NatWest trials AI spending tool, adds Cora fraud triage

NatWest Group announced two new AI-powered features on 25 September 2026: a planned voice-and-text trial called Spending Insights, initially for Royal Bank of Scotland customers, and a Fraud Triage Agent already running inside the group's Cora chat assistant. The first is designed to turn a customer's transaction history into personalised insights and graphs about spending, budgeting and financial habits. The second gathers a customer's account of a suspicious credit-card transaction and points them towards the right fraud, scam or dispute team.

The Fraud Triage Agent operates inside Cora, the chat assistant used across NatWest Group's brands, which include National Westminster Bank, Royal Bank of Scotland and NatWest itself. Spending Insights is described separately as a planned trial, and NatWest's announcement does not establish that it will run inside Cora. The group says it handled 12.9 million retail-banking conversations through Cora during 2025, half of them without any human involvement, and that generative AI was supporting 21 Cora customer journeys by 31 December 2025 after being added to 17 more during the year. NatWest reports an increase of roughly 20 percentage points in queries resolved without human intervention on those generative-AI journeys compared with equivalent non-generative Cora journeys.

The new features matter because they move NatWest further into financial guidance and fraud handling — areas where the Financial Conduct Authority's Consumer Duty and UK data-protection law apply regardless of which technology a firm uses. Cora itself moves into fraud handling through the Fraud Triage Agent; Spending Insights is a separate, planned extension of AI into spending guidance, not established as a Cora feature. NatWest has disclosed how the tools are meant to work, but it has not published several details a customer or a regulator would want before relying on them: trial size and timing, the technical basis of the AI models, accuracy or reliability testing, and what happens when the system gets something wrong.

What NatWest has launched, and what remains a trial

Spending Insights is not a live product. NatWest describes it as a planned audio-visual, voice-and-text trial, initially for Royal Bank of Scotland customers, that will let customers ask questions about their spending, budgeting and financial habits and receive personalised insights and graphs in response. The announcement does not state when the trial will begin, how long it will run, how many customers will take part, or how those customers will be chosen. It is also not established whether participation will be optional, whether a non-AI route will remain available, or how consent and privacy information will be presented before a customer's first use.

NatWest says Spending Insights was developed by its Chief AI Research Office and is powered by proprietary small language model technology. The company's own materials are inconsistent on the detail: some references describe "small language models" in the plural, others a single proprietary model, and the exact architecture, training data and hosting arrangements are not disclosed. NatWest also describes the planned experience as an industry-first, fully generative, real-time voice-to-voice banking service. That is a marketing claim rather than an independently verified one — the announcement does not define the comparison set or provide evidence of priority over other banks' tools.

The Fraud Triage Agent, by contrast, is already live within Cora for customers concerned about suspicious credit-card transactions. NatWest's customer-facing fraud-reporting page describes it asking what happened and then guiding the customer to the appropriate fraud, scam or dispute team or next step. NatWest's own description frames this as advice and claim-routing support, not the final adjudication of a claim. A report accompanying the announcement, as described by secondary analysis, says the tool launched in August 2026; the exact launch day has not been published. NatWest says the agent had handled nearly 19,000 customer conversations by 25 September 2026.

How Spending Insights will use transaction data

NatWest says the tool will interpret a customer's transaction data to produce personalised insights and interactive graphs covering spending, budgeting and financial habits. Beyond that description, the company has not said how much transaction history the tool can access, which fields it processes — merchant, category, location or counterparty data, for example — or whether it can draw on linked accounts. Nor has NatWest said whether voice recordings or transcripts are retained, for how long, or whether customer data feeds back into training any model. These are the kind of details a tool-specific privacy notice or data protection impact assessment would normally settle, and none has been published alongside the launch.

How Cora's fraud triage works, and where it stops

The Fraud Triage Agent's role, as described in NatWest's own materials, is to gather information from a customer about a suspicious credit-card transaction and route them to the right internal team or process. NatWest says fraud specialists remain involved and that human judgement turns AI-generated signals into action — language that suggests the tool informs rather than replaces staff decisions. What is not established from the published material is whether the agent only routes cases or whether it also influences operational actions such as blocking a card, applying provisional credit, classifying a dispute or shaping the outcome of a claim. A conversation count of nearly 19,000 is a volume figure, not an outcome measure: NatWest has not published routing accuracy, resolution rates, escalation rates, abandoned journeys, complaint levels or reimbursement outcomes for the tool.

Where human support sits

NatWest's broader customer-facing material says Cora can pass a customer to a colleague "if necessary," and that fraud specialists apply human judgement to signals the AI generates. Royal Bank of Scotland's Cora page adds that conversations with Cora are stored for monitoring purposes, pointing customers to its privacy notice for further detail, though it does not state a retention period. What is missing from the public record is whether every fraud-triage path offers immediate access to a person, what happens outside staffed hours or during a system outage, and how quickly a customer can expect a human response if they ask for one.

NatWest's own AI and Data Ethics Code of Conduct, which the company says governs its use of AI, is described by NatWest itself as a statement of intent rather than a comprehensive account of its AI use — a distinction worth noting given how much of the detail above remains undisclosed.

Consumer Duty, data protection and fraud reimbursement

None of this sits outside existing UK regulation. The FCA's Consumer Duty, which took effect on 31 July 2023, requires firms to act to deliver good outcomes for customers, avoid causing foreseeable harm, and provide support that meets customers' needs. The FCA has not assessed either NatWest tool specifically, but the Duty is technology-neutral: deploying an AI assistant does not change a firm's underlying obligations.

Use of transaction and conversational data in both tools also remains subject to UK data-protection law. The Information Commissioner's Office's guidance on AI sets out requirements for data minimisation, security, fairness, transparency and statistical accuracy appropriate to the purpose for which data is processed. That guidance establishes general duties rather than certifying any individual firm's system, and it does not assess NatWest's implementation.

On the available descriptions — insights, guidance and routing — neither tool appears to make a solely automated decision with legal or similarly significant effects on a customer. If either tool were found to influence claim acceptance, card blocking, reimbursement or access to services without meaningful human review, automated-decision safeguards under UK data-protection law could become more directly relevant.

Reimbursement rules also depend on the type of claim rather than on whether Cora was involved. The Payment Systems Regulator's mandatory reimbursement requirement, which set a maximum reimbursement of £85,000 per eligible claim from 7 October 2024, applies to eligible authorised push payment scams made over Faster Payments. It does not automatically apply to every suspicious credit-card transaction that a customer raises with the Fraud Triage Agent; credit-card fraud and disputes follow different protections and processes. A customer should check which route applies to their own case rather than assume Cora's triage determines it.

Survey findings, and a sample discrepancy worth flagging

NatWest also published customer research alongside the launch. It reports that 57% of surveyed customers said they were using AI more than six months earlier, though the company describes this finding inconsistently across its own materials — variously as using AI "much more," using AI tools "more," and AI use having "grown rapidly" — and has not published the exact survey question or response scale. The research also found that 40% used AI tools most days or daily, and 22% used AI platforms for financial information and advice. On trust, 81% said access to a real person was the most important factor in building trust in financial-services AI, 77% wanted clarity about data handling, 77% wanted confidence that AI-enabled services would work with 100% reliability, and 75% considered strong independent regulatory oversight important.

These are survey responses about attitudes, not measured performance of NatWest's own tools. The underlying sample figures also do not add up cleanly: NatWest's press release describes research covering "more than 2,400" customers benchmarked against 1,800 UK consumers, while the accompanying report's methodology reportedly gives 2,422 and 1,853 respectively — figures that themselves total 4,275 — against a stated overall sample of 4,077. NatWest has not explained the discrepancy.

What to watch next

The clearest gaps are the trial's start date, size and eligibility criteria for Spending Insights; the technical basis and any independent testing of NatWest's small language model technology; and outcome data — rather than conversation counts — for the Fraud Triage Agent. A published data protection impact assessment or tool-specific privacy notice would resolve open questions about data retention and training use. There is no evidence in NatWest's published material that either tool is part of the FCA's AI Live Testing programme; readers should not treat the company's broader AI activity as regulatory approval of these two specific deployments. Customers wanting the definitive position on their own protections should check NatWest's official fraud-reporting guidance and the Payment Systems Regulator's published policy rather than relying on Cora's triage alone.