FSB Sound Practice 10: The Supervisory Architecture for Agentic AI That National Regulators Will Translate

The Financial Stability Board delivered its final report on 12 Sound Practices for responsible AI adoption to G20 Finance Ministers and Central Bank Governors in Bangkok, establishing a non-binding supervisory baseline for agentic AI in finance. Sound Practice 10 requires a human-in-command model with human approval or dual authorization for agent transactions above a set threshold, restricted payment-system access, comprehensive audit trails, and AI-in-the-loop monitoring. FSB Chair Andrew Bailey's accompanying letter and legal analysis from Skadden indicate national regulators including the Federal Reserve, OCC, FDIC, SEC, and CFPB are expected to translate the framework into examination requirements, while the Warner AI AGENT Act remains stalled in the Senate Commerce committee and the Hawley-Murphy AI Agent Accountability Act has seen no committee action.

The global supervisory architecture for agentic AI https://forkast.news/glossary/agentic-ai/ is shifting from theoretical debate to operational reality. By delivering its final report on Sound Practices https://www.fsb.org/2026/10/sound-practices-for-responsible-adoption-of-artificial-intelligence/ to G20 Finance Ministers and Central Bank Governors in Bangkok, the Financial Stability Board has effectively signaled that the era of unconstrained autonomous experimentation in finance is closing. While these 12 practices remain non-binding, they establish a baseline for risk management that institutions ignore at their own peril, as detailed in the accompanying letter https://www.fsb.org/2026/10/fsb-chairs-letter-to-g20-finance-ministers-and-central-bank-governors-october-2026/ from FSB Chair Andrew Bailey. The Human-in-Command Mandate At the core of this framework is Sound Practice 10, which mandates a shift toward a human-in-command model. The FSB acknowledges that traditional, decision-by-decision review is incompatible with the velocity of autonomous systems. Instead, the board requires firms to focus on high-level oversight, specifically defining autonomy boundaries and setting guardrails rather than attempting to audit every individual output. For agents handling financial transactions, Sound Practice 10 imposes a significantly more rigorous set of controls. To mitigate systemic risk, the framework requires institutions to implement human approval or dual authorization for any transaction exceeding a specific threshold value. Furthermore, it demands restricted access to payment systems and the maintenance of comprehensive audit trails for every transaction an agent executes. As these systems scale, the FSB explicitly expects firms to deploy AI-in-the-loop monitoring—using AI to oversee other AI—to supplement human supervision. From Non-Binding to De Facto Requirement Although the FSB’s guidance lacks the force of law, its influence on the operating environment is substantial. National regulators, including the Federal Reserve, OCC, FDIC, SEC, and CFPB, typically translate such international frameworks into concrete examination requirements. As Federal Reserve Governor Michelle Bowman noted in July 2026, regulators are expected to align with existing frameworks and tailor expectations to use-case materiality. Legal experts at Skadden https://www.skadden.com/insights/publications/2026/08/the-fsbs-sound-practices have observed that the framework is likely to influence supervisory practice despite being nonbinding, making it prudent for firms to benchmark their current governance against these standards immediately. The Liability Vacuum The FSB’s intervention arrives during a period of legislative paralysis. The Warner AI AGENT Act https://forkast.news/warners-agent-fiduciary-bill-sits-in-committee-while-two-consumer-agents-enter-the-market/ , which would treat AI agents as fiduciaries, has stalled in the Senate Commerce committee, while the Hawley-Murphy AI Agent Accountability Act remains without committee action. In this void, the industry is effectively writing its own rules. Consumer-facing agents like Meta’s Muse and xAI’s GrokBot are already operating under vendor-defined liability terms, while the tools-not-actors doctrine championed by some observers seeks to place liability on developers rather than users. As detailed in our Policy Radar https://forkast.news/policy-radar-agent-liability-is-being-written-without-a-statute/ , the legal status of the agent itself remains an open, urgent debate. The FSB provides a structure for internal governance, but it does not resolve the external legal liability of autonomous actions. For a deeper look at how these standards intersect with current market trends, see our recent FSB piece https://forkast.news/global-fsb-issues-final-guidance-on-agentic-ai-in-finance-market-structure-beyond-the-perimeter/ . The standing question remains: who answers when an agent’s purchase, booking, or email goes wrong? For builders and investors, the immediate task is to align with these emerging supervisory expectations while navigating a landscape where the law is still catching up to the code.