The Deposit Loyalty Gate: Which Deposits Agentic AI Takes First — and the Gate That Holds Them

Your deposit base has never been loyal to your bank. It has been loyal to inertia — the habit, the hassle, the ten minutes it takes to move money that kept balances sitting still even when a better rate sat one click away. That inertia is the asset your funding plan has quietly priced at zero, and it is unwinding at different speeds for different segments.

Your customer's AI agent has no habit, no hassle, and no loyalty. Its only job is to find a better yield for a balance and move it. This article lays out the replacement discipline: The Deposit Loyalty Gate, a two-axis map — rate-sensitivity times agent-reachability — gated by a third axis, friction and authorization. It carries one control mechanic running through the middle — reachable is not the same as gone — and one diagnostic, the Vulnerability Quadrant, that names which segment an agent takes first and which ones a regulator is still holding closed on your behalf.

Why this matters now

Three data points moved in the same direction at once, and together they turn this from a thought experiment into an asset-and-liability question due this quarter.

In the United States, the Federal Reserve's March 2024 Senior Financial Officer Survey reported mean cumulative deposit betas over March 2022 to March 2024 of 77% on wholesale non-operational deposits, 58% on wholesale operational, and 40% on retail — measured on deposits with a maturity of 7 days or less, and reported as a mean of self-reports from a panel of roughly 80 to 100 banks rather than as a market-wide measurement. Ordinary savers largely stayed put; the balances that fund the bank at the margin did not. The survey measures betas and pricing rationale and does not measure sweep-tool adoption, so why the wholesale figure ran so high is this framework's inference rather than a survey finding: corporate treasuries running automated cash-sweep tools extracted almost the entire rate rise, because nothing stood in the way.

Layer on speed. The Federal Reserve OIG Material Loss Review of Silicon Valley Bank (September 2023) records $42 billion of deposits leaving on 9 March 2023 — a single day — against a deposit base of which more than 94% was uninsured at the end of 2022. Read those as what they are: a flow, and a stock statistic about the whole book; nothing in the record establishes what share of the $42 billion itself was uninsured. The 30-day Liquidity Coverage Ratio every bank reports was calibrated for a run measured in weeks. This one ran inside a single day.

Now layer on access. Vietnam standardised open banking with Circular 64/2024/TT-NHNN, whose own obligations commenced 1 March 2025. The later date of 1 March 2027 closes a grandfathering window for banks already connecting to third parties by API to serve individual customers before that start — a legacy-compliance deadline, not the moment the rails switch on. And the circular constrains as much as it opens: its Article 7(3) permits payment-initiation Open APIs to be implemented only for third parties that are banks or licensed payment intermediary service providers, so a consumer's own agent provider does not reach payment initiation without that licence. Whether the circular obliges a bank to deploy those interfaces at all, rather than standardising them once deployed, is an open question this series has not settled.

Automated money, moving at machine speed, toward a doorway a regulator is standardising on a dated calendar — and holding partly shut with a counterparty restriction. Read together, that is the setup this framework maps.

The problem: two wrong reactions, one missing axis

When a Treasurer hears "agentic AI will drain your deposits," the room tends to split into two camps, and both get it wrong.

The first camp panics, picturing every retail account quietly emptying overnight — a silent run conducted by software instead of a queue at the branch. They freeze, or they overspend defending a flood that has not arrived.

The second camp shrugs. Inertia has protected deposits, customers are slow to switch, and most never move a balance at all. So this camp assumes agentic AI is hype for this book and does nothing — trusting an inertia that has already collapsed for the balances that actually fund the bank.

Most banks fail here for the same reason: they score a balance on how much it wants yield and how easily an agent can reach it, then stop — and either panic or relax on an incomplete map. When a balance is rate-sensitive and reachable, leaders should ask a third question before they act: can it actually settle? A deposit only leaves when all three line up — sensitive, reachable, and authorized to move. Miss the third axis, and the map over-predicts a run that a regulator, a maker-checker workflow, or an authentication step is quietly blocking.

The fix is not to defend every balance equally. It is to map the axis everyone skips.

The framework: two axes, gated by a third

Here is the reframe, in one sentence.

Loyalty is no longer a feeling your customer has about your bank — it is a gate, and either it holds or it does not.

Stop scoring deposits on how much they want to leave, and start scoring whether they can. The mechanic that holds the whole structure together is a conjunction, not a threshold.

The three axes — two you already score, one you probably do not

Read the map as two scoring axes and a gate, not as a single vulnerability score. Each axis has one job, one failure mode, and one diagnostic question that tells you where a segment sits.

Around the map sit three supporting dimensions, useful for sequencing rather than for scoring: C · Flight Channels (corporate robo-treasury sweeps, embedded savings products, aggregators), V · Velocity (how fast a segment can drain once it starts), and D · Defenses (friction, pricing discipline, liquidity buffers, and the bank's own competing offer).

The Vulnerability Quadrant — score the book, then apply the gate

Score each deposit segment on the two axes, then check whether the gate lets it settle. The order of who leaves is not uniform, and that order is the entire diagnostic.

Every HIGH, MEDIUM and LOW in that table is this framework's own analytic judgement, not a measured observation. The only measured figures in it are the deposit betas, and they measure rate sensitivity — not agency. Read the ratings as the framework's output, and score your own book rather than inheriting these cells.

The balance that leaves first is not the one the headlines fear. It is high-sensitivity, high-reachability, and low-friction — surplus corporate and small-business cash, authorized through a maker-checker workflow rather than an authentication step an agent cannot satisfy. No wall stands between the instruction and the exit.

The Vietnam collision — why the gate holds retail, for now

Vietnam is the cleanest live case of the gate doing its job, and reading it precisely matters more than reading it dramatically.

Circular 64/2024/TT-NHNN raises reachability: an agent can watch a retail account through standardised open-API rails all day. But the moment an instruction tries to move money, Circular 50/2024/TT-NHNN — as amended by Circular 77/2025/TT-NHNN, effective 1 March 2026 — requires OTP combined with biometric matching against chip-based identity, VNeID or stored biometric data. That requirement is scoped, and the scope is load-bearing for this framework: it binds transfers between different account holders above 10 million dong per transaction, or at or below that figure once the day's cumulative transfers pass 20 million. Below those lines, OTP alone.

Two consequences follow, and neither is the one the headline version of this story tells. First, this is the operative instrument — not Decision 2345/QĐ-NHNN, where these requirements originated and which Circular 50 absorbed, but which was repealed in full by Decision 2872/QĐ-NHNN effective 1 January 2025. It is history, not law, and citing it as current is the fastest way to lose a room of compliance officers. Second, the different-account-holders qualifier means a sweep between a customer's own accounts sits in a lower transaction class than a transfer out to a third party — so the biometric limb is narrower than a summary reading of "any transfer over 10 million dong" implies.

The pricing limb is narrower still. Circular 48/2024/TT-NHNN sets the framework for a maximum VND deposit rate but sets no number: the ceiling lives in Decision 2411/QĐ-NHNN (0.5% per annum on demand deposits and tenors under 1 month, 4.75% for 1 month to under 6 months, 5.25% for people's credit funds and microfinance institutions), and it binds only those short tenors. For tenors of 6 months and above, credit institutions set rates on market supply and demand — there is no ceiling. That is the band a yield-seeking sweep would target, so the rate-ceiling limb does not reach the balances this framework is most concerned about. The gate still holds retail today — on authentication scope and on the Article 7(3) counterparty restriction, and less on price than the two-line version of this argument assumes.

That gate is a moat, and a dated one. PDPL Law 91/2025 (in force 1 January 2026) supplies the explicit-consent architecture a customer would use to delegate account access, and AI Law 134/2025 (in force 1 March 2026) governs the agents themselves, with Article 35 giving pre-existing systems in finance 18 months to comply — roughly 1 September 2027. Circular 64's grandfathering window closes 1 March 2027. Loosen the authentication threshold, widen who may hold a payment-intermediary licence, or let the transaction-class boundaries drift, and retail moves toward the corporate quadrant. Watch those, not the calendar alone.

Proof: where the gate is open, and where it holds

Look at both edges of this, because the evidence splits cleanly and does not need embellishing.

Where the gate is already open: corporate treasury. The 77% wholesale non-operational beta is evidence of rate sensitivity in a segment with no settlement gate worth the name — and nothing in that record attributes any part of it to AI agents. Read against the same survey's 40% retail figure it becomes a differential, and the differential is the finding: the balances with the weakest gate extracted nearly twice as much of the rate rise as the balances with the strongest. Whether that previews retail once its own gate comes down is an analogy this framework draws, not something the survey measured.

Where speed proves the danger: Silicon Valley Bank. $42 billion in a single day, from a book of which more than 94% was uninsured at the end of 2022 (Federal Reserve OIG Material Loss Review, September 2023). A networked, digitally reachable deposit base does not drain over 30 days — and one well-documented case makes that point without dressing it in a time of day the record does not support.

Where the gate still holds: Vietnam's own regulatory design. A Bank for International Settlements working paper demonstrates, in simulation, that an autonomous agent can manage a cash-liquidity buffer and prioritize payments to the standard of established prudential practice — proof the capability exists, not proof retail adoption has arrived at scale. No verifiable data yet shows Vietnamese retail customers running such agents against their own accounts, which is precisely why the authentication scope and the counterparty restriction matter today and will matter less as the capability spreads.

Read the two edges together and the framework holds without a blanket alarm: where there is no gate, loyalty is already gone; where the gate holds, a bank has been given time, not permanence. The nearest precedent for how fast reachability itself can build is India's Account Aggregator framework, which crossed 100 million cumulative consents by August 2024, about 3 years after its 2021 launch. Take that as a precedent for how quickly consent-based data access scales, and explicitly not as evidence about an agent moving money — it is a data rail, India's payment-initiation rail is a different system, and conflating the two is how a reachability argument quietly becomes a settlement argument it has not earned.

How to apply this — 5 steps

Read this as an ALCO segmentation drill for the next quarterly cycle, not a defend-everything program.

1. Map the book on both axes, then apply the gate. Score every deposit segment on rate-sensitivity and agent-reachability, then check the friction and authorization layer provision by provision. You are locating the one quadrant that is high-sensitivity, high-reachability, and low-friction.
2. Ring-fence surplus corporate and SME cash. That quadrant is live today. Re-tier it in the asset-liability model as rate-sensitive, machine-fast funding — not the sticky, cheap balance it used to be treated as.
3. Move liquidity monitoring to intraday for the surge-prone segments. The 30-day metric was calibrated for a human-speed run; Silicon Valley Bank lost $42 billion inside a single day.
4. Become the agent. If an external aggregator will optimize a client's idle cash, do it first: sweep surplus balances into the bank's own term and money-market products through a proprietary orchestrator with the same human-in-the-loop and audit-ready controls a good agent needs. It compresses net interest margin on those balances — near-zero demand funding rotates into a several-percent product on the bank's own books — but the funding and the relationship stay yours.
5. Watch the gate as a leading indicator, limb by limb. Track the authentication threshold and its transaction-class scope, the Article 7(3) counterparty restriction, and the rate-ceiling regime the way market risk tracks a benchmark rate — and track which tenors each one actually binds. The day any limb loosens, the retail quadrant moves, and the ring-fencing in step two should already be in place.

The board action underneath all five is one sentence: name the segment that is rate-sensitive, reachable, and ungated today, and re-tier its funding before the gate on the next segment moves.

Risks and caveats

This framework is a segmentation discipline, not a doom forecast, and it deserves the same honesty about its limits that it applies to a deposit book.

The deposit betas are the only measured numbers in it, and they are narrower than they look: mean cumulative figures over March 2022 to March 2024, on deposits with a maturity of 7 days or less, self-reported by a panel of roughly 80 to 100 banks, drawn from a concluded tightening cycle whose betas behave asymmetrically on the way down, with no later round publishing cumulative figures. The survey measures betas and pricing rationale and says nothing about agents — the automated-sweep mechanism, and the reading of 40% retail as a preview of retail once its gate comes down, are this framework's inferences rather than survey findings. Every HIGH, MEDIUM and LOW in the Vulnerability Quadrant is analytic judgement rendered in the visual grammar of measurement; no bank's book has been scored here.

Two limbs of the gate are weaker than the short version of this argument implies, and both are open rather than settled. The deposit-rate ceiling reaches only demand deposits, tenors under 1 month, and 1 month to under 6 months — the 6-month-and-longer band a yield-seeking sweep would target is uncapped, so the pricing limb does not defend the balances the framework is about, and what the gate's argument rests on once that limb is discounted is a question for this framework's next revision rather than something to paper over here. The biometric limb binds transfers between different account holders, so an own-account sweep falls in a lower transaction class. And whether Circular 64/2024/TT-NHNN obliges a bank to expose payment-initiation interfaces, or only standardises them once exposed, is unresolved in this series' research record; Article 7(3)'s counterparty restriction is established and is disclosed above, and nothing here asserts an obligation to deploy.

On the remaining evidence: the Bank for International Settlements paper is a simulation, so treat the capability as demonstrated and the adoption curve as still forming; no verifiable large-scale data yet shows autonomous agents managing retail Vietnamese accounts, which makes the retail side of this map a forward read rather than a backward-looking count; India's Account Aggregator figure is a historical level for a data rail, cited as analogy and not as evidence about payment initiation; the Silicon Valley Bank uninsured share is a stock statistic about the whole base at the end of 2022, not a property of the $42 billion that left, recorded across the full day of 9 March 2023 rather than at any particular hour; a second-jurisdiction comparison on stress outflows against prescribed run-off rates is withheld pending primary-source confirmation and is not relied on above; and United States open-banking rulemaking under Section 1033 remains unresolved at the time of writing. Vietnam's texts move on a real calendar — one clause set inside Circular 77/2025/TT-NHNN reaches a further commencement on 1 October 2026 — and any detail beyond what is cited here should be checked against the primary text before it enters a board paper.

This is independent thought leadership, not affiliated with any current or past employer, and not a substitute for your own legal, compliance, and treasury review. Vietnamese bank and market references anywhere in this series use publicly disclosed data only.

Where this fits in the series

This week extends the series rather than re-deriving it. The GenAI Assurance Grid governs the risk your own models create; this Deposit Loyalty Gate is the adjacent frontier — the risk your customer's model creates against your funding base, a treasury and liquidity question rather than a model-risk one. The AI-Augmented Bank's five-pillar operating model is the parent architecture that "become the agent" draws its own-orchestrator capability from — this article assumes that capability exists rather than re-deriving it. The AI-Ready Bank's five-layer data-readiness map is the dependency behind the reachability axis: an agent can only see a balance because the data layers that map describes are being standardised and opened. And any bank building its own competing agent should run that build through the 4 Stone Guardians governance gate before it goes live — a defensive agent still needs the same pre-deploy checkpoint an offensive one would.

Before your next asset-and-liability meeting

Your deposit base was never loyal — it was inert, and the inertia is unwinding at different speeds for different segments. Corporate and SME surplus cash is already in the high-risk quadrant, and a 77% wholesale beta with no settlement gate in front of it is why. Retail Vietnam sits behind a real gate today, held by an authentication requirement and a counterparty restriction that a regulator, not the bank, controls — and held less firmly than it looks by a rate ceiling that stops short of the tenors that matter. The discipline is to map the book on both axes, apply the gate limb by limb, ring-fence what is already exposed, and become the agent for the balances that matter before an outside one does it for you.

Every week, we send one architecture-grade framework like this one to leaders governing AI in banking, in The AI Architect Letter — one issue a week, no hype. The free five-page Deposit Loyalty Gate playbook gives you the Vulnerability Quadrant worksheet to run against your own book this quarter.

Sources & note. Deposit betas: US Federal Reserve, March 2024 Senior Financial Officer Survey — mean cumulative betas over March 2022 – March 2024 of 77% wholesale non-operational, 58% wholesale operational and 40% retail, measured on deposits with maturity of 7 days or less against a 525bp move in the target range, reported as the mean of a panel of roughly 80–100 bank self-reports and therefore not a market-wide measurement. The March round is cited deliberately: the September 2024 round carries 76% / 59% / 42%, expected rather than actual, and later rounds stopped publishing cumulative betas. The survey measures betas and pricing rationale only — it does not measure automated sweep-tool adoption, and no source attributes any part of the 77% to AI agents. Silicon Valley Bank: $42bn withdrawn on 9 March 2023 and more than 94% of the total deposit base uninsured at end-2022, per the Federal Reserve OIG Material Loss Review of SVB (2023-SR-B-013, September 2023); the separate Board review of April 2023 states "more than $40 billion", so the $42bn is attributed to the OIG report rather than to that document, and the uninsured share is a stock statistic about the whole base rather than a property of the withdrawn tranche. Bank for International Settlements working paper 1310: a simulation of agentic cash-liquidity management, cited as evidence of capability and not of retail deployment. India: the Account Aggregator framework — a consent-based financial-data-sharing rail, not a payment rail — crossed 100 million cumulative consents as at August 2024, about 3 years after its 2021 launch, per Sahamati, the RBI-recognised industry body; the level has since moved and the figure is historical. Regulatory references, Vietnam: Circular 50/2024/TT-NHNN of 31 October 2024, effective 1 January 2025 with staged commencement for individual clauses, as amended by Circular 77/2025/TT-NHNN of 31 December 2025 (effective 1 March 2026, one clause set reaching 1 October 2026) — the operative requirement is OTP combined with biometric matching against chip-based identity, VNeID or stored biometric data on transfers between accounts of different holders above VND 10m per transaction, or at or below 10m per transaction where the day's cumulative transfers exceed VND 20m; below that, OTP alone. Decision 2345/QĐ-NHNN of 18 December 2023 originated those requirements and Circular 50 absorbed them, but Decision 2345 was repealed in full by Decision 2872/QĐ-NHNN of 30 December 2024, effective 1 January 2025, and is not operative law. Circular 48/2024/TT-NHNN of 30 September 2024 (effective 20 November 2024) frames the maximum VND deposit rate and sets no numeric ceiling; the numbers sit in Decision 2411/QĐ-NHNN of 1 November 2024 — 0.5% p.a. demand and under 1 month, 4.75% p.a. for 1 to under 6 months, 5.25% p.a. for people's credit funds and microfinance institutions — and bind only those tenors, leaving 6 months and above market-determined and uncapped. Circular 64/2024/TT-NHNN of 31 December 2024, effective 1 March 2025, standardises open API implementation in banking; Article 7(3) permits the payment-initiation group of basic Open APIs to be implemented only for third parties that are banks or licensed payment intermediary service providers, and 1 March 2027 is the full-compliance deadline for banks whose connections serving individual customers pre-date 1 March 2025 — a grandfathering deadline, not a start date. Whether the circular obliges deployment or only standardises it is unresolved in this series' research record, and no claim of a deployment obligation is made here. Law 91/2025/QH15 (Personal Data Protection) is in force from 1 January 2026; Law 134/2025/QH15 (Artificial Intelligence) from 1 March 2026, with Article 35 allowing pre-existing systems in finance 18 months to comply, approximately 1 September 2027. Load-bearing hedges are set out in full under Risks and caveats above: the quadrant's ratings are analytic judgement, the sweep mechanism and the retail-preview reading are inferences rather than survey findings, both the pricing and biometric limbs of the gate are narrower than the short argument implies, a second-jurisdiction outflow comparison is withheld pending primary-source confirmation, and US Section 1033 rulemaking is unresolved. Vietnamese bank and market references use publicly disclosed data only; this is independent thought leadership, not affiliated with any current or past employer, and not a substitute for your own legal, compliance and treasury review.