2026.09.25 | TB | Financials | European FS AI Demand: Mistral & HSBC

Client-led • 11 Sep 2026

Companies: HSBA GB, AMZN US

Expert Former Head at HSBC Holdings plc

Agenda

• Around 15 years' experience in financial services and management consulting, focusing on enterprise conversational AI deployment and digital transformation within global banking
• Well-placed to discuss Mistral AI's use cases and integration into HSBC's databases, as well as generative AI deployment strategies and compliance risks associated with data retention and sovereignty
• Knowledgeable on the commercial realities of banking technology budget and spend, with insight into the adoption of external LLMs (large language models) vs in-house builds
• In-depth understanding of how enterprise sales channels, hyperscaler ecosystems and executive relationships shape model selection across global banking organisations

Introduction

Client [00:02:13]: Have you been familiar with Mistral AI? Have you been exposed to it at all? Is it quite new to you?

Expert [00:02:24]: I know of Mistral, I know of their capabilities. Obviously, the approach in terms of building a frontier model here in Europe and the way they've open sourced and made open-weight so that other companies can use it. I'm not super, super close to it being super honest and candid with you.

Questions

[00:02:53] What are the current primary use cases for Mistral AI at HSBC?

Expert [00:03:09]: I think, like any other bank, HSBC had a number of priorities for how to work with gen AI systems. They started off going all very broad, with everyone having an idea and everyone trying to do something and using whatever technology was available. Then there's a big debate about what to buy vs build. Obviously, by working with someone like Mistral, particularly when you're making an investment there, it's more of a co-building motion together. Some of the work that was being done previously, before that relationship, was using OpenAI, ChatGPT through the Azure relationship to build out staff-facing capabilities as one of the priorities. Giving a productivity tool to all 200,000 employees to make everyone more productive day-to-day, whether that's writing e-mails, reviewing documents, all that stuff. Obviously, there's concerns around tokenomics and the pass-through cost you get from working with those vendors. Then there's also some of the challenges, question marks around data retention, using proprietary information from a big bank and allowing that to go out of the firewall and go and use that to train other companies' frontier models.

That buying was, I think, a short-term priority. Then it was more the ideal next step being to build internally, so you get both the data security and also the lower cost of ownership as well. I think that's where I would expect things like Mistral to be implemented at large banks. It's where you have some concerns around where the data goes, particularly with the whole US and what the Trump administration did with blocking access to Fable for periods. I think giving more sovereignty, giving more data residency, more data security, and also being able to manage the cost in a more predictable way. I think those would be why someone like Mistral would be used at an institution like HSBC.

[00:05:54] How deeply are LLMs [large language models] such as Mistral or ChatGPT integrated into HSBC’s databases? How much trust is there in relation to data retention and privacy?

Expert [00:06:16]: I think a big bank is conflicted because you get the most value by having the most data connected. Being able to actually allow the model to understand more about the customer and more about the processes and more about the systems, the more intelligent it essentially becomes. With all of that, you get the risk in that banks are risk-averse by definition. Being able to find that right balance is the most difficult thing. How do you use chatbots and voice bots to support customer interactions, automate them? Ultimately, you need fewer people sat in call centres and reducing some costs there. Some of the others were around more like know-your-customer documentation reviews. So, actually getting corporate banking customers to provide a load of documentation and then feeding that into the models to be able to identify if it was the right parties and any risks around the ownership and all those things.

Being able to start putting customer data in is definitely the things that they were starting to do, but it was some of the lower risk back-office processing, lower risk customer support interactions where the immediate risk appetite was allowing it. Even then, the governance, the compliance reviews, the data reviews, all that stuff is super strict and challenging to work through. What I would say is there's an executive desire to do these things as an executive prioritisation to do what we thought would be the, inverted commas, easiest things to do. It still wasn't easy, which is why I think the medium to longer-term plan of building these models, hosting these models on HSBC infrastructure is the big unlock to being able to do more risky things and what could be perceived as more risky activities, and do them more quickly and more safely.

[00:09:09] How does Mistral play into the compliance framework? Is HSBC just following the compliance guidelines required by law or sovereignty, with those factors at the forefront of mind regardless? How does that benefit Mistral as virtually the only European player offering up-to-speed LLM capabilities?

Expert [00:09:42]: There was what was called an AIRC, so the AI Review Committee that was established as the single body to oversee the governance of any AI use case. That had parties from every function, whether regulatory compliance, model risk, legal, all these functions were part of it. It had business representation from each of the business lines. It was really chaired by, I think, the legal team. To get to that forum, you have to go through all the individual approvals, the risk teams, the legal teams, the model risk, compliance, everyone to get there. It was a pretty hefty process and then different divisions, different markets, different countries sometimes have their own subcommittee to even pass it before you get there. That's just the nature of a big painful beast. I saw use cases take 6-12 months to get through that governance process from project initiation through to launch. A large part of that was the whole model risk framework where this model risk is established by banks to work out whether they were lending money fairly. They're actually going to give you a credit card limit that you can afford to pay back or lend you a business loan to have a business and they're giving you the right interest rate.

That's where model risk came from, not to manage the risk of a probabilistic LLM, which is much more difficult. I think one of the biggest challenges that I saw was when you go through that governance process with model risk, they want to be able to understand how the model is built, how the model is trained, make sure there's no bias in the model. They want to be able to make sure the model is not going to hallucinate. [Mistral] won't give you the whole secret sauce and you don't know how it was fully built, but you know how you will have the opportunity to post-train it on the weightings yourself.

From a risk perspective, it gives a lot more confidence that you don't know the whole recipe, but you know like 50% or a lot more about it, and you can much more vigorously test it and prove it one way or the other. I think that's where Mistral will have that benefit. I think the other piece is the residency as well. Obviously, with something like OpenAI or with Claude, it is hosted where OpenAI and Claude want to host it. For a European bank, I think Claude only does inference in the US at the moment. It has no inference set-up in the EU. OpenAI actually does. When it comes down to that sovereignty, if you want it to be in country, if you want it to be in region, you're going to have to accept to an extent that some of that data is going to be flowing to other regions outside of the EU area, whereas with Mistral, because it is open-weight, you can download it and host it in your data centre in London, in Luxembourg and wherever you want it to for whichever regulated institution. You have more flexibility to keep that data in region.

[00:14:06] Do you see data residency risks being mitigated over time? Hyperscalers such as AWS [Amazon Web Services] and Azure are starting to offer European-only sovereign clouds. Could these allow HSBC and other companies to host US and Chinese competitors?

Expert [00:14:48]: I think it will. I think, yes, having that idea of more sovereign data centres. I know some people at Nvidia, they talk about building these I think they call them AI factories rather than data centres in the Nvidia world. I think that direction of travel will allow that. I think when the control is still sat with a US HQ, there will always be that risk or that underlying fear that something will happen in the way that the leading Claude models, Fable and Mythos got blocked when Trump said, "No one who's not a US resident can use this model", and they just have to get turned off. If you've got critical business processes running on that, even if it's in the sovereign cloud, but does that sovereign cloud ultimately still have some governance or leadership decision-making that sits outside of the sovereign? It probably does.

I think it gives a competitive chance to those models, but I don't think it fully solves the sovereignty when there is still just US ownership, I think, and a volatile leadership in that country. I do think there are other models that they are starting to at least talk about being built as competitors to Mistral. I think there's one called Cosine in the UK that started to raise money and be announced. They'll all take time. This is a tough game to get into. It takes time to build the models and to build the right compute. Mistral does have a unique positioning, I think, at the moment, but it will erode over time potentially.

[00:16:48] Does more confidence regarding the risks of testing, training and adaptability mean that China's open-weight models may be considered? Are China's open-weight models automatically blocked?

Expert [00:17:15]: I think it depends. When it comes to HSBC, it is in that weird position where it straddles both west and east. The geopolitical tension that that causes if Hong Kong becomes more mainland Chinese at some point, should HSBC in Hong Kong be reliant on US firms? There's a question mark there. Therefore, China models would seem more appealing, I would say, potentially. However, for an HSBC, I think there is less risk about Chinese models, and I think there will be a growing adoption. This is just my speculation. It's not based on anything I know. When it comes to other more European banks, whether it's a Barclays or Lloyds, I think there will be some political concern about it, even though they are Chinese open-weight models that can be downloaded and hosted fully within your infrastructure. On paper, none of that should have any backdoor out into China because it's entirely hosted, not connected to the internet or connected to the Chinese producers.

I think there will always be some underlying concern, fear and risk with it somewhere within compliance teams that the Chinese technology companies are very, very advanced. Have they found some very clever way to hide a backdoor into these models even though they have open weights? Will risk teams be confident that that's not the case? I think for sovereign EU and UK organisations, they will do certain things with Chinese open-weight models because they are catching up very quickly. They are cheap to run, but will critical infrastructure run through them? I would be surprised if anyone would be confident enough to do that right now.

[00:19:39] What could implicitly compete with Mistral? Could HSBC move away from LLM providers and build completely from scratch in-house? Is that an expertise that HSBC has or would they rather outsource?

Expert [00:20:09]: Being honest, I think a lot of organisations like big banking organisations, not just HSBC, but people in their cohorts. The JPMs, the Citis, the biggest banks, the Deutsche Banks, whoever, across Europe, I wouldn't be surprised if they try because they think that they will have some competitive advantage to do it. A lot of these banks historically have built their own tech systems, their own IT infrastructure. They have large technology teams. They've been hiring data scientists. I think there will be both a pride element of, "We should build this thing. It is going to be the greatest thing for our bank. It's the way we stay competitive in the next 50 years is by managing our own AI and our models and everything." They will definitely try. I just don't think they, in reality, have the talent or the sufficient scale to really do it. The amount of money raised in the frontier labs is absurd. The amount of money they pay their best researchers is absurd. Banks obviously do pay their best traders a lot of money, but that doesn't even compare to how much you have to pay for the best researchers. They may take some open-weight models and train them and make them specific to their use cases.

No, I don't think so in reality. I think they will try and they will think, "Oh, yes, we don't need Mistral forever or we don't need OpenAI forever." I think ultimately most of those organisations will fail in that. Some of them might have some success with some use cases. They might say, "Actually, for something that is mission-critical to our organisation, we are going to do this in-house. We might partner with someone to do it where we just don't have the expertise." I know Citibank in the US publicly partnered with Google DeepMind on building some models, not just Google, but like the DeepMind deep AI research division to do that. I can see people doing that, but I think there will be so many AI and model use cases that just don't require the investment that would be needed for a proprietary in-house model. There's just too much commoditisation in the market, I think, of a lot of the use cases that banks need.

[00:22:44] What is the overall demand in banking for LLM providers such as Mistral in terms of spend and budgeting? Banks were initially reluctant to adopt these models due to their risk and compliance frameworks. However, adoption of external models has increased as in-house builds could not keep pace.

Expert [00:23:35]: Banks spend an incredible amount on technology every year. A lot of that is software engineers and software licences. Banks are very rigid in the way they manage finance typically. There's a budget for software, there's a budget for hardware, there's a budget for people, and they're not necessarily interchangeable in-year or even YoY without going through a big process. What AI quite clearly does is it would be substitutional for some of that labour spend and substitutional for some of that software spend. Most banks try and operate from a basis where they're reducing their OPEX year after year. They don't want to really significantly increase it. You might get some big CAPEX programmes. Typically, you see a lot of CAPEX investment in digital and systems upgrades and all those things. I think the demand is there to implement the technology. It's just how do they budget for it efficiently, effectively, and how quickly do they want to do that pivot. For example, one of the easiest use cases for AI and the one most commonly adopted across all industries and the lowest risk is software engineering, using coding assistants to supercharge the productivity of every single engineer.

A big bank will not be typically aggressive. They might just give everyone it. The software allows them to do a little bit with AI and then gradually reduce their headcount as they see some attrition or have programmes like that. The short answer to that is the spending will be there, but it can't be unconstrained as you would see in a Silicon Valley company or a software company where they are just going all in on AI and have venture capital backing.

It doesn't really matter how much money they burn on tokens so long as you see the growth of the company net-net. I think given most banks, or banks publicly traded, they've got shareholders, they've got investor commitments in terms of OPEX and spend. I think the demand for AI spend will be there, but they need to find a way to balance it out against all their other spending and how quickly can they cut those other spend lines to increase the AI spend. In the short term, AI spend will probably not be a massive line item in the overall scheme of a bank. It probably will take a good two to, I don't know, four years that it actually becomes more meaningful vs the other getting headcount out, getting people costs down, getting other software costs down.

[00:27:28] Are there concrete LLM use cases on the deal side? Are companies using Claude, Mistral and ChatGPT more for standard customer support and know-your-customer document reviews? What are the most complex use cases being deployed?

Expert [00:27:59]: I think HSBC is a pretty slow adopter, very risk-averse. Most of the use cases that were really being focused on were those low-risk things, so back-office functions and simple customer support for retail customers. There's a mass productivity. From what I've seen in big banks, it's still pretty much slow adoption. I think there's lots of aspiration to give tools to make advisors more efficient, getting them to do deal reviews, giving traders tools to synthesise information better about what's happening in the market to make decisions. A lot of it is just almost like consuming knowledge, using a model to consume some knowledge and reformat it or summarise it in a more user-friendly manner to make that human more productive, more intelligent. Yes, nothing really groundbreaking, I would say.

[00:29:25] Is there a trade-off in mindset between needing the most capable, up-to-date frontier models and prioritising risk and compliance aspects? Has demand for capability plateaued for broad use cases, meaning companies don’t necessarily require the best provider and model?

Expert [00:30:01]: I think the model quality or the model capability is something that is not really a constraint. Because of the risk appetite constraints, the ambition of the use case, I don't think you need the most leading model capability to do the use cases that are required. I think that's where a lot of the big banks are at the moment. They're not pushing the boundaries in terms of the use case, so they don't need the latest, greatest technology.

[00:31:32] What is the enterprise demand and channel for introducing new AI players? Is there an aspect of exposure to and gaining familiarity with free models before advocating for it to be brought in-house? Is there an executive enterprise sales channel through which providers sell their product?

Expert [00:32:14]: I think there's a couple of motions. ChatGPT came out nearly four years ago now. I think everyone is familiar to some degree with ChatGPT or Google, even just as a result of Google AI summaries when you're searching for something. Everyone knows about them. Everyone hears stuff in the press. It's all very, very loud. I think the way enterprises are really selecting the models is probably two-factor. There are partly executive relationships and introductions and sales processes and things like that. From what I've seen in the market, there are definitely executive relationships that are playing a big part in introducing. Then I think most organisations are taking a multi-model approach where they're testing everything. Some of it is dependent on hosting and hyperscalers and those things. For example, again, a lot of banks are multi-cloud. If you're using Google Cloud, your Google sales reps will be saying, "Hey, use Gemini, it's available out of the box," as part of your Google relationship. You have your Azure team telling you that, "Hey, you can access OpenAI through Azure." There's an element of what tech ecosystem are you in, what executive and very high-level relationships do you have with the organisations.

Then I think it comes down to some of those risk questions. Some of them come down to architecture. Some of it comes down to just personal preference. I think the organisations that will struggle the most in a big enterprise will be someone that doesn't have the big hyperscaler relationship. If you're not within the Google ecosystem, the Microsoft ecosystem, the Amazon ecosystem, it's quite difficult to then break in. Then a lot of the model providers have to be available through those systems. For example, I think you can get Mistral through the Amazon marketplace. There's a Canadian model company called Cohere that I think is also through the Amazon marketplace. They're not the first-party model as part of those ecosystems or those platforms that you're buying. You really have to be able to force your way in there. Otherwise, the default will be, "I know ChatGPT because I use it in my personal life. I know Gemini, I use it in my personal life. Claude is always in the news, so I want to use Anthropic." I think it's a very noisy space. I think relationships play a key part and the tech ecosystem plays a key part.

[00:35:40] How sticky is the contract and relationship between, for example, HSBC and Mistral? Do data residency and custom builds make it hard to switch?

Expert [00:36:13]: No. I think where it's really positioned as a partnership and I think also, to be frank, when it's publicly announced as a partnership, there's always a bit of added stickiness just because, "Oh, you've talked about it publicly, so we don't really want to backtrack on it." There's a bit of exec embarrassment if you then switch provider again six months later. All those things help. Obviously, doing the security stuff, the architectural integrations, all of that makes it more sticky. On the flip side, a lot of these things are not commits. A lot of these contracts are like memorandums of understanding. There's not a commitment to spend USD 10m per year on tokens with this vendor. It's often the big banks have the ability to push for more pay-as-you-go models and things like that. Banks don't chuck out software providers every six months in the way that a retailer might or a hospitality chain. They have a much simpler ecosystem to integrate with, so they're much happier to throw someone out.

Once you've got deeply embedded in a bank, then you often don't leave for many years. I think it does improve the stickiness, but there will also be every other big provider in there at the same time to some degree just through the existing tech ecosystem. You might dial one down and dial one up at various points. It can depend on even the execs. Someone moves on, they held that relationship. A new person comes in who really loved Google wherever they used to work, and they really pushed down the Google side. There's a people business as much as anything.

[00:38:37] Will Mistral win over the European banks or the European market in general? Is its sovereignty and open-weight model value proposition strong enough to compete against pure capability?

Expert [00:39:04]: I think if the US continues to behave like it does in terms of the Trump administration, I think Mistral has a huge advantage for the next couple of years. The French market, I would assume, is sewn up. The French are very good at buying French. I think they have a big advantage there. Germany, in particular, also, I think, quite like the European side of things. We in Britain are much less good at supporting local business. I think Mistral will be potentially less successful in the UK than it otherwise would be. Anyone who really cares about the sovereignty angle, and I think everyone increasingly does. The FCA released a report within the last couple of months as well, highlighting the risks of dependency on US cloud providers, US AI providers. I think sovereignty is an increasingly important aspect for UK financial services. Until anyone else builds something, and I mentioned the UK one that has been announced but I think it's still some way off, Mistral definitely has a good couple of years' advantage, I would say.

[00:40:35] Does Mistral’s couple of years’ sovereignty advantage create stickiness? Does competing on a company-wide perspective still apply given that few players are signing with just one provider?

Expert [00:40:57]: Yes, completely. I think the thing they have to do, though, I would say, is continue innovating because I think they have been behind the frontier labs. I think, actually, the whole sovereignty thing has really boosted them, and they obviously raised money this week. I think it was announced at a huge valuation as well, the biggest raise in European ventures. They need to compound that advantage and get that technical capability to be close to the frontier models, close to or as good as the Chinese ones. I think they're partnering on the Chinese labs as well. I saw one of the open-weight ones as well. I think they need to focus on the innovation side, not just be thinking there's a structural advantage because of sovereignty.