first

In June, Bangko Sentral ng Pilipinas issued Memorandum M-2026-031, setting out AI governance guidelines for financial institutions. That matters for reasons beyond compliance. In most markets, supervisory guidance arrives after the industry has already made its mistakes at scale. Here it landed while adoption is still young.

Forty-four percent of Philippine financial institutions have deployed at least one AI system. That is a meaningful base, but it is mostly single systems doing single jobs. The guidelines have arrived at the point where institutions are deciding whether to go from one system to twenty, which is exactly the point where governance either becomes architecture or becomes paperwork.

Banks that treat M-2026-031 as a documentation exercise will spend the next three years retrofitting. Banks that treat it as a design input will move faster than their peers, not slower.

Seventeen percent, and sixty percent

Two numbers from the AWS session stayed with us. Seventeen percent of organisations have deployed AI agents today. More than sixty percent intend to within two years.

The distance between those numbers is not a procurement cycle. It is a build programme. Agents do things rather than suggest things, which means they need clean data, resolved entities, permissioned access, auditable decisions and a rollback path. None of that gets bought in a quarter.

The same research put the cost of skipping that work plainly. Organisations with successful AI invest four times more in data quality, governance and AI-ready people. More than half of generative AI projects are abandoned after the proof of concept. The projects do not fail in the model. They fail in everything the model was assuming.

Below the waterline

That was the title of the session Mitch Bautista, Financial Services Industry Head at AWS Philippines, delivered with Manish Bajaj, LUMIQ’s Regional Head for Southeast Asia. Below the Waterline: What AI-Ready Banks Built First.

The framing is useful because it puts the visible layer in its place. Copilots, chat interfaces and agent demos are the part of the ship above the surface. They are also the part that gets funded first, because they are the part that can be shown to a board.

What sits below is less photogenic. A data layer where customer, account, transaction and product records agree with each other. Lineage that survives an audit question. Context that travels with the data rather than being reassembled by each application that touches it. Access controls that hold when a machine is making the request instead of a person.

Banks that built this first are now shipping AI use cases in weeks. Banks that did not are running their fourth pilot on the same unresolved customer master.

The identity problem sitting next to it

Elsewhere on the agenda, the account takeover sessions made a point that belongs in the same conversation. The high-risk moments in a customer lifecycle are well known: login from a new device or location, unusual login behaviour, account recovery, SIM swap, a beneficiary added just before funds move, a transfer that breaks the customer’s pattern.

Attackers do not exploit any one of these. They exploit the gaps between them, because each moment is usually handled by a different system that does not know what the others just saw. Passwords, knowledge-based questions and SMS one-time passwords prove that someone has access. They do not prove who that someone is.

This is a data problem wearing a security badge. If a bank cannot assemble a single continuous view of a customer across channels and moments, it cannot do real-time fraud decisioning and it cannot do useful AI either. Same foundation, two different business cases, and most institutions are funding them separately.

What we are taking back

Three things, for anyone who was not in the room.

First, the sequencing question is now the strategy question. Every institution in Manila has an AI roadmap. The difference between them is what they chose to build before the roadmap.

Second, governance is cheaper early. M-2026-031 gives Philippine institutions something most markets did not get, which is a clear target to build towards before the estate gets complicated.

Third, the foundation is shared. Fraud, compliance, personalisation and agentic automation all draw from the same data layer. Funding it four times over as four separate projects is how the four times multiplier gets spent on the wrong things.

Thanks to Tradepass for a well-run two days, and to everyone who stopped by the LUMIQ stand. The conversations were the best part.