Banking AI Visibility Scorecard: 57 Fortune Global 500 Banks Ranked
Published 2026-04-20 · PROGEOLAB Research
The Banking AI Readiness Score ranks the 57 commercial and savings banks in the Fortune Global 500 on five dimensions: ChatGPT-User accessibility, llms.txt implementation, robots.txt AI policy, JSON-LD structured data, and security.txt publication. The sector spans 16 countries, 5 continents, and regulatory regimes from GDPR through GLBA to PIPL.
The sector's headline finding is the opposite of what most observers predict. Banks invest more in cybersecurity per dollar of revenue than almost any other industry; heavy regulation and sensitive customer data would suggest aggressive AI crawler blocking. Yet banking shows one of the lowest AI-specific blocking rates of any Fortune 500 sector: only 3 of 57 banks fall in the GEO Visibility Gap (Chrome-accessible, ChatGPT-blocked) — a 5.3% rate versus the Fortune 500 average of 10.6%.
Those three banks: Goldman Sachs Group, UniCredit Group, and Bank of Montreal.
The Goldman Sachs contradiction
Goldman Sachs's robots.txt explicitly allows GPTBot and ChatGPT-User — the firm has made a deliberate content policy decision to welcome AI crawlers. Yet probe data shows 0 of 64 successful ChatGPT-User probes. The block is at the WAF layer, not at the content-policy layer. Goldman runs F5 BIG-IP; the WAF rule set includes AI-crawler signatures that override the robots.txt Allow directives silently.
This is the canonical example of the robots.txt-vs-WAF inconsistency documented across the robots.txt research. Two teams — marketing/SEO (owning robots.txt) and security operations (owning WAF rules) — reach opposing decisions, and nobody reconciles. A journalist reading Goldman's robots.txt would report them as AI-friendly. An AI crawler testing reality would report them as blocked.
National Australia Bank: #1 in banking, #7 overall
NAB has the highest Banking AI Readiness Score of any Fortune 500 bank (8/11) and ranks #7 on the overall PROGEOLAB AI-Readiness Index — the highest-ranked financial services company in any sector.
NAB's llms.txt contains 61 curated links organized across personal banking, business banking, corporate banking, and institutional services. No other Fortune 500 bank approaches this coverage. Commonwealth Bank of Australia (Australia #2) has 16 llms.txt links in a home-loan-focused file. UniCredit has a metadata-only placeholder. The remaining 54 banks have nothing.
NAB's combination — full Chrome accessibility (10/10 endpoints), full ChatGPT-User accessibility (10/10), a real llms.txt, JSON-LD on the homepage, and F5 BIG-IP configured to permit AI crawlers — is the template for what a bank that has decided to be visible to AI looks like.
The banking scorecard: top 15
| Rank | Bank | Country | Score | Key signals |
|---|---|---|---|---|
| 1 | National Australia Bank | Australia | 8 | llms.txt (61 links), JSON-LD, F5 BIG-IP |
| 2 | Bank of New York Mellon | U.S. | 7 | JSON-LD, Akamai WAF permissive |
| 3 | Capital One Financial | U.S. | 7 | JSON-LD, 11/11 ChatGPT accessibility |
| 4 | Commonwealth Bank of Australia | Australia | 6.3 | llms.txt (16 links), Cloudflare WAF |
| 5 | Barclays | Britain | 6 | JSON-LD, partial ChatGPT (1/10) |
| 6 | Groupe BPCE | France | 6 | JSON-LD, F5 BIG-IP |
| 7 | HSBC Holdings | Britain | 6 | JSON-LD, full ChatGPT accessibility |
| 8 | BBVA | Spain | 5 | JSON-LD |
| 9 | Bank of America | U.S. | 5 | JSON-LD, F5 BIG-IP |
| 10 | Citigroup | U.S. | 5 | JSON-LD, Akamai WAF |
| 11 | Crédit Agricole | France | 5 | JSON-LD, 63/63 ChatGPT accessibility |
| 12 | Deutsche Bank | Germany | 5 | 62/62 ChatGPT accessibility, F5 BIG-IP |
| 13 | Morgan Stanley | U.S. | 5 | JSON-LD, partial ChatGPT (2/11), Cloudflare |
| 14 | Wells Fargo | U.S. | 5 | JSON-LD, F5 BIG-IP permissive |
| 15 | ANZ Group Holdings | Australia | 4 | Imperva WAF permissive |
The Australian concentration at the top (NAB, CommBank, ANZ — three of Australia's Big Four banks) suggests regulatory environment plays a smaller role than sector culture. Australian banking has historically led on digital customer service, and AI visibility appears to be a downstream consequence of that investment. The US banks cluster in the 5-7 range with JSON-LD but no llms.txt; European banks lean similarly.
Chinese banks and the Great Firewall
Nine of the 57 banks are Chinese — ICBC, CCB, Agricultural Bank of China, Bank of China, China Merchants, Ping An, Postal Savings, China Construction, and China Minsheng. All nine show partial-or-zero reachability from the European datacenter used for the audit, but not because of AI-specific blocking. The pattern is geographic infrastructure: Chinese corporate websites are optimized for domestic traffic and apply aggressive blocking to non-Chinese IP ranges.
Bank of China is the outlier — 64/64 accessibility across all four user agents. The rest show patterns ranging from partial accessibility (China Merchants, 3/3) to complete unreachability (ICBC).
What's in the full report
- Complete 57-bank scorecard with all five dimensions per bank
- Goldman Sachs case study: robots.txt vs WAF contradiction, line by line
- NAB case study: the 61-link llms.txt structure and how to replicate it
- llms.txt templates for retail banking, commercial banking, and wealth management
- WAF recommendations for banks: what to keep, what to open up for AI
- Adverse-event implications: how AI-blocked banks lose customer-service narrative control