How serious is it that I used my personal laptop to access a bank client’s remote environment?

The fact that the remote environment blocked copying, downloads, and transfers helps show that you may not have exfiltrated data, but it doesn’t eliminate the device-security concern. A personal laptop may not meet requirements for management, encryption, antivirus, patching, or incident response. Explain exactly what you did and did not access, and don’t make claims beyond what you can verify.

The outcome depends heavily on the company and client policies, your location, and what the security logs show. If the policy clearly prohibited personal devices, you may face disciplinary action. If access was technically allowed and there were no controls preventing it, that may be relevant context, but it doesn’t automatically excuse bypassing the approved process.

It’s also possible the organization’s access controls failed to enforce its own policy. A properly configured conditional-access setup can often restrict access to managed or compliant devices. That could be considered during the review, but the existence of a technical loophole doesn’t guarantee there will be no consequences. Start preparing for the possibility of disciplinary action while waiting for the investigation.

Because the client is a bank, they’ll probably treat unauthorized device use seriously, regardless of whether you actually downloaded anything. Corporate-device requirements usually exist for endpoint security, monitoring, patching, and compliance. Be honest, review the applicable policies, and cooperate with the investigation rather than speculating or trying to hide details.