Successfully Scaling Automation at KeyBank

About KeyBank, Mike, and Kristin

KeyBank is in the top 20 largest banks in the US and has 18,000 employees. They offer a plethora of products you would expect a full-service bank to have: consumer, commercial, trade floors, real estate capital, AAA rated junk bonds, etc.

Mike leads the Service Digitization group that oversees RPA, low-code solutions, IDP, and, as of this week, generative AI. He has a team of 40 who support business units across KeyBank.

Kristin works on Mike’s team. She automates business processes for many lines of businesses including wealth and fraud. Kristin went to school for business administration and started in back office operations at KeyBank. When Automation Anywhere came into the picture at KeyBank, she was interested in the work being done and trained in their first class of citizen developers. She’s grown her skills to where she is today without having any formal technical background.
 

Evolution of Automation & Service Digitization at KeyBank

2017/2018

• KeyBank launched their citizen developer program and trained 45 people that came from a myriad of business units. It was slow going to roll out new automations and they faced all the common battles.
• Put 23 automations into production and it was taking 6-9 months to develop one automation.
• They were starting to build an appetite for automation throughout the organization. The problem was, with citizen developers moving between departments, there was no sustainability and there was often abandonment.

2019

• Had to make the decision to go big or go home.
• They went big, offering people those 23 citizen developers who had put something into production the previous year to go full-time as developers. 13 people, including Kristin, said yes. They centralized development, took over whatever had been built, and kept running with it.
• Prioritized opportunities by hard saves. A hard save = someone had to leave the bank or a contract had to exit.
• Those hard saves resulted in the team seeing 30 high priority ideas per month roll in, creating a healthy pipeline.
• Put 68 automations into production.

2020

• Focused on outreach and establishing “the art of the possible” roadmaps.
• Put 133 processes into production.

Present-Day

• The automation program has 40 team members that handle RPA or low-code solutions.
• There are 316 processes in production across the business. That translates to about 900 VMs, of which 400 are production and the rest are DDR or test-type machines. It takes 1200 applications to run the bank and RPA touches 215 of those.
• Each developer is aligned with specific parts of the business. They found that when you know an area of the business well, you can automate faster. You know their terminology, systems, data, screens, etc. It takes only about 6 weeks to go from idea to development to production for an automation.

The Future

• Looking at automating controls of the bank, meaning risk controls required for validation and verification. These have a low rate of return, but people are prone to do things differently whereas automations do things the same way every time, which KeyBank loves (so do the auditors)!

Use Case: Secured Credit Card Product Eligibility & Compliance

Problem
The eligibility and compliance of secured cards is closely monitored due to the higher risk of the product. When their secured credit card product was onboarded, the compliance piece somehow fell out. Two people took on the task part-time to review 20,000 products for compliance. As the portfolio grew day by day to 40,000 products, they didn't have FTE capacity to add on to oversee that process, so they turned to an automated solution.

Solution
The team broke the complex process down into smaller pieces.

1. The automation retrieves the secured card data set from 40,000 products.
2. Compares the product rules to make sure that they're compliant.
3. Places holds on cards when they're not compliant.
4. If they're out of compliance for more than 30 days, the automation marks those for closure for the line of business.
5. At the end of the day, the automation sends out a detailed spreadsheet of what was reviewed, what it did and what it didn't do, as well as any business exceptions that need to be handled.

Summary & Metrics
The automation sped up the handling time and greatly reduced financial risk by taking action on the account the same day as needed for compliance. The automation analyzes 40,000 products daily, saves 5 FTEs, and takes 1-2 minutes per transaction and only 8 hours to run each day in its entirety.
 

PEER Q&A

Q: How many authentication IDs are you managing for the 215 systems?

• A: There were laws in both California and New York that said they were going to tax bots just like humans because you're going to replace them. So, ahead of that, our legal department determined we needed to treat these like digital workers. As a results, we onboard our managers that are getting a business process automated, they onboard a bot ID just like they would an employee, they create a position for it, and then fill it. That's what generates our, let's say, Windows ID, for lack of a better word here. And then access control and all those kind of things, they have to request access for their newly onboarded bot just like they would a human managing that password. My team—we store those passwords in CyberArk (a credential vault). We don't even know what the password is. The access provisioning team at KeyBank will copy and paste that password from Windows into that CyberArk and we never have to manage that password.

Q: Were people concerned they or someone would lose their jobs during ideation?

• A: Yes absolutely. A hard save for us is defined as someone has to leave the bank. Well, really that position has to be closed and that dollar amount removed from their budget. What we have found is that an employee may have been doing something, but our volume of employment and turnover really means that there's another spot for them. So we automated the lowest value activities in many of these circumstances. Then there was a higher value or maybe even attrition set in certain cases that people move to or migrated from different departments or out of KeyBank.

Q: How do you pull passwords from the Cyberark and update them later in the control room? From my knowledge, there is no API to update password in the A360 CR.

• A: There's a team outside of mine called Access Provisioning and they're the ones that create the ID, the password, and they plug them both into CyberArk. Then we have integrations that feed them over.

Q: How do you handle when a process is no longer needed, like when it does the automation on their end instead of using a 360?

• A: I like that question. Rarely do people talk about turning things off. We have turned off 118 automations since 2019. We recently installed some new software—and when I say new, I mean built in the last couple of years. It replaced a system that was 40 years old. So when you think of the integrations and the bots that we had in place, those bots were probably the only thing that could integrate that system with some of the more modern systems. When we upgraded, guess what? Modern systems talking to modern systems don't necessarily require bots. We invested in the direct API, so we got to turn those off. Now, on the flip side, that created a whole new set of problems and we generated a new set of automations to monitor those problems.

Q: How do you prioritize use cases and what benefits does it need to bring in order to keep it a priority?

• A: We go by hard save. From my enterprise budget, it's about who has the biggest hard save. Since we move at a pretty quick pace—think six weeks, and that's typically one person working on that automation for six weeks--that allows us pretty much every week for a team of 5-7 to come in every week, pick up a new automation, or even an old one that need some enhancements or updates. So we'll prioritize enhancements and updates, keeping the lights on, working on on a valuable automation, pretty much top hard saves. And then I have an exception category. We have 22 people that are dedicated to the controls of the bank. That's about 60% of the team automating the controls. In that area, there's around 3000 controls in the bank. Of that 3000, maybe RPA can automate 10%. That's a lot of automations to create. We're creating about 90 per year in that space, many of them are low-hanging fruit and some of them are pretty complex. So that's how prioritization works in my world.

Q: Who is managing and owns delivery of the bots? Is it separate production support team or does it lie on the business teams?

• A: For the delivery, everything is maintained within our team from obtaining the requirement, refining those inquiry requirements, doing the development, user acceptance, testing, implementation, and then prod validation and support. That all is under our development team,

Q: Same question for the infrastructure, who's managing that?

• A: We have a CoE under Mike as well. So everything is really contained and we manage the control and the scope of that. We have 4 people and a manager on that CoE that manage this application and others.

Q: What percentage of your team is allocated to the Technical Support break fix of the production? And, do you have devs on board 24/7?

• A: We have a target goal of 20% support. We make sure that when we put things into production, we've worked out as many bugs or as many exceptions on the front end so we don't deal with those constantly on the back end. If you put garbage in, you're going to get garbage out. As far as support, we do have a support model with a tiered structure. So let's say there's something in the control room, an issue of a bug or something that's stopped there. There is the platform team that would take those kind of those kind of calls. If there's a more broad system update, if it's not something that has a stripped SLA or client impact or risk impact, we'll leave it until the morning. Our philosophy is you, you write it, you support it. But we do have a 24/7 on-call rotation for each team.. We have our automations integrated with just a page. So we put Page in the subject line and through the integration with KeyBank, we get text on our phone. Then we know that someone needs to look at “What bot is it? Do I need to address this or wait until the morning?” We're also trying to look at some ways to automatically restart those spots and that's something we've been digging into for a while, just haven't been able to get that off the ground.

Q: Have you used Copilot for business in any of the use cases shared?

• A: No. I will tell you one thing about banks and Gen AI--we're very conservative right now. We're piloting, looking at things, but implementation and the regulations and things like that, we're going to make sure that we're ultra compliant and really understand the terminologies, the responses back, monitor those, and see how they change over time before we productionize anything.

Q: What is your deployment strategy, WLM/schedules/on-demand?

• A: All our bots are unattended bots on a schedule. We do have one workload management bot out there and we are looking to onboard another. But every other one is on schedule. We don't have attended bot use cases right now.

Q: Which organization does the CoE report to?

• A: We report to IT.

Q: When you're looking at savings tracking, the hard save would be a fully loaded cost of a role. What about partial roles that are automated and what type of soft saves are you providing?

• A: Reporting to our CIO to finance, we only track hard saves. We get zero credit otherwise. Literally a hard save for us means someone has to leave the bank. It's not a partial. You can't part leave the bank. And contracts, exiting a contract or procurement does that, so those are very easy ways to track. When someone says, “hey, I have this process that's going to save me 10 minutes per day every day,” it's like, “OK, fantastic,” but that's very low priority for us. We may never touch that. Revenue generation—if we have a bot that's generating revenue—that can be a grey area for us and we get a finance call on that. We'll ask finance directly: are you going to add to their plan because of this bot process? If the answer is yes then we'll add a revenue number, but I think we've had three of those out of 400

Q: So no benefits you can claim for hard-cost avoidance?

• A: Yeah, that's the same. Cost avoidance is hard save for us.