Copilot Cowork for Banks and Credit Unions

Microsoft made Copilot Cowork generally available on June 16, 2026. Copilot Cowork is a Microsoft 365 Copilot capability that takes a task you describe and runs it end to end across your apps, then returns a finished result.

This is different from the earlier Copilot experience. The older Copilot drafts or answers in the app you are in. Cowork builds a multi-step plan and runs it in the background, with checkpoints where you review the work.

Banks and credit unions should care, but with caution. Cowork can run repeatable back-office tasks, yet GLBA and BSA rules govern customer financial data and reporting. Controls and oversight must come first.

What Copilot Cowork Can Do in Banking

Copilot Cowork runs multi-step tasks across Microsoft 365 and returns a finished result. In a bank, that can mean drafting internal reports, organizing data in Excel, or preparing routine documents.

It is grounded by Work IQ, which uses context from Outlook, Teams, and Excel. It runs in the background with checkpoints for your review.

Cowork shows recommended actions and applies them only after you approve. That review step matters where customer data and compliance reporting are involved.

• Draft internal reports and routine documents
• Organize and summarize operational data
• Run tasks in the background with approval checkpoints

GLBA and BSA Cautions

GLBA requires you to protect nonpublic personal information, so any Cowork task that could touch customer data needs strong safeguards.

BSA and anti-money-laundering duties cannot be delegated to an AI tool. A person must review and own any output tied to suspicious-activity monitoring or reporting.

Restrict who can run sensitive tasks, and keep a clear record of what Cowork did and who approved it.

• Safeguard nonpublic personal information under GLBA
• Keep BSA and AML decisions with accountable staff
• Limit which users can run data-sensitive tasks
• Keep an approval and audit record for every task

Controls Microsoft Provides

Copilot Cowork runs within Microsoft 365's security and governance boundaries, so identity, permissions, and compliance policies apply by default.

Microsoft states that sensitivity labels are inherited and displayed end to end and that actions and outputs are auditable, which supports examinations and reviews.

Microsoft Purview is available to govern and audit Cowork, including audit logs. Confirm which protections are active in your tenant.

Licensing and Billing

Copilot Cowork requires a Microsoft 365 Copilot license per user and then bills the Cowork work by usage in Copilot Credits.

Cowork is off by default. An admin must enable it and can set spending limits and choose which models and plugins are allowed.

Microsoft sets credit rates and they can change, so confirm current pricing with Microsoft before you budget.

A Controlled Rollout

Start with internal tasks that do not touch customer data so you can see how Cowork plans and acts.

Have compliance and IT review approved use cases, access settings, and audit logging before sensitive work.

Train staff on what they may hand to Cowork and on the duty to review every output.

What you need to run Copilot Cowork for banks and credit unions

The first question most banks and credit unions teams ask is whether their current setup can handle Copilot Cowork. For the standard cloud version, the answer is usually yes: Copilot Cowork runs on the provider's servers, so the computers and internet connection you already have are enough to start — there is no server to buy and nothing to install across the firm.

What you do need is two things: access (a business plan or the API) and a tool to work in. Whoever wires Copilot Cowork into your workflows will move fastest inside an AI IDE — Cursor is the most popular and connects to Copilot Cowork directly — while the rest of the team uses Copilot Cowork's own apps day to day.

The exception is compliance. If customer financial data and banking regulations mean client data cannot leave your systems, the cloud version is off the table and you move to a private, on-prem setup: self-hosting an open-weights model on hardware you control. In practice that is a workstation with a strong GPU (an NVIDIA RTX 4090 build) or a large-memory Mac Studio for mid-size models, or RunPod to rent the same power by the hour. Our open-weights models for business guide walks through the full build.