CBA's CAIO put A$200m on the table. Then the scam agents.

You've probably sat in a steering pack where the chief AI officer will talk about vision and will not put a dollar on the year just gone. If that is the case, you do not have a CAIO. You have a keynote. Ranil Boteju, Chief AI Officer at Commonwealth Bank of Australia, broke the rule in the useful direction. A$200 million of measured gross benefit in FY26. He expects that to double in FY27 and to exceed the bank's AI investment. One interview talked about scaling toward A$400 million. That is the double, not a second result. Print $200 million for the year just gone. Do not brief the board on a number the body of the piece has not booked.

What Boteju actually owns

His remit is not a slide titled "AI vision." Platform. Controls, evaluation, observability. Token cost. Enablement. An AI science lab. That is a CAIO job. If your CAIO only does keynotes, you do not have one.

Eighty per cent of CBA's 7,800 engineers are using a mix of bought and built coding agents. Three times more code changes in the past year. Fifteen thousand quality, resilience and security issues found. Those are delivery numbers. They are not a chatbot satisfaction score.

Four reasons he will fund the work: frauds and scams; personalisation; personal productivity; delivery speed. I would put that order on a steering pack and leave it there. Scams first. Customer polish later. Eighty million signals a day. Up to 40,000 intelligent alerts. A human in the loop. Agent-as-a-judge. He is cautious about putting agents on the customer. Good. Most banks skip that sentence.

The other story is the one a customer will feel

CBA's Behavioural Science Centre of Excellence found nearly nine in ten Australians think they can spot a deepfake. Forty-two per cent actually did. That gap is the product.

James Roberts, Executive General Manager for fraud and scams at CBA, said that by the time you are making the payment, the deception has already been successful. So they went after the conversation, not the last click. The Pollen Team swarm has had more than 350,000 conversations with scammers since last year. There is a Fraud Detection Agent sitting on around 3,000 fraud rules. Payment redirection scams were A$166.8 million in 2025. The pieces do not print a separate figure for how much of that the agents stopped.

If you run a bank in Australia or New Zealand, this is the stack: a CAIO who will put a dollar on FY26, engineers on agents with a quality count, and a fraud team that treats the con as a conversation. Skills work that starts on a hated workflow is the enablement half of Boteju's remit. Without it you get licences and a science lab that nobody from branch will call.

The Retail Banker International interview is the operator artefact. Platform, evaluation, token cost, enablement, lab. If your CAIO pack is still a maturity curve and a vendor map, you are behind a listed Australian bank that will print a gross-benefit number. The 80% of 7,800 is also a training number: most of the engineering bench is already in the tool. Your job is the 20% and the people who have to supervise the 80%.

Keep the two pieces stapled together. Boteju is delivery and dollars. Roberts is the customer-harm story. Payment redirection at A$166.8 million in 2025 is why scams sit first in the four "why AI" list. Personalisation can wait. If your programme inverted that order because the customer-experience team had a sprint slot, invert it back.

The deepfake miss rate is the tell for any "AI literacy for customers" fantasy. Nearly nine in ten thought they could see it. Forty-two per cent could. Do not brief a public campaign as if awareness were detection. Detection is a lab number. Awareness is a survey. Roberts is building for the moment after the con has already worked.

What this means for L&D

One gross-benefit number for the year just closed, not a 2028 fantasy. Name the four reasons for AI in public. Put a human in the loop on the customer-facing agents. Measure the deepfake miss rate, not the licence count. That is a programme a board can argue with.

Sources: Retail Banker International, 18 September 2026. MPA, 18 September 2026.