Adopting Model Context Protocol (MCP) in Financial Services for AI System Integration

evergreen_wealth_/bloomberg/_saxo_bank · Finance · 2026 · source Agentic: yes · promotional bias: low · source-backed · extracted with prompt 0.5.2 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Financial services integration

Financial services teams needed a way for regulated agentic systems to connect to internal data and tools while respecting security and compliance boundaries.

Constraints:

High security requirements
Backend entitlement and authorization
Young MCP ecosystem

Architecture

The roundtable describes MCP as a regulated integration layer between financial-services AI systems and backend tools, data, and accounts. Bloomberg uses MCP as a plug-and-play layer for internal agentic systems, developer productivity, and cautiously emerging client exposure; Evergreen runs an MCP gateway for its AI advice engine, connecting knowledge bases, real-time data, personalized financial information, and linked external accounts; Saxo frames MCP services as secure API-like infrastructure. Across all three, the architecture depends on identity propagation, entitlements, zero-trust treatment of LLM output, structured outputs, version control, observability, and eventually stateless scale-out.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  agentic-ai-systems[Agentic AI systems] --> mcp-servers[MCP servers]
  agentic-ai-systems --> mcp-gateway[MCP gateway]
  mcp-gateway --> knowledge-base[Knowledge base]
  mcp-gateway --> real-time-data-sources[Real-time data sources]
  mcp-gateway --> client-financial-profile[Client financial profile]
  mcp-gateway --> external-linked-accounts[External linked accounts]
  mcp-servers --> backend-services-and-data[Backend services and data]
  backend-services-and-data --> entitlement-service[Entitlement service]
  mcp-servers --> structured-outputs[Structured outputs]
  structured-outputs --> evaluation-systems[Evaluation systems]
  evaluation-systems --> version-management[Version management]
  mcp-servers --> observability-layer[Observability layer]
  observability-layer --> evaluation-systems

Drag to pan · scroll or use +/− to zoom · reconstructed from the source's described component topology

Components

Component	Role	Interacts with
`Agentic AI systems`	Internal and customer-facing AI systems that need controlled access to financial data and tools.	`MCP servers`, `MCP gateway`
`MCP servers`	Protocol servers exposing tools and backend capabilities to agents.	`Agentic AI systems`, `Backend services and data`
`MCP gateway`	Evergreen's internal gateway joining knowledge, real-time, personalized, and linked-account data.	`Agentic AI systems`, `Knowledge base`, `Real-time data sources`, `Client financial profile`, `External linked accounts`
`Knowledge base`	Advice-engine content source used with client-specific financial data.	`MCP gateway`
`Real-time data sources`	Market or operational data available to the AI advice engine.	`MCP gateway`
`Client financial profile`	Continuously updated personalized financial information.	`MCP gateway`
`External linked accounts`	Client-linked external account data for comprehensive financial advice.	`MCP gateway`
`Backend services and data`	Financial institution services and internal data exposed through MCP tools.	`MCP servers`, `Entitlement service`
`Entitlement service`	Carries user identity and access rights across the agent/MCP call chain.	`MCP servers`, `Backend services and data`
`Structured outputs`	Typed MCP server responses used to verify shape and support protocol migration.	`MCP servers`, `Evaluation systems`
`Evaluation systems`	Tests that production agents conform to expected tool and output contracts.	`Structured outputs`, `Version management`
`Version management`	Controls tool descriptions, outputs, and rollouts in production finance environments.	`Evaluation systems`, `MCP servers`
`Observability layer`	Quantitative measurement of how metadata/tool-description changes affect agent performance.	`MCP servers`, `Evaluation systems`

Data flow

An agent or AI advice engine requests data through MCP tools or an MCP gateway. The request carries user identity and entitlements to backend services; MCP servers return structured or tool outputs; the LLM combines knowledge-base, real-time, and client-specific information; security controls treat model output as untrusted; and regulated teams verify outputs, citations, versions, and tool contracts before broader rollout.

3 supporting quotes

“MCP and primarily tools within MCP have enabled our agentic systems to connect to the vast array of services and data we have available internally.”transcript, stated

“we've built our own um uh MCP um gateway uh that we use to connect to um you know a variety of uh these different uh data sources”transcript, stated

“entitlements they have to be carried throughout the call along with the user identity not just the agent that's talking”transcript, stated

Why this architecture

Financial-services teams chose MCP because it standardizes how agents connect to existing systems, but they kept it mostly internal and wrapped it in familiar security practices. The key design pressure is not tool invocation itself; it is preserving entitlements, contractual attribution, versioned outputs, and evaluation in an industry where agent nondeterminism can expose regulated data incorrectly.

“Um it's a and I I think the the the perspective that I usually try to to convey is that MCP is a protocol. we still need to build services and infrastructure that is secure that is compliant”transcript, stated

“we're using um MCP as internal tooling only right we're not exposing u this functionality um the MCP directly um to our end users”transcript, stated

Scale

MCP was only about 10 months old, yet all speakers were already adopting it in production or production-adjacent systems.
“We're 10 months in. This is not a technology that's been around, but I know in setting this up, all of you inside of your organizations are already adopting it and you're using it today.”transcript, implied
Bloomberg described three adoption areas: internal AI systems, developer productivity, and early client-facing server exposure.
“Uh but primarily inside the organization we have seen adoption in uh three areas. Um the first one which is probably the most mature is using MCP as like a plug-and-play layer to build our own AI systems.”transcript, stated

Alternatives considered (roads not taken)

Expose MCP directly to end users first

Rejected because: Internal deployment let teams rely on existing API security and least-privilege controls while external exposure remained less mature.

“sometimes MCP is the internal layer sometimes it could be the external layer and it probably changes a little bit your security posture”transcript, implied

Natural-language-only tool responses

Rejected because: Bloomberg favored structured outputs because financial production agents need verifiable shapes and migration stability.

“>> Yeah, I think um at least in the last version of the spec, one of the things we were really excited about was uh structured outputs. um mostly because it it makes it easy for us to verify what's coming out of MCP servers and like if we want a certain shape and form to the outputs uh that's great.”transcript, stated

Dynamic unversioned tool contracts

Rejected because: Production finance agents need vetted, approved tool and output changes rather than remote servers changing behavior on the fly.

“when you're shipping production agents that need to do exactly a set of things and you need to have very good evaluation systems”transcript, implied

Sticky stateful MCP scaling

Rejected because: Saxo wanted stateless scale-out so any client can connect to any MCP server without stickiness.

“you don't just want one physical MTP server you need to be able to scale to a lot and then you don't want to have a lot of state”transcript, stated

Patterns

`tool-use-orchestration` (integration)

MCP tools connect agentic systems to financial-service backend capabilities.

“tools within MCP have enabled our agentic systems to connect”transcript, stated

`safety-policy-enforcement` (governance)

The use cases are constrained by financial-services security expectations.

“areas that are regulated, areas that have high security requirements. So we're going to kick off this section”transcript, stated

Tradeoffs

Adopt MCP internally before broadly exposing it to clients.

Chose Internal tooling and backend integration first over External client-facing MCP access as the initial deployment mode.

Rationale: Internal use let the organizations reuse familiar API-security processes while the external security posture remained less mature.

“using um MCP as internal tooling only right we're not exposing u this functionality um the MCP directly um to our end users um and so um you know we from that perspective”transcript, stated

Constrain MCP outputs where verification mattered.

Chose Structured outputs for server responses over Maximum natural-language flexibility for the LLM to interpret.

Rationale: The Bloomberg speaker valued structured responses because they were easier to verify and eased migration from the prior protocol.

“I know typically with with tools and MCP servers you want as much flexibility as possible so the LLM can interpret the response in natural language but having structured output”transcript, stated

Where to deploy MCP first in financial services.

Chose internal protocol and gateway layers over broad direct end-user MCP exposure.

Rationale: Internal deployment let teams keep LLMs behind existing zero-trust and least-privilege controls while the external posture matured.

“we've got a zerorust uh leaseprivileged architecture.”transcript, stated

How to make MCP outputs auditable.

Chose structured outputs and version-managed contracts over maximum dynamic tool-response flexibility.

Rationale: Structured and pinned contracts make output verification and approval possible for production financial agents.

“when you're shipping these systems in in the financial industry, you want more control over the output and like any change has to be vetted”transcript, stated

Gotchas (what bit them)

MCP tool access in finance must preserve user identity and entitlements across the whole agent call chain.

Root cause: An agent may reach data the current user is not entitled to unless authorization travels with the request and derived answer.

Resolution: The teams treated MCP as a secure service layer with entitlement propagation, attribution guarantees, and existing security controls.

“there are some interesting challenges uh in the just authentication authorization space in in terms of how you carry forward that identity, how you make sure entitlements are retained throughout the life cycle”transcript, stated

Evaluation

The transcript is a practitioner discussion and does not provide a formal metric framework.

Outcomes

The organizations reported production MCP adoption for internal and customer-facing AI systems.

The summary says all three organizations had already deployed production MCP systems.

“ements. Despite MCP being only 10 months old at the time of discussion, all three organizations have already deployed production systems leveraging the protocol, with use cases ranging from personalized financial advice engines to internal productivity tools, while working through challenges around”summary, stated