AI agents can already do much of the repetitive work in finance: matching bank lines, reading bills, drafting reminders and commentary, flagging unusual entries and answering questions from the ledgers. Approvals, releasing payments, posting to the books and judgement calls stay with accountable people. A safe setup gives an agent the limited access of a junior team member, takes every figure from the ledger, and routes every decision to a person.
What is an AI agent in finance?
An AI agent in finance is software that carries out a defined finance task with little prompting. It reads the data, applies checks, prepares an output such as a match, a draft or an alert, and hands it to a person or to the next step. It runs on a schedule or on request, inside permissions someone has set.
Most useful finance agents combine two kinds of software. Ordinary code does the arithmetic and the rules: summing a ledger, matching an amount, comparing a balance with last month. A language model handles what code handles poorly: reading a scanned bill, writing a paragraph of commentary, understanding a question typed in Arabic or English. Keeping the two apart matters. Language models write fluent text, but they are not a reliable source of figures, so figures should come from the ledger through code the model calls.
An agent is also different from a chat assistant that needs a prompt for every step, and from older automation that follows a fixed script and stops at the first exception. A good agent handles the routine cases, explains what it found and leaves the exceptions for a person.
What can AI agents do in finance today?
Today they are good at high-volume, rule-based work with a clear right answer, and at first drafts. The table lists common tasks and where the line between agent and person usually falls.
| Task | What the agent does | What a person does |
|---|---|---|
| Bank reconciliation | Matches bank lines to ledger entries and lists what does not match | Clears the exceptions and signs off the reconciliation |
| Bills and receipts | Reads supplier bills from PDFs and photos and proposes the fields | Confirms the fields, the match to the order and the posting |
| Collections | Lists overdue customers by amount and age, and drafts reminders | Decides who to chase, approves the message and handles disputes |
| Month-end commentary | Explains material movements line by line, down to suppliers, projects and customers | Edits the narrative and decides what goes to the board |
| Anomaly review | Flags possible duplicate payments, unusual amounts and late postings into reported periods | Investigates and decides whether anything is wrong |
| Cash monitoring | Warns when cash falls below a set floor or overdue bills exceed the cash on hand | Decides what to pay, delay or fund |
| Intercompany matching | Proposes which counterparties are other group companies and flags balances that do not agree | Confirms the links and resolves the differences |
| Questions on the numbers | Answers from the ledgers, with each figure linked to its source records | Judges what the answer means and what to do about it |
Each of these saves time because the agent does the gathering and the first pass. None of them removes the need for someone who understands the business to look at the result.
What still needs a person?
Anything that commits the company, needs judgement or carries legal accountability stays with a person. An agent can prepare all of it, but it should not complete it.
- Approvals. Payments, journals, budget changes, write-offs and access requests need someone with the authority to approve them under an approval matrix. An agent should never approve, and nobody should approve their own request.
- Releasing payments. A person uploads the payment file to the bank or releases it in the banking portal. A change to a supplier's bank details needs a second person to verify it before any payment uses it.
- Posting to the books. Journals an agent proposes go through review and approval before they reach the ledger.
- Judgement. Provisions, impairments, revenue on complex contracts, credit losses on a disputed customer and materiality are decisions for qualified people who can be asked to explain them.
- Signing off. The close, the financial statements and the tax returns are signed by people who are accountable for them. Filing and audit stay with the company and its advisers.
- Relationships. Talking to a bank about a covenant, to a customer about a dispute or to an auditor about a finding needs a person.
This is more than caution. Segregation of duties exists so that no single actor can both create and approve a transaction. An AI agent is an actor too, so it belongs on the preparing side of that line.
How do you stop an AI from making up numbers?
Do not let the language model produce figures. Make it call functions that read the ledger, and check that every number in its answer came from one of those calls.
A language model asked for a revenue figure will produce something plausible whether or not it has the data. The fix is in the design, not in a better prompt: the model chooses which calculation to run, ordinary code runs it on the ledger, and the answer is built from the results. Any number in the text that did not come from a calculation should be rejected before the answer is shown. When the data cannot support an answer, the right output is a plain statement that it cannot answer, not a guess.
Traceability is the other half. A reader should be able to open any figure and see the ledger lines, invoices or bank lines behind it. Treat an answer that cannot be traced as unverified, however confident it sounds.
What controls should surround an AI agent?
Treat an agent like a new team member with limited rights: give it only the access its task needs, make everything it does visible, and keep it on the preparing side of every approval.
- Scope its accessGive the agent only the companies and data its task needs, and make it act within the permissions of the person it works for. An agent answering a branch manager should see what that manager can see, nothing more.
- Keep credentials away from the modelPasswords, API keys and bank tokens stay in encrypted storage the model never reads. The model asks for a calculation; the system fetches the data.
- Read first, write through approvalStart agents read-only. Where an agent prepares something that changes the books or moves money, route it through the same approval path as a person's request.
- Log everythingRecord every agent run, what it read and what it produced, in an audit log nobody can edit.
- Know where the data goesAsk which outside AI service processes your data, in which region, and whether you can switch it off. Check any data location obligations that apply to your business with your adviser.
- Review its outputSample what the agent produced each month, track how often people overrule it, and adjust its thresholds.
How should a finance team start with AI agents?
Start with one high-volume task that has a clear right answer and a person already checking it, and run the agent beside that person for a full close before relying on it.
- Pick the task. Bank reconciliation, bill capture and collections lists are common first choices: frequent, rule-based and easy to check.
- Define the checkpoint. Write down what the agent prepares and what the person approves.
- Run in parallel. For one close, let the agent work alongside the existing process and compare the results.
- Count the exceptions. Note what the agent matched, what it missed and what it got wrong.
- Expand step by step. Add the next task once the first is trusted, and keep the approval rules unchanged.
The month-end close checklist is a good map of where agents fit in the close.
Questions people ask
Will AI agents replace accountants?
They replace much of the gathering, matching and first drafting that fills an accountant's week, not the accountant. Judgement, approvals, sign-off and the conversations with auditors, banks and customers stay with people, and someone has to review what the agents produce.
Can an AI agent approve a payment?
It should not. Approval needs a person with the authority under your approval matrix, and the person who raised a request should not approve it. An agent can check a payment request and route it; in Naarvin, a person releases every payment.
Is it safe to connect an AI agent to our ERP?
It can be, with the right design. Connection credentials should be encrypted and never reach the model, the agent should read through permission-checked functions rather than an open database connection, and anything it writes back should pass your approvals. Ask any vendor to show you each of these.
Can AI agents work in Arabic?
Current language models read and write Arabic, so an agent can answer questions, draft reminders and write commentary in Arabic or English. Have a native reader check formal letters during a trial. In Naarvin, the product, the Copilot, reports, reminders and notifications all work in Arabic and English.
What happens if the AI is switched off or unavailable?
Work that does not need a language model should carry on, because matching, checks and reports are ordinary calculations. In Naarvin, an organization can switch external AI processing off and the Copilot then answers from the ledger only. When the monthly AI allowance runs out, Naarvin keeps working without the AI writing until more is added.
How do we know what an agent did?
Every run should be recorded with what it read, what it found and what it produced, and every finding should link to the records behind it. In Naarvin, every action is written to an append-only audit log in which each entry carries the fingerprint of the one before it.