Cognition said on September 22 that it is bringing Devin to Latin America from São Paulo, launched at an event at the MASP in front of leaders from large enterprises and governments. It names three banks: Itaú, Nubank and Santander. And it gives numbers. According to Cognition, more than 75% of Itaú’s technology teams use Devin, and at Nubank a migration of a multi-million-line monolith went from years to weeks, at over 20x lower cost.

Those figures come from the company selling the product, so read them that way. Still, it’s the most concrete public account of how a coding agent gets into a regulated bank in the region.

A post circulating on LinkedIn says Nubank just signed with Cognition and that the team flew to Brazil to close the deal. I couldn’t find that in any primary source. What’s published is different: Nubank already appeared as a customer in a Devin case study, and what Cognition opened in September was a local office. The material worth reading is there.

What the Nubank case shows

Nubank had to split an ETL monolith of more than 6 million lines into submodules. Per the case study, that meant over 1,000 engineers moving about 100,000 implementations on an expected 18-month timeline. Watch that figure. It’s the estimate for that one migration, not how long a bank takes to adopt new software.

How they did it matters more, because it looks nothing like “installing a tool.”

They picked a repetitive job with many variants but no mystery. They gathered examples of migrations their engineers had already done by hand, used some to tune Devin and kept the rest as a test set (evals). According to the case, tuning doubled Devin’s task completion scores and cut the time per subtask from roughly 40 minutes to 10.

And a person stayed in the loop throughout. An engineer quoted in the case puts it this way: instead of finishing the whole task by hand, “they could just review Devin’s changes, make minor adjustments, then merge their PR.”

Where it runs is the security question

In a bank, the first question is where the agent runs and what it can see. How well it codes comes after. Cognition lists three options: shared SaaS in its cloud, dedicated single-tenant SaaS with private connectivity to the customer’s cloud, or Devin inside the customer’s own virtual private cloud (VPC), with data staying in the customer’s account. It states SOC 2 Type II and ISO 27001, audit logs, fine-grained access controls and no training on customer data.

What I don’t know, and isn’t published, is how long the security review took at Nubank or Itaú, or who signed it. Any account of that process that doesn’t come from them is guesswork.

Why people in the room matter

Cognition is hiring in Latin America “a team of deployed engineers to embed with customers.” It doesn’t say why. My reading, and it’s a reading: the steps above (choose the job, gather human examples, decide who approves, decide where it runs) need someone sitting with the team that knows the code. A demo can’t do that.

For Central American companies

You don’t need 140 million customers to use the sequence. A mid-size company with an aging system can follow it just as well.

1. Pick one repetitive, measurable job. Upgrading a language version, or fixing the vulnerabilities your scanner already reports.
2. Build the test from earlier human work before granting any access.
3. Decide who approves each change, and make it a named person.
4. Decide where the agent runs based on which code it touches. Ask about the option inside your own cloud.
5. Ask who at the vendor can sit with your team, and in which time zone.

The agent solves none of this. It’s groundwork, and it’s where we help. Our software audit looks at how code is reviewed, tested and deployed today, which is what an agent will inherit. I’ve written about why code review can’t keep running on 2020 processes. And if the doubt is which processes to automate first, AI Maestro ends in a Go or No-Go decision before you invest in anything.

If you have an old system and a list of repetitive chores nobody wants, start by writing the list with one hand-done example of each.

Review how your code gets reviewed before handing it to an agent