How HSBC Builds AI Coding That Doesn't Crumble Under Fintech Pressure

Banks Can't Afford Sloppy Code

Everyone talks about caring for code—reviews, tests, docs. But at HSBC, it's not a slogan. Li Weining, who leads internal open source at the bank, is embedding AI into the entire software development lifecycle. He spoke at AICon Shenzhen about turning AI from a personal shortcut into an organizational muscle that prioritizes quality, security, and compliance.

Fintech has zero margin for error. A glitch in a trading system or a breached customer database can trigger chaos. So HSBC's AI coding isn't about raw speed—it's about responsibility. Li's talk, "From Code Generation to R&D Closed Loop: AI Coding in Fintech SDLC," walked through the hurdles of weaving AI into a tight regulatory framework.

The Messy Reality of Fintech R&D

Building fintech software isn't like shipping a consumer app. You're dealing with legacy systems, strict rules, and teams using wildly different tech stacks. Li noted that AI tools like GitHub Copilot work fine for individual devs, but they stumble in complex business contexts. Outputs can be inconsistent, and hallucinations—when the model produces plausible but wrong code—are a constant threat.

Security and compliance aren't optional. AI might accidentally touch sensitive data or make unauthorized calls. And scaling is a headache: what works for one team often fails elsewhere, and proving value is murky. HSBC has been wrestling with these issues directly.

Internal Open Source: Not Just a Buzzword

HSBC's answer? Treat AI coding practices like open source projects. They built an internal community where teams swap their AI experiences. No more reinventing the wheel—they pool what they've learned. This encourages collaboration, but it also demands discipline: you have to care about what you share and who'll use it.

From scattered prompts to reusable tools and Agent Skills, HSBC has curated a library of tested solutions. These aren't random snippets; they're vetted, battle-hardened artifacts. By treating them as open source, everyone taps into the collective brain.

Agent Skills: Doing the Grunt Work

Li demonstrated how Agent Skills slot into each SDLC stage. In requirements, agents mine Jira and Confluence to clarify what's needed, ask smart questions, and flag gaps. During design, they generate architecture options and run impact analyses, giving teams data for decisions. In coding, they pair with VS Code and GitHub Copilot to speed things up. In review, they scan for risks and compliance issues. In testing, they create test cases and analyze defects—closing the loop.

This isn't automation for automation's sake. It's about reducing human error and letting developers focus on the tricky, creative stuff. Think of it as a meticulous colleague who double-checks your work and catches what you'd miss at 2 AM.

Wiring Agents into the Toolchain

One key takeaway: integration matters. Agents can't live in a vacuum. HSBC uses MCP (Model Context Protocol) to bridge agents with tools, data, and research context. That means smooth connections with VS Code, GitHub Copilot, Jira, and Confluence.

The aim is to shift from isolated helpers to cross-tool workflows. Example: an agent pulls a requirement from Jira, whips up code in VS Code, then creates a test case—all without human nudging. That level of integration needs careful planning and a deep understanding of how devs actually work.

Guardrails and Governance

You can't let AI run loose in a bank. HSBC has set up strong governance for AI coding: defining data boundaries, blocking agents from sensitive info, and implementing permission controls. They also keep audit trails and quality checks for Agent Skills.

Li stressed balancing speed with engineering risk. Shipping faster isn't enough; you need safe, compliant code. That's where the real care comes in. The governance framework ensures AI is used responsibly, and problems get caught early—not after the damage is done.

Scaling Without Losing Your Marbles

Going from pilot to enterprise-wide is tough. HSBC started with small internal open source projects and gradually built a platform shared by over 10,000 people. They picked high-value pilots and mapped repeatable adoption paths.

But scaling isn't just tech. It's people. HSBC invested in training, feedback loops, and community management. They fostered a culture where devs feel okay sharing wins and screw-ups. That community vibe is what keeps the AI practices evolving.

What Others Can Learn

Li's talk offered practical advice for anyone diving into AI coding. First, start with a community—give teams a place to share what works and what doesn't. Second, bake governance in from day one, not after a scare. Third, measure what matters: not just lines of code or speed, but quality, risk reduction, and whether devs are happier.

HSBC's story is a reminder that AI isn't magic. It takes thoughtful rollout, constant attention, and a stubborn commitment to doing things right. Whether you're caring for code or people, the principles are the same: be deliberate, be thorough, and never trade quality for speed.