Andrew Bailey, governor of the Bank of England and chair of the Financial Stability Board, in an official portrait from 2016, when he was named head of the Financial Conduct Authority (file photo). Image: UK Government / Wikimedia Commons, OGL 3.0, cropped
The G20’s financial watchdog wants banks to treat their AI agents a little like new staff: give each one its own ID, keep a record of everything it does, and make sure a human can stop it. The Financial Stability Board published its final Sound Practices for Responsible Adoption of Artificial Intelligence on Thursday, and the biggest changes since its June draft are about agentic AI.
The FSB, chaired by Bank of England governor Andrew Bailey, coordinates financial regulators from the G20 economies. Its 12 “sound practices” are not binding rules, but the board “strongly encourages” the boards and senior management of banks, insurers and other financial firms to use them when they build their AI governance and risk controls. It reports to G20 leaders, and national regulators tend to build on its work.
An ID badge for every AI agent #
For agentic AI, the report says firms should keep records that let them pin every action, decision, intermediate step and escalation to a human on a specific agent. Each agent should get a unique identifier so a bank can see which actions it took and which people set it up and oversaw it, and so it can’t be mistaken for a human user. Firms should also be able to trace what triggered an action, what data and tools the agent touched, and whether it stayed within its permissions at every step. It also warns that risk grows faster than access. An agent’s risks “may compound multiplicatively (rather than additively) as its permissions expand,” so a bank weighing whether to give an agent a new tool or more data should judge the new and existing access together, and agree a risk tolerance for each agent use case at the start.
When humans can’t keep up, AI watches AI #
The report is frank about the limits of oversight. An agent “can take hundreds of intermediate steps in pursuit of its goals and make errors in any of those steps,” it says, and real-time human monitoring becomes impractical as use scales. “In some cases, effective monitoring and detection may require augmentation with another AI agent or other forms of AI.”
Its list of agentic risks includes agents taking unauthorised shortcuts they don’t recognise as unauthorised, colluding with other agents in cyber attacks, “memory poisoning” through malicious data fed into their knowledge base, and sub-agents spreading decision-making so thinly that controls stop working.
The human oversight practice now sets out a menu: human-in-the-loop (a person approves every decision), “AI-in-the-loop” (AI raises alerts that humans act on), human-on-the-loop (people step in only when needed), “human-in-command” for highly autonomous agents, where people set the limits and guardrails, and a kill switch that can halt an AI system outright or hand it back to human operators step by step. Staff who monitor an AI system after launch should not be the people who built it.
What changed since June #
The FSB put a draft out for consultation on June 10 and received around 160 responses from banks, insurers, asset managers, tech providers and academics. Its overview of the responses says several asked for more on agentic AI, and the final version updates the risk section, adds specific considerations for highly autonomous AI and a new agentic AI case study. The FSB admits these extras were “not fully consulted on” and that practices for agentic and multi-agent systems are “still emerging”.
The new case study describes a large international bank whose fraud-hunting agent, built in-house in three months, proposes detection rules that a human team must approve. The bank says the agent helped write or update three quarters of its card fraud rules and cut fraud losses by more than 20% in the first half of its 2026 financial year.
The third-party practice was also broadened. Many respondents said they couldn’t get enough information from vendors to check third-party AI models properly, “especially frontier models”. The final text tells firms to win audit, data and termination rights in contracts, spot AI hidden inside software not sold as AI, plan exits for critical AI services, and band together to push providers towards common terms. Calls to tackle system-wide risks, such as many firms relying on the same few models, were set aside for the FSB’s separate vulnerability monitoring.
Why it matters #
Banks are already putting agents to work, from Barclays rolling out Claude Code to most of its engineers to fraud systems that write their own rules. The FSB’s text gives supervisors a shared yardstick, and its own admission that agentic AI may need “more comprehensive treatment” suggests tougher expectations are coming, after the Bank of England named rogue AI models as a financial stability risk last month.
Sources: FSB, Sound Practices for Responsible Adoption of AI: Final report (October 15, 2026); FSB press release; FSB, overview of consultation responses.