Agentic AI controls for financial institutions
Agentic AI needs controls that work outside the model: a defined mandate per agent, an allow-list of tools, transaction limits enforced by the system rather than the prompt, human approval for irreversible or customer-impacting actions, its own least-privilege identity, a tested kill switch, full action logs and manual fallback procedures. Rate agentic use cases high materiality until evidence supports less.
An AI agent plans and executes multi-step tasks: it reads, decides and acts. That turns model error into operational loss, because the wrong action can be executed before anyone sees it.
Why is agentic AI riskier than other AI?
A chatbot that is wrong produces a wrong answer that someone may catch. An agent that is wrong may pay, change a record or email a customer. Errors also cascade: one agent's output becomes another's input. SR 26-2 excludes agentic AI from model risk scope, so the controls have to come from operational risk, information security and the AI policy.
What controls should every AI agent have?
| Control | What it does | Evidence to keep |
|---|---|---|
| Mandate and tool allow-list | Limits what the agent may do and which systems it may call | Approved mandate in the AI inventory; tool configuration |
| System-enforced limits | Caps values, volumes and counterparties in the platform, not in the prompt | Limit settings and change log |
| Human approval gates | Requires a person to approve irreversible, high-value or customer-impacting actions | Approval records with approver identity |
| Own least-privilege identity | Agent runs under a service account, never a staff login | Access reviews for agent identities |
| Kill switch | Business owner or operations can stop the agent immediately | Kill-switch test results |
| Full action logging | Records inputs, tool calls, outputs and outcomes | Retained, reviewable logs |
| Manual fallback | Process continues when the agent is switched off | Tested fallback procedure |
| Hand-off validation | Checks format, limits and reasonableness between agents and systems | Validation rules and exception reports |
How should a bank pilot an AI agent safely?
- Start with internal, reversible tasks such as reconciliation preparation or document triage.
- Run the agent in recommend-only mode first and compare its proposals with human decisions.
- Move to execute-with-approval, then to limited autonomy for low-value actions only when error rates are evidenced.
- Include agent failure scenarios in operational resilience testing.
Who is accountable when an agent gets it wrong?
The named business owner of the use case, not the vendor or the developer. The FSB and MAS both expect clear roles and human oversight proportionate to risk. Write the owner into the inventory and into the owner's role profile.
Primary sources (reviewed 17 Oct 2026)
- Financial Stability Board: Sound Practices for Responsible Adoption of Artificial Intelligence, final report (15 October 2026)
- Monetary Authority of Singapore: Guidelines on Artificial Intelligence Risk Management (7 October 2026)
- Federal Reserve, OCC and FDIC: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026)
- NIST: Artificial Intelligence Risk Management Framework (AI RMF 1.0, January 2023)
This page explains supervisory guidance in plain language. It is not legal advice; confirm how each text applies to your institution and jurisdiction.
Frequently asked questions
What is a kill switch for AI?
A tested mechanism that lets authorised staff stop an AI agent or model immediately, with a manual procedure that keeps the business process running while it is off.
Should AI agents ever act without human approval?
Only for low-value, reversible actions within system-enforced limits, after testing shows acceptable error rates. Irreversible and customer-impacting actions should keep a human approval step.
Put these controls to work this month
Start on the cloud risk management software within 24 hours, or ask for training or advice tailored to your institution.