Maxcode and PAYSTRAX share an unfiltered account of three months integrating AI tools into a live fintech delivery team: the wins, the fatigue curve, and what it means to ship responsibly under regulatory scrutiny.
The bottom line: AI tools delivered real, measurable value, but not where most teams expect. The developers who thrived were the ones who learned when to hand the keyboard back.
The Context: Compliance First, Then Innovation
PAYSTRAX is an EU- and UK-authorised payment institution operating under PSD2 and FCA supervision. When its delivery partner Maxcode proposed integrating AI tooling into the team, the question was never which tool is most powerful, it was which tool fits inside a regulatory perimeter that does not move.
That constraint shaped every decision that followed, and ultimately made the experiment more rigorous, and more replicable, than a free-for-all adoption would have been.
An AI coding assistant became the sanctioned environment for anything touching client code or context. External chat assistants remained available for research and learning, under one non-negotiable rule: anonymise inputs, keep prompts generic, never paste anything that could identify a system, merchant, or flow.
That rule is unglamorous, and it is the single most important governance decision we made. — Maxcode team
What Actually Happened
Technical adoption was led by Cătălin Sârbu, Maxcode’s Tech Lead, who set the pace and, critically, decided where to pull back.
The most enthusiastic developers went all-in early: for weeks, most of their work happened through agent conversation, iteration, and review rather than direct coding. It felt productive. It looked productive.
Then the fatigue hit. Not from the tools failing, but from the shape of the work itself. Endless dialogue, constant guidance, reviewing code that was almost-but-not-quite right. Several developers independently chose to put their hands back on the keyboard.
Agent-led development has a fatigue curve. Teams that don’t acknowledge it will burn people out before they reach the productivity gains. This is the most underreported finding in AI-coding discourse today.
Where AI Earned Its Place
Once the pendulum settled, a clear, repeatable pattern emerged. AI delivers consistent value in:
- Research & onboarding: Developers understand unfamiliar subsystems in minutes instead of hours.
- Implementation trade-offs: Comparing approaches, surfacing edge cases before QA or production finds them.
- Planning & decomposition: Breaking stories into chunks with security and regulatory concerns surfaced upfront.
- Documentation: Produced as a matter of course, not as an afterthought.
- Unit test generation: High coverage achieved quickly, enabling a more test-first rhythm.
- Communication artefacts: Clearer user stories, sharper acceptance criteria, better bug reports, richer visual comparisons.
- Code-standard enforcement: Consistent style and convention feedback — developers report learning from it.
Where It Still Falls Short
In a regulated environment, failure modes matter as much as wins. The team documents them honestly:
- Library hallucinations: Confident, wrong answers about well-known SDKs like Auth0 and Terraform. Agents still prefer inventing an API to admitting ignorance.
- Shallow code reviews: AI reviews catch style issues reliably but miss functional and business-logic problems. Human reviewers stay in the loop, always.
- Supervision overhead: Markdown instruction files and careful scaffolding help, but they do not eliminate the need to babysit. Developers describe it as working with a very fast junior who needs constant direction.
- Trust ceiling: No one on the team is comfortable letting an agent build a feature end-to-end without thorough human review. Small and medium tasks, yes. Whole features, no.
Three Principles for Fintech AI Adoption
For any engineering leader navigating the same questions, the team distils three hard-won lessons:
- Start from the compliance posture, not the tool. An AI coding assistant was chosen because it fit PAYSTRAX’s non-negotiables on data residency and vendor risk — not because it topped a benchmark. Every subsequent decision flowed cleanly from that anchor.
- Anonymisation is a discipline, not a policy. Teams need explicit habits, concrete examples of safe prompts, and a culture where asking about safety is normal rather than pedantic.
- Time gained is reinvested, not pocketed. The recovered time goes into deeper quality checks, better reviews, richer domain understanding, and the thorough documentation a regulated client actually needs. That reinvestment is the value.
Security: The Non-Negotiable Layer
Maxcode operates under ISO/IEC 27001 across all teams by default. Introducing AI tooling forced the team to treat prompts and agent interactions as a new class of data-egress surface. The same controls applied to source code, credentials, and customer data now explicitly extend to anything a developer types into a model.
The uncomfortable truth: a certification does not make an organisation secure. Behaviour does. ISO 27001 provides a framework and an audit trail, but the actual security of this adoption rests on how developers behave at the keyboard every day.
The Verdict
The team likes these tools, sees real value in them, but does not yet trust them to build a feature from scratch. For research, planning, repetitive work, and content generation, they are excellent. For anything with meaningful business or regulatory weight, they are collaborators, not authors. — Cătălin Sârbu, Tech Lead, Maxcode
AI tooling will go deeper into development processes as it matures. But the human judgement, the part that reads a payments regulation, understands what a merchant actually needs, and takes responsibility when something breaks in production, is not going anywhere.
It is, in fact, what clients pay for.
