Can Financial Institutions Trust AI Generated Code?
Artificial intelligence is reshaping how software is designed, developed and deployed. In finance, where code underpins payments, trading, fraud detection, liquidity management and other mission-critical operations, this shift raises a fundamental question: how do institutions verify that AI-generated or AI-modified code can be trusted?
Jamshir Qureshi, Vice President of DevSecOps Engineering at MUFG Bank Ltd., has spent more than two decades working across enterprise technology, cloud architecture, DevSecOps and cybersecurity. Much of his work sits inside large and highly regulated financial environments where software security and digital trust are essential.
He is also the architect of the Hybrid Chain of Trust, a framework designed to strengthen software supply chain security through cryptographic verification, AI-assisted analysis, provenance tracking and tamper-evident mechanisms. His research on the Hybrid Chain of Trust was published in the International Journal of Artificial Intelligence and Machine Learning in 2025.
As AI systems have evolved, Qureshi’s work has increasingly focused on the security and governance challenges created by increasingly autonomous software development. In 2026, he has also written on AI supply chain attacks, autonomous AI systems and the need for continuous verification, extending the conversation beyond traditional cybersecurity into deeper questions of accountability, provenance and trust in increasingly autonomous digital systems.
Against this backdrop, Olakunle Agboola, interviewer for The Circle Media Plus, spoke with Qureshi about the changing nature of trust in financial technology, the limitations of traditional security approaches, the Hybrid Chain of Trust, and what AI-driven development means for accountability in the financial sector.
The Interview
Olakunle Agboola: Why has trust and verification in financial code become such an important issue at this stage of digital transformation?
Jamshir Qureshi: We have crossed a threshold. Digital transformation in finance once meant digitising manual processes with slowly written and heavily reviewed code. It now means continuous and real-time adaptation of core systems, with code being generated or modified by AI at a speed no human review board can match.
We are asking AI to write payment routing logic, fraud detection rules and smart contract functions. The old assumption that a human expert carefully reasoned through every line is disappearing.
Trust is no longer about whether the system runs. It is about whether we can prove, both mathematically and forensically, that it does not contain hidden biases or catastrophic failure modes introduced in microseconds by a probabilistic model.
Trust has become the bottleneck rather than computational power.
Olakunle Agboola: What challenges do traditional software security and compliance approaches face in today’s AI-driven development environment?
Jamshir Qureshi: Traditional approaches rely on process. They use checklists, manual reviews and static analysis tools designed for human-written patterns. They face three major challenges with AI-generated code.
The first challenge is volume and speed. An AI system can generate a thousand variations of a function in seconds. Human review cannot scale in a linear way. This is a qualitative shift rather than a quantitative one.
The second challenge is semantic opacity. A human developer’s logic can be interrogated. An AI system’s reasoning is based on high-dimensional statistical correlation. Traditional compliance asks why a decision was made. That question becomes extremely difficult to answer.
The third challenge is cross-provenance risk. Modern systems mix human-written, AI-generated, and third-party library code. Traditional tooling does not trace provenance across these boundaries, which means we lose the chain of custody for the code’s intent and safety properties.
We are trying to secure a dynamically assembled artefact using static and linear methods.
Olakunle Agboola: Can you explain the thinking behind the Hybrid Chain of Trust and the problem it aims to solve?
Jamshir Qureshi: The core problem is that neither pure formal verification nor pure AI governance works on its own for real-world AI-generated financial code.
Formal methods cannot scale to the ambiguity of large language model outputs. AI oversight alone cannot produce the mathematical proof that regulators and risk managers may ultimately require.
The Hybrid Chain of Trust is a symbiotic architecture. AI generates code under strict, machine-readable formal specifications, but that code is not trusted at this stage.
It is immediately pushed through a verification pipeline that uses symbolic execution and semantic differential analysis. The pipeline compares what the code does with what the specification requires.
Cryptographic nonces are embedded at the specification and verification layers, creating an immutable provenance trail.
The Hybrid Chain of Trust creates a single and unbroken chain of custody from intent, including what the code must never do, through generation, to a formal proof or counterexample. The entire process is supported by cryptographically assured lineage.
The question shifts from whether we trust the AI to whether we can verify this artefact against this specification with tamper-proof evidence.
Olakunle Agboola: What evidence demonstrates the effectiveness of this approach?
Jamshir Qureshi: In the paper, I describe a controlled simulation using financial-grade logic. We took a liquidity pool smart Contract Method for an automated market maker. A state-of-the-art large language model was asked to generate an optimised version.
The AI system occasionally produced a subtle re-entrancy vulnerability in the token transfer ordering. This is a classic bug, now disguised by AI.
The Hybrid Chain of Trust pipeline caught every vulnerable instance. The symbolic executor, guided by a formal specification that barred specific state updates before external calls, flagged each violation. The semantic differential analysis identified the exact bytecode segment where the AI output diverged from the safety invariant.
More importantly, the cryptographic nonce chain allowed an auditor, completely disconnected from the generation event, to replay and verify the entire sequence.
No faith in the AI was required. Only verification of the chain.
Olakunle Agboola: As AI increasingly generates and modifies code, how should organisations rethink accountability and verification?
Jamshir Qureshi: Accountability must shift from process compliance to artefact verifiability.
A sign off sheet is a proxy for safety. It must be replaced by a deterministic and queryable proof object.
Accountability becomes a question of what formal property has been proven about this binary and whether the integrity and lineage of that proof can be verified now and in the future.
This requires a new role. A verification and provenance architect defines machine-checkable safety and fairness invariants before any AI system writes code.
Verification becomes a continuous and automated gate rather than a milestone.
Accountability also divides. The AI provider is responsible for the model’s ability to produce well-structured output. The deploying institution is responsible for the correctness of its specification and the rigour of its verification gate.
You are accountable for what you chose to verify rather than what you hoped the AI meant.
Olakunle Agboola: What risks do financial institutions face if they fail to establish stronger verification processes?
Jamshir Qureshi: They face a shift from operational risk to epistemic risk. These are risks that arise from not knowing what you do not know about your own systems.
The immediate threats are silent and correlated failure modes. A flaw in an AI-generated library used across many trading desks may not cause a loud crash. It may produce subtly incorrect risk calculations or small accounting errors across millions of transactions, appearing only as a sudden and unexplained solvency gap.
The second risk is regulatory liability. If an incident occurs and the response is that the AI wrote the module, without a cryptographically sound verification trail, regulators could regard the absence of such a trail as negligence.
The final risk is systemic. If multiple institutions unknowingly share the same unverified AI-generated pattern, a single latent bug could become a market-wide failure.
Olakunle Agboola: How do you see AI governance, cybersecurity and software verification evolving over the next few years?
Jamshir Qureshi: They will merge into a single, integrated discipline.
AI governance is currently about ethics boards and principles. Cybersecurity focuses on perimeter defence and threat hunting. Verification remains a niche activity. This separation is becoming impossible to maintain.
We will see continuous computational governance.
Risk committees will review dashboards of live cryptographic proofs showing that all AI-generated code running in the trading layer satisfies defined fairness and safety invariants.
Cybersecurity will shift from scanning for known vulnerabilities to detecting real-time deviations between a module’s verified behavioural specification and its runtime execution trace.
Verification becomes a real time sensor.
Cryptographic provenance is the bridge.
Olakunle Agboola: What advice would you give technology leaders who are trying to balance innovation with trust and security?
Jamshir Qureshi: Stop treating trust and speed as a trade-off. That framing creates fragile compromises.
Make verification a force multiplier for innovation.
Invest in building your organisation’s specification capability. Soon, the speed of AI adoption will be limited not by model capability but by how quickly you can write and test machine-readable specifications of what your code must not do.
Turn your best senior engineers into specification authors. Give them tools to encode their knowledge.
Demand cryptographic proof of lineage from your AI tooling and pipelines. Every artefact should carry a verifiable birth certificate linking it to its specification, its generator and its verification result.
Speed comes from knowing that any AI generated code passing your automated gate is safe to deploy immediately. That certainty enables defensible innovation.
Build the verification gate first, then allow the AI to operate at full speed.
Editor’s Note
The views and opinions expressed in this interview are those of Jamshir Qureshi and do not necessarily reflect the views of The Circle Media Plus.
