AI Coding in Fintech: From Snippets to Full SDLC Automation

The Next AI Battle Isn't About Models

Large language models keep getting smarter, but the real competition has shifted. It's no longer just about raw capability. The hard part now is building agents that actually work, wrapping them in solid engineering practices, and getting them to behave in messy, high-stakes business environments.

That's the theme of the upcoming AICon conference in Shenzhen, and one talk in particular caught my attention: Li Weining, head of internal open source at HSBC Technology, is presenting on how AI coding is moving from simple code generation to a full software development lifecycle (SDLC) tool.

Li has spent 15 years in fintech, with stints at HSBC, GAC Auto Finance, XPeng Leasing, and Hang Seng Bank. He's seen the industry's quirks up close—the compliance layers, the legacy systems, the risk aversion. His session promises to be a grounded look at what it actually takes to roll out AI coding in a place where a bug isn't just an annoyance; it's a regulatory headache.

Why Fintech Is a Different Beast

Financial services aren't known for moving fast. The SDLC there is heavy on documentation, sign-offs, and audit trails. When you introduce AI into that mix, you're not just swapping out a code editor—you're touching every step from requirements to deployment.

Li's talk breaks down the real pain points: context, quality, compliance, security, and measurement. In a bank, you can't just trust a model's output because it looks plausible. You need to know where the code came from, whether it violates data boundaries, and how it handles edge cases that could cost millions.

The key insight is that AI coding in fintech isn't about generating more code faster. It's about making the entire process more reliable. That means giving agents the right context, enforcing quality gates, and keeping humans in the loop for the risky bits.

Internal Open Source: The Unlikely Hero

Here's a twist: HSBC's approach relies on internal open source. Different teams are experimenting with AI coding in their own ways—some are using it for test generation, others for code review, still others for requirement analysis. Instead of letting these silos grow, Li's team aggregates the good stuff.

They collect prompts, workflows, and tool configurations, then publish them back as reusable assets. Think of it as a marketplace for AI coding practices. A team that figured out a clever way to use Jira data for requirement clarification can share that as an Agent Skill. Another team can adopt it without starting from scratch.

This isn't just about sharing code snippets. It's about building a governance layer. The internal open-source model creates a natural review process—practices get vetted, documented, and versioned. That's crucial in a regulated industry where you need to prove how decisions were made.

Agent Skills Across the SDLC

Li's talk walks through concrete examples of Agent Skills at each stage of the SDLC.

Requirements: Jira and Confluence as Context

Instead of a blank page, agents pull in ticket history, design docs, and comments from Jira and Confluence. They help clarify ambiguous requirements before a line of code is written. That's a huge time-saver in meetings that usually drag on for days.

Design: Architecture and Impact Analysis

Agents assist with generating architecture options, analyzing potential impacts of changes, and even documenting trade-offs. This doesn't replace architects, but it gives them a starting point and cuts down the busywork.

Coding: VS Code and GitHub Copilot

The most obvious use case. But in fintech, the code needs to meet internal standards. Agents are trained or prompted to follow specific patterns, and they integrate with the IDE to offer suggestions that fit the codebase's conventions.

Review: Catching What Humans Miss

Code review is a bottleneck in many teams. Agents can flag potential issues, check against coding standards, and identify risky patterns. They don't replace reviewers, but they make the first pass faster and more consistent.

Testing: Generation and Verification Loops

Test case generation is a sweet spot. Agents can churn out edge cases and integration tests that humans often overlook. They also help with defect analysis—looking at a failure and suggesting likely causes.

The thread here is that each Agent Skill is narrow and focused. They're not trying to build one mega-agent that does everything. Instead, small, well-defined skills are composed into a workflow. That modularity makes them easier to govern and reuse.

MCP and the Tool Integration Puzzle

For agents to be useful, they need to talk to the tools developers already use. That's where the Model Context Protocol (MCP) comes in. MCP acts as a bridge between agents and data sources or tools. It's like a USB-C for AI—standardizing how agents access context.

In HSBC's setup, MCP connects agents to Jira, Confluence, GitHub, and CI systems. This lets an agent pull the latest ticket status, read a design doc, and check a build result without manual intervention. The result is a cross-tool workflow that feels less like a chatbot and more like an assistant that's actually part of the team.

But integration isn't just about APIs. It's about workflow design. You need to decide when an agent should act autonomously and when it should ask for human approval. In fintech, the default is often 'ask first.'

Governance, Risk, and the Compliance Tightrope

Here's the part that usually gets glossed over: security and compliance. If you let an AI agent roam your codebase, you're opening the door to data leaks and unauthorized actions. Li's talk doesn't shy away from this.

They're building guardrails around Agent Skills—who can use them, what data they can access, and how their actions are logged. There's a permission model, an audit trail, and a review process for new skills. It's not just about preventing bad actors; it's about proving to regulators that the process is sound.

Another challenge is quality control. Model outputs can be inconsistent, especially in complex scenarios. HSBC is tackling this by combining automated checks with human oversight. Agents suggest, but humans dispose. The goal is to make AI a tool that augments human judgment, not replace it.

Scaling from Pilot to Enterprise

Getting from a handful of teams to thousands of developers is a different challenge. HSBC started with small internal open-source projects and slowly built a platform that now has tens of thousands of contributors and users. The key was finding high-value use cases that could be replicated.

They also focused on adoption. It's not enough to build a great tool; you need to train people, gather feedback, and create a community. They've set up feedback loops, regular training sessions, and a mechanism for developers to propose new Agent Skills.

One of the biggest hurdles is measuring value. How do you quantify the benefit of a faster code review or a better test suite? It's hard, but Li's team is working on metrics that go beyond lines of code or time saved. They're looking at defect rates, rework, and even developer satisfaction.

The Road Ahead

AI coding in fintech is still early days, but the direction is clear. It's not about replacing developers—it's about making the entire SDLC more intelligent. The tools will get better, the governance will get tighter, and the line between human and machine work will blur.

Li's talk offers a blueprint for anyone trying to navigate this transition, especially in industries where the cost of failure is high. The takeaway: start small, share openly, and build the guardrails before you build the rocket.