How Do You Govern Autonomous AI Agents in Banking?

Gartner projects that more than 40% of agentic AI projects, meaning software that plans and carries out the steps of a task itself, will be canceled by the end of 2027 (Gartner, 2025). Yet in banking, such agents can now carry a fraud alert, a Know Your Customer (KYC) refresh, or a payment exception through several systems, from intake to resolution. The agents that reach production have approval gates, a complete audit trail, and a named owner for every action, because model risk, compliance, and internal audit check for exactly those before they sign off.

How banks use agentic AI today

Banks can use agents in operations and employee-facing work. They should reserve for people decisions that change a customer’s money, credit, or regulatory standing. The Federal Reserve’s Director of Supervision and Regulation told Congress that uptake of generative and agentic AI “is generally limited to low-risk applications,” and that the Fed expects adoption to rise as applications reach more material areas (Federal Reserve, 2026).

Agentic AI accounted for 31% of new use cases announced by banks in the Evident AI Index in the first quarter of 2026 (Evident, 2026).

BNY reports 134 digital employees, which it defines as multi-agentic solutions that “autonomously perform complex, rule‑based and cognitive tasks with human oversight” (BNY, 2025). Citi introduced its Arc platform in April 2026 to deploy embedded agents across business lines “with the same rigor and control applied to any critical system within the firm” (Citi, 2026). HSBC says it has “enhanced our inventory control to apply heightened scrutiny of agentic AI use cases before deployment” (HSBC, 2026) and commits to “maintain human judgement, human decision-making and human accountability at the core” (HSBC, 2026).

Within defined permissions, agents can handle the following work without step-by-step approval:

• Gathering records from core, case management, screening and document systems
• Enriching alerts with transaction history, prior cases and counterparty data
• Drafting dispositions, credit memos and SAR narratives for review
• Reconciling breaks and repairing data within defined rules
• Routing work to the right queue with the evidence attached

Banks should require human approval for these actions:

• Filing a suspicious activity report (SAR)
• Approving, denying or repricing credit
• Releasing a payment on an instant rail or above a set limit
• Closing a high-risk alert or changing a customer’s risk rating
• Contacting a customer about suspected fraud or an account closure

What makes AI agentic versus generative AI, chatbots, and RPA?

An AI agent is software that takes a goal, breaks it into steps, calls tools and systems to carry them out, and decides the next step from the results. The EU AI Act defines an AI system as one “designed to operate with varying levels of autonomy” that “may exhibit adaptiveness after deployment” (EUR-Lex, 2026).

For a bank, the defining trait is that an agent changes system state, so a chatbot that answers wrongly produces a bad answer, while an agent that acts wrongly produces a bad transaction, a wrong rating, or a missed filing.

The four approaches fail differently and need different controls:

JPMorgan Chase lists the agent-specific version of this risk in its 2025 Form 10-K: that “AI systems, particularly agentic systems, are not designed and implemented with appropriate safeguards to prevent systems from accessing sensitive data sources or system resources and taking actions” (JPMorgan Chase, 2025).

Core use cases: fraud, AML and KYC

In fraud, AML and KYC, agents do the investigative assembly work that consumes analyst hours. People keep the filing and customer-relationship decisions.

Alert investigation. When transaction monitoring fires, the agent pulls the customer’s KYC profile, transaction history, prior alerts, counterparties, and adverse media. It then drafts a disposition with the evidence cited. An analyst reviews a prepared case instead of opening six applications to build one.

SAR drafting. The agent drafts a narrative structured around the five elements FinCEN expects: who, what, when, where and why the activity is suspicious (FinCEN). The investigator edits it, and the BSA officer decides whether to file.

Continuous KYC refresh. In place of calendar-based reviews, the agent watches for trigger events, re-collects documents, re-screens the customer, and proposes a risk rating change for an analyst to approve. HSBC’s Continental Europe entity describes its dynamic risk assessment as “replacing rule based monitoring” for customer accounts (HSBC, 2026). HSBC UK reports “a substantially better alert-to-Suspicious Activity Reports (‘SAR’) conversion rate than the previous system” but publishes no figure or baseline (HSBC UK, 2025).

Early wins share three traits:

• High alert or case volume with repetitive evidence gathering
• Outputs a person already reviews, such as dispositions and narratives
• No direct movement of customer funds

Supervisors have signaled room for this work. FinCEN’s April 2026 AML/CFT program proposal names machine learning and generative AI as examples of innovative approaches, though the rule is not final (Federal Register, 2026). The 2018 interagency joint statement says pilot programs “in and of themselves should not subject banks to supervisory criticism, even if the pilot programs ultimately prove unsuccessful” (FinCEN, 2018).

Lending, treasury, payments and customer servicing

Agents in lending and payments touch money and credit decisions, so their autonomy is narrower than in AML case preparation.

Loan lifecycle. An agent can run intake, chase missing documents, verify income, spread financials (enter a borrower’s statements into standard templates), draft the credit memo, track conditions, and monitor covenants (loan conditions the borrower must keep meeting) after closing. Underwriting carries fair lending exposure. Regulation B requires that a statement of adverse action reasons (the stated grounds for a credit denial) “must be specific and indicate the principal reason(s) for the adverse action,” and that notice of action taken generally follows within 30 days of a completed application (eCFR, 2026). The CFPB withdrew its 2022 and 2023 circulars on adverse action notices for complex algorithms on May 12, 2025 (CFPB, 2025), but the regulatory text they interpreted still stands.

Treasury control loops. BIS researchers found that generative AI agents “can replicate key cash-management tasks” in intraday liquidity management, while calling for “regulatory safeguards, human oversight and further research” before use in financial market infrastructures (BIS, 2025). In practice, the agent monitors positions and proposes funding moves inside limits, and a treasury officer approves them.

Exception-only payments. The agent works the exception queue: it repairs formatting errors, assembles screening context, and resolves mismatches. A person releases anything that leaves the bank on a rail where settlement is final.

Customer servicing. Bank of America’s CEO describes Erica as a servicing AI agent the bank deployed in 2018 (Bank of America, 2026). Servicing agents can answer, look up, and initiate low-risk requests. Disputes, hardship arrangements, and fraud claims route to staff.

How do banks bound agent autonomy and keep human oversight?

Banks bound autonomy by assigning each use case to an authority tier before deployment, then defining the conditions that push any single action up a tier.

JPMorgan’s security team frames the logic plainly: “Confined, read‑only agents merit lighter guardrails,” while agents with broader reach require “robust, continuous enforcement and oversight” (JPMorgan Chase, 2026). The Cybersecurity and Infrastructure Security Agency (CISA) and international partners advise organizations to begin with low-risk, non-sensitive use cases and to “avoid granting broad or unrestricted access, especially to sensitive data or critical systems” (CISA, 2026).

The tiering model below sets authority per use case. Each bank sets the dollar and risk thresholds from its own risk appetite:

Escalation triggers should be explicit and machine-checkable:

• Transaction or exposure amount above the bank-defined limit
• Model confidence below the approved threshold
• Missing, conflicting or stale source data
• Any action on an instant payment rail where settlement is final
• Any adverse outcome for a credit applicant
• Any instruction that arrived inside external content rather than from the operator

Few firms have this in place. Only 21% of respondents in Deloitte’s 2026 “State of AI in the Enterprise” survey say their organizations have a mature governance model for agentic AI (Deloitte, 2026). The Financial Stability Board’s final report on responsible AI adoption names agentic AI explicitly and sets out sound practices for organization-wide governance across the AI lifecycle (FSB, 2026).

Applying SR 11-7 and OCC expectations to AI agents

SR 11-7 is no longer the operative text. On April 17, 2026, the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) issued revised model risk guidance. Fed letter SR 26-2 states it “supersedes and replaces SR letter 11-7” (Federal Reserve, 2026), and OCC Bulletin 2026-13 rescinds OCC Bulletin 2011-12 and the Comptroller’s Handbook booklet on model risk management (OCC, 2026).

The revised guidance places agents outside its scope and states: “Generative AI and agentic AI models are novel and rapidly evolving” (Federal Reserve, 2026) and, as such, they are not within the scope of this guidance.”

It goes on to direct banks to use their broader risk management and governance practices for tools the guidance does not cover and Vice Chair for Supervision Bowman said the agencies expect “other risk-management and governance practices to support adoption of generative and agentic AI” (Federal Reserve, 2026). The agencies have also said they plan a request for information covering generative and agentic AI.

The carve-out does not exempt an agent’s components. A fraud score, credit model, or transaction monitoring model that an agent calls remains a traditional or non-generative model in scope. The agencies expect the guidance to be most relevant to banking organizations with over $30 billion in total assets (FDIC, 2026). Banks can extend the guidance’s 3 disciplines to the agent itself:

• Inventory: The guidance says an effective inventory includes “sufficient information to understand model risks” at individual and aggregate levels (Federal Reserve, 2026). For agents, record the use case, authority tier, tools and systems the agent can call, underlying models and the accountable owner.
• Validation: The guidance allows interpretability measures or benchmarking where theoretical review is impractical, and describes outcomes analysis as comparing outputs “to corresponding real-world outcomes.” For an AML agent, that means scoring its dispositions against investigator decisions before it reaches production.
• Ongoing monitoring: The guidance describes monitoring as evaluating whether a model performs as expected given changes in products, clients, data relevance or market conditions (FDIC, 2026). For agents, add override rates, escalation rates and drift in the procedures the agent follows.
• Vendor products: The guidance states that “the principles of model risk management remain applicable” even when a vendor withholds code, data or methodology.

Third-party risk guidance covers the foundation-model provider and the agent platform vendor; the 2023 “Interagency Guidance on Third-Party Relationships” (OCC Bulletin 2023-17) remains in effect, though on September 11, 2026, the agencies proposed replacing it, with comments due November 16, 2026 (Federal Register, 2026). The agencies state that the 2023 Guidance applies to all third parties, including those without a direct contract with the bank (Federal Reserve, 2026), a reach that extends to model APIs accepted on standard terms. The 2023 contract provisions that matter most for AI vendors are these (Federal Reserve, 2023):

• Right to audit, including SOC and other independent reports
• Ownership of data the third party generates and limits on its use of bank information
• Operational resilience and continuity if the provider fails
• Consent rights and reporting duties for subcontractors, which cover upstream model providers

On operational risk, the OCC’s “Fall 2025 Semiannual Risk Perspective” states that “appropriate governance and risk management are essential to mitigate potential risks when implementing AI systems” (OCC, 2025).

Ownership, audit trails and accountability when agents act

The business line that deploys an agent owns its outcomes. Model risk, compliance, and technology each own a defined control. SR 26-2 states that sound governance “delineate[s] the individual(s) responsible for key activities throughout the model lifecycle, from development through validation and ongoing monitoring” (Federal Reserve, 2026). The same principle applies to an agent’s lifecycle.

The RACI below assigns each agent governance activity (R = responsible, A = accountable, C = consulted, I = informed):

Audit logging is the evidence base for every row. BNY describes oversight that covers “telemetry logging, lineage tracking, approval workflows, access recertification, incident analysis and periodic retesting” (BNY). Each agent action record should capture:

• The triggering event and the case or transaction identifier
• Every data source the agent read, with timestamps
• The procedure version, model version and tools called
• The proposed action and the rationale the agent produced
• The approver, the decision and any edits
• The final system change and its reversal path

Banks cannot unilaterally reverse settled payments on instant rails. FedNow settlement becomes final at the earlier of two events: the service records the entries or sends the Advice of Credit. A Reserve Bank “has no obligation to cancel or amend a payment order” on request (Federal Reserve Financial Services, 2026).

The sending bank can seek recovery through a return request (camt.056, the standard message for asking for funds back), which FedNow procedures say should be sent within 60 days of settlement. The receiving bank can accept (IPAY), reject (RJCR), or conduct further review (Federal Reserve Financial Services, 2025).

On RTP, The Clearing House states that “Settlement is final and irrevocable” (The Clearing House). A Request for Return of Funds generally requires a response within 10 banking days, and the receiving participant has no obligation to return the funds (The Clearing House, 2023).

A failed autonomous payment therefore needs a written runbook with four parts: a kill switch that stops the agent’s payment authority, an immediate return request with the fraud or error reason code, an internal ledger correction, and customer remediation.

For consumer accounts, Regulation E requires provisional credit within 10 business days of an error notice while the bank investigates (eCFR, 2026). Because settlement cannot be undone, pre-send controls carry most of the weight. Those controls include per-transaction limits, payee verification, and human release above the tier threshold.

Fair lending, security and privacy risks

Each risk below maps to a specific control a bank can test.

• ECOA adverse action reasons: An agent that assembles a credit decision can obscure which factors a credit officer used to deny credit. The control is to keep the adverse decision with a credit officer and require the agent to output principal reasons that meet the Regulation B specificity standard, which still applies after the CFPB withdrew its algorithm circulars.
• Disparate impact and proxies: The CFPB’s April 2026 Regulation B rule states that ECOA does not authorize disparate-impact liability, effective July 21, 2026, and the rule is under challenge in National Fair Housing Alliance v. CFPB (CFPB, 2026). The same rule notes that facially neutral policies may still violate the law if they are proxies or pretexts for discrimination. The OCC still analyzes data for evidence of disparate treatment (OCC, 2025). The control is proxy testing on every input an underwriting agent uses, plus continued disparity monitoring for Fair Housing Act exposure, which the Regulation B change does not affect.
• FCRA permissible purpose and notices: An agent that pulls consumer reports during an account review must do so under a listed permissible purpose, such as reviewing whether the consumer “continues to meet the terms of the account” (Cornell LII). A creditor taking adverse action based in whole or part on a consumer report must provide the FCRA notice, including any credit score used in the decision and the reporting agency’s contact details (Cornell LII). The control is to scope report pulls to approved purposes in the agent’s tool permissions and to generate notices from a template a human releases. The CFPB withdrew its proposed data broker rule on May 15, 2025, so alternative data coverage under the FCRA rests on existing definitions (CFPB, 2025).
• Prompt injection: An agent reading customer documents, emails or web pages can receive hidden instructions. OWASP states it is unclear whether fool-proof prevention exists, and recommends segregating untrusted content, least privilege and human approval for high-risk actions (OWASP, 2024). The control is to treat all external content as data, never as instructions, and to block tool calls that originate from it.
• Excessive agency and tool misuse: OWASP traces damaging actions to excessive functionality, permissions and autonomy, and recommends implementing authorization in downstream systems rather than relying on the model (OWASP, 2024). The control is narrow, task-specific tools and entitlement checks in the core system, so a compromised agent cannot exceed its tier.
• Persistent memory poisoning: OWASP’s agentic Top 10 lists Memory and Context Poisoning (ASI06), where poisoned memory reshapes behavior long after the first interaction (OWASP, 2025). A MITRE ATLAS investigation of one agent platform found that “All memory is undifferentiated by source” (MITRE, 2026). The control is to tag memory by source and trust level, set expiry dates, and exclude customer-supplied content from durable memory.
• Privacy and credential exposure: MCP’s security guidance warns against token passthrough, where a server forwards unmodified tokens downstream and creates a confused-deputy problem (MCP, 2026). The control is audience-bound tokens per service, data minimization in every tool response, and a SAR confidentiality filter so no agent output reveals that a SAR exists.

Data and system foundations before deployment

Agents need a machine-readable record of how work runs, and most banks do not have one. Documents, standard operating procedures (SOPs), and interviews describe the intended process and can omit the tacit knowledge operators use to handle exceptions, which is where agents fail in production. Event logs, the records systems keep of their own activity, show only what instrumented systems record, so a KYC refresh that moves between a mainframe screen, a spreadsheet, and a case tool leaves gaps in any log.

Four foundations come before deployment:

• Data quality: Consistent customer identifiers, current KYC records and reconciled reference data across the systems the agent reads.
• APIs and system access: Callable, permissioned interfaces to core banking, case management and document systems, with entitlements an agent can inherit.
• Legacy core readiness: The OCC warns that prolonged use of older systems “could increase the likelihood of operational outages” and introduce security vulnerabilities (OCC, 2025).
• Interoperability standards: Anthropic donated the Model Context Protocol to the Linux Foundation’s Agentic AI Foundation in December 2025 (MCP, 2025), and its 2026-07-28 revision contains breaking changes (MCP, 2026). The Linux Foundation launched the Agent2Agent project in June 2025 (Linux Foundation, 2025), and A2A v1.0 also introduced breaking changes (A2A Project, 2026). Banks should pin protocol versions and route both through the same third-party and change controls as any other dependency.

The missing record of how work actually runs shows up in returns. In McKinsey’s 2025 “State of AI” survey, about 6% of respondents qualified as AI high performers, attributing more than 5% of earnings before interest and taxes (EBIT) and significant value to AI (McKinsey, 2025). Agents grounded in documents and event logs lack the operational context to act reliably across real workflows.

Observed process activity adds cross-system handoffs and exception patterns to the foundation for agent execution.

Grounding agents in observed work

Grounding agents in observed work means giving them a Context Graph of Work, which Skan AI, an agentic AI platform, builds from observed process activity instead of from documents or event logs. The Context Graph of Work is a continuously updated graph that connects people, applications, tasks, decisions, policies, outcomes, and governance constraints, including the cross-system handoffs and exception patterns that documents miss.

Process mining, which reconstructs workflows from system event logs, reaches end-to-end depth only after integration into every system of record. Task mining, which records user actions on the desktop, captures individual tasks. Skan AI combines end-to-end process depth with capture that requires zero integrations, APIs, or logs, built on privacy by design.

Skan Virtual Assistant (Skan VA) observes process activity across mainframes, virtual desktop infrastructure (VDI), legacy desktop applications, web applications, and spreadsheets with zero integrations, APIs, or logs. Privacy by design governs what it captures: email content and keystrokes are never captured. Skan PRISM, an on-premises gateway, applies pixel-level redaction before protected information leaves the customer environment, so raw screen data stays inside the customer-controlled perimeter.

Deployment options are on-premises inside the customer firewall, private cloud, or Skan AI hosted. Skan AI’s assurance posture includes a System and Organization Controls (SOC) 2 Type 2 report, ISO 27001 and ISO 42001 certifications, and compliance with the Health Insurance Portability and Accountability Act (HIPAA), the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

The products work in sequence: Skan AI Blueprint runs a lighter opportunity scan to identify where agents fit, and Skan AI Process Intelligence then observes those identified areas in depth, building the Context Graph of Work with end-to-end flows, variants, and drift detection. Skan AI Agents execute approved work under agentic operating procedures (AOPs), machine-usable procedures that encode workflow steps, decision rules, escalation thresholds, and stopping conditions, while Agent Studio sets each agent’s scope, permissions, and escalation paths. The control and governance layer records inputs, outputs, actions, decisions, and rationales for case-level review, which supports the traceability model risk and audit teams ask for, though regulatory compliance remains the bank’s own determination.

Realistic example: A governed AML alert triage agent

This illustrative workflow runs one transaction monitoring alert from trigger to audit record under a Tier 3 authority setting:

1. Trigger. The transaction monitoring system generates an alert on a pattern of cash deposits. The case opens in the investigation queue, and the clock rules are attached: the bank must file a SAR within 30 calendar days of initially detecting facts that may constitute a basis for filing, extendable to no more than 60 days if no suspect is identified (eCFR, 2026).
2. Evidence assembly. The agent reads the KYC profile, 12 months of account activity, prior alerts, linked accounts and adverse media through read-only tools. It logs each source and timestamp.
3. Analysis and draft. The agent applies the approved procedure, compares the activity with the customer’s stated business, and drafts a disposition: close, escalate or recommend a SAR. Where it recommends a SAR, it drafts a narrative covering who, what, when, where, why and how.
4. Gate check. If confidence is below threshold, data is missing or the customer is high-risk, the agent routes the case to a senior investigator without a recommendation. It cannot close the alert, contact the customer or touch the account.
5. Human decision. The investigator reviews the evidence, edits the narrative and records a decision. The FFIEC manual describes the decision to file as “an inherently subjective judgment” and directs examiners to the bank’s decision-making process (FFIEC). No retrieved FinCEN, OCC or FFIEC text requires human sign-off on AI-assisted SAR decisions in those words. In this workflow, the bank retains human sign-off because it bears the filing obligation and assigns the judgment to its BSA officer.
6. Filing and approval. The BSA officer approves the SAR and a person files it. FinCEN’s October 2025 FAQs state there is no requirement to document a decision not to file (FinCEN, 2025). In this workflow, the bank logs the agent’s recommendation and the human decision for model monitoring.
7. Audit record. The investigator closes the case with the full action log: sources read, procedure and model versions, the draft, the reviewer’s edits, approvals and the filing confirmation. The bank retains the SAR and supporting documentation for five years from filing (FinCEN, 2026).
8. Feedback. Model risk reviewers compare agent recommendations with final decisions each month. They review the procedure when override rates rise, before the agent’s next release.

Want to see how you can transform a regulated workflow by grounding agents and governance controls in real work? Request a Skan AI demo.

Banks evaluating agentic AI need to distinguish execution from content generation, select bounded starting workflows, assign accountability, and plan for regulatory scope and payment finality.