Banking regulators in Europe, Britain and the United States are increasing their scrutiny of artificial intelligence systems as financial institutions experiment with software capable of taking more autonomous decisions and carrying out complex tasks.
Regulators are questioning banks about the controls surrounding agentic AI, their use of externally developed technology and their ability to recover critical operations after a system failure or cyberattack, according to reporting by Reuters published on 13 October. The discussions are part of supervisory scrutiny, not evidence that a single new international rule has been adopted.
The difficulty arises when software can take a succession of actions faster than staff can assess each decision. Conventional software generally operates within predefined sequences and access permissions. AI agents may carry out connected tasks, use several tools and act on instructions that do not anticipate every possible outcome. For banks, an unexpected action could affect sensitive information, customer services or operational processes that must remain available.
Financial institutions are already heavily regulated in areas such as operational resilience, outsourced services, data protection and cyber risk. The spread of AI changes the technology used within those existing responsibilities. Responsibility for a critical process does not disappear when a bank buys software or uses a hosted model supplied by another company.
US supervisory agencies have been seeking details of how financial institutions deploy agentic systems, including the methods used to monitor their behaviour and stop activity that is no longer authorised or safe. Questions concerning technology developed overseas also reflect the complexity of software supply chains and the need to understand dependencies that may not be visible at the point of procurement.
European authorities have been reviewing recovery arrangements and the ability of banks to restore services without relying entirely on potentially compromised systems. That can include maintaining sufficiently independent infrastructure, trusted copies of data and practical recovery procedures. Testing these arrangements under realistic conditions is different from merely documenting an incident-response plan.
Several developments are converging. Banks are looking for productivity benefits from AI in customer service, compliance monitoring and operational support. They also face pressure to modernise older systems while managing a growing range of third-party technology providers. The result is a technology environment in which a failure or poorly controlled integration can spread across multiple business functions.
The regulatory questions therefore extend beyond whether an AI model gives an accurate answer. Supervisors are interested in who can authorise an agent’s actions, what limits apply to its access, whether decisions are recorded and how quickly humans can intervene. The ability to explain an automated decision may also be required for investigation, customer redress and regulatory reporting.
Outsourcing introduces another layer of risk. An organisation may understand its own systems but have less visibility of a provider’s model updates, infrastructure changes or subcontractors. Concentration among major technology suppliers creates the possibility that a problem at one company affects several financial institutions at the same time.
None of this establishes that agentic AI is inherently unsuitable for banking. Carefully designed systems may improve fraud detection, document processing and internal productivity. However, these gains need to be assessed alongside operational dependencies and the consequences of a control failing in an environment where customer funds and market confidence are at stake.
Bank boards already oversee operational resilience, risk appetite and continuity planning. Agentic AI is bringing new technology into those established responsibilities, requiring risk, audit, legal and operational teams to understand how an automated system behaves and what happens when an action falls outside its intended use.
Regulators are presently gathering evidence and pressing for stronger preparedness. As financial institutions increase the autonomy of their software, the credibility of those safeguards is likely to become as important to supervisors as the promised efficiency improvements.
You must be logged in to post a comment.