The FSB moves control of AI agents into code

On 15 October 2026 the Financial Stability Board (FSB) published the final version of its twelve sound practices for the responsible adoption of artificial intelligence in financial institutions. It follows a consultation draft published on 10 June and, according to the FSB, around 160 responses. The framework itself barely moved: the twelve practices keep their order, and the six forms of human oversight in sound practice 10 are word for word what they were in June.

The change sits one level down, with AI agents. The draft treated them through a list of guardrails: identifiers, approval thresholds, prohibited actions. The final report turns that list into an architecture. Controls should take effect in code before an agent acts, permissions should be assessed as a combined risk, and every action should be attributable to an agent and to the person behind it. That is a different answer from the one many read into the draft over the summer, that human oversight had reached its limits and would be handed to machines. People stay accountable. What they gain are controls that do not depend on someone paying attention at exactly the right moment.

The summary now follows the structure

The draft’s executive summary split the twelve practices into three clusters: governance (1 to 4), the individual use case (5 to 10), and cyber and third-party risk (11 and 12). The body of the draft, however, already placed both of the last two in its chapter on the AI lifecycle. The final report now brings the summary into line and says so on its first page: “The 12 sound practices are organised into two groups.” The first four still cover governance across the whole organisation. The remaining eight, in the report’s words, set out a framework “for managing risks throughout the AI lifecycle, from inception to retirement.” Cyber and ICT (information and communication technology) risk and third-party dependencies are therefore managed across each use case’s lifecycle, in the summary as well as in the body.

The wording of the practices themselves changed little. In nine of the twelve the FSB either dropped a comma or left the text untouched. The other three were sharpened. Sound practice 3 is now titled “Incorporation of AI risks into risk management framework and effective documentation of AI use”, “selection” in sound practice 6 has become a “selection process”, and the text of sound practice 12 refers to “third-party AI dependencies” where the draft spoke of AI third-party use. According to the FSB’s overview of the consultation, practice 12 now also covers AI embedded in purchased products, sub-outsourcing along the supply chain and how to manage concentration among a small number of providers. For firms, the implication is to examine the third-party dependencies of an AI use case when it is selected, tested and retired, and not to leave them to outsourcing management alone.

Six forms of oversight, now explicitly combinable

Sound practice 10 is headed “Human oversight”. The FSB distinguishes six forms: human-in-the-loop, AI-in-the-loop, human-on-the-loop, human-in-command, kill switch and contestability. The sequence follows the point at which a person steps in, and it implies no ranking. The final report now introduces the list with a sentence that rules out reading it as a fixed ladder: “These forms are not mutually exclusive and may be used in conjunction, or separately at different stages of the AI lifecycle.”

Two of the six carry most of the debate about agents. The first is AI-in-the-loop, which the report defines as follows: “‘AI-in-the-loop’: integrates AI into human oversight to augment performance monitoring rather than merely using humans to oversee AI. It uses AI as a supportive layer for decision-making and task automation while keeping humans in control (e.g. humans monitor and respond to AI-enabled automated alerts). AI-in-the-loop may become warranted as financial institutions scale the number of AI use cases.” As use cases multiply, the report says this form may become warranted.

The second is human-in-command, aimed explicitly at autonomous systems: “‘Human-in-command’: high-level human oversight, including deciding the extent of autonomy, setting guardrails and managing its overall impact. This form of human oversight is aimed at AI with high levels of autonomy, such as agentic AI.” Here the human sets the parameters: how much autonomy the system has, which guardrails apply and what overall impact is acceptable. Outputs need not be reviewed one by one.

Guardrails become an architecture

What those limits look like in technical terms only the final report spells out. It asks institutions to combine human oversight of agents with deterministic controls and is precise about where those controls live: “Deterministic controls are introduced at design and implemented as code in the control plane (the layer where decisions are made about what an agent can and cannot do).” These are restrictions that hold whether or not anyone is watching at the time. The draft already required approval before payments above a set value. The final report extends approval triggers to any action that could cause irreversible harm, and asks for goals to be broken into discrete steps so that an agent cannot carry on after failing a control. The report grounds this design in how agents behave: they interact with other agents, reason in loops and call tools repeatedly, all of which can compound errors.

Also new is a rule on permissions that the draft did not contain. According to the report, the risks arising from an agent’s access to tools and systems can multiply rather than simply add up with every new permission. Anyone granting an agent one more tool should therefore assess the risk of the new and existing access together. Anyone who has worked with access management in banks knows that requests are usually reviewed one at a time. The rule therefore targets an established habit inside firms.

Traceability completes the picture. The draft already called for identifiers for agents. The final report develops this into the concept of attribution: each agent carries a unique identifier that distinguishes it from human users and other systems, and it must be clear which person configured and oversaw it. Documentation and lifecycle records should be protected against later alteration and, where possible, made immutable. Agents that spawn sub-agents now form a risk category of their own, because decisions are spread across several instances and controls may weaken as a result. Where appropriate, summaries that agents write about their own actions should be checked against other sources, the report citing the risk of “deception and hallucination by agents”. And the kill switch, already one of the six forms of oversight in the draft, should now also be tested for agents: how an agent responds when it cannot complete a task safely, when a connected system fails, or when further attempts would make a problem worse. Retaining human expertise is new as well: firms should give staff room to take decisions, challenge AI outputs and keep the skills they need when AI tools are unavailable or wrong.

The final report is not more specific everywhere. The draft contained a separate passage on agents handling customer funds: human approval or dual authorisation above a set value, no direct agent access to payment systems, and execution only through a human. That passage has been dropped, and the value threshold survives only as an example of an approval trigger. Also gone are the instruction to analyse approval patterns for signs that people merely rubber-stamp agent recommendations, and the idea of treating agents in HR processes as synthetic employees. The report still names over-reliance and automation bias as risks, just without that review step. The shift is towards general architecture and away from transaction-specific rules. For institutions that had used the dropped payments passage as their benchmark, the final report is less specific.

Trading floors have run this architecture since 2018

The pattern is new only for agents. Anyone who has taken a trading algorithm live under the second Markets in Financial Instruments Directive (MiFID II) will recognise it from Commission Delegated Regulation (EU) 2017/589 on algorithmic trading. Its Article 15 requires pre-trade controls on every order entry: price collars that automatically block or cancel orders outside set price parameters, together with maximum order values and maximum order volumes. Article 12 requires a kill functionality that lets an investment firm cancel all of its unexecuted orders on every trading venue immediately. Under Article 12(3), a firm must be able to identify for each order which trading algorithm and which trader, trading desk or, where applicable, client is responsible for it.

The parallel with the FSB’s final report is structurally close: limits written in code, an emergency stop, and every action traced to its origin. The analogy has its limits. A trading algorithm follows logic its developers fixed in advance. An agent chooses its own route to a goal and, as the FSB notes, may interpret its instructions in unexpected ways. That is precisely why the pattern still applies: a control that sits outside the decision logic works however that logic behaves. A price collar does not care why an algorithm wants to send an order. It simply blocks or cancels the order if it falls outside the permitted range. The FSB now asks that controls on agents be equally independent of the agent’s own reasoning. Institutions with a trading business already have the blueprint in-house, even if it sits in another part of the bank.

The newest part is the least tested

However concrete the provisions on agents have become, the FSB itself treats them as provisional. Its overview of the consultation states: “These additional considerations on agentic AI are not fully consulted on but are distilled from the public consultation responses.” The report describes the practices for agents and multi-agent systems as “nascent” and allows that they may warrant fuller treatment in future. The architecture for agents, the part of the final report with the greatest practical consequence, has therefore not been through the full consultation process.

That is no argument against its content. According to the FSB’s overview, several respondents had asked for precisely these controls, from authorisation before execution and least-privilege access to immutable audit trails. It is an argument for reading these controls as a direction of travel rather than an exhaustive list. The FSB has also expressly left out the systemic dimension raised by several respondents, such as correlated behaviour among market participants using the same models. It intends to keep monitoring those questions through its regular assessment of vulnerabilities. The herding risk created by many identically built agents therefore lies beyond what any single institution can manage through the sound practices.

AI may monitor AI, but only independently

Over the summer, coverage of the draft circulated the idea that the FSB was steering banks towards AI that monitors AI. The phrase came from a trade publication’s headline and was not in the draft. The final report now takes up the theme itself, with a condition attached: “Where AI is used to monitor and manage the performance and risks of another AI model or system, the monitoring AI is independent of the AI model or system under review.” The sentence sits in the passage on control functions, which are to remain separate from development teams and business users.

The gap between that sentence and the headline remains wide. AI-in-the-loop strengthens the monitoring capacity of a human who stays in control. Where one AI does monitor another, the FSB expects the same independence it expects of any other control function. Boards that take the headline at face value risk handing oversight to machines in a way the report does not endorse, and miss the independence condition it attaches.

What the case studies actually show

The report’s case studies from practice reveal more than its principles do. A large internationally active bank runs an agentic system that detects emerging fraud and scam patterns in real time and proposes the detection rules needed to stop them. The bank’s existing AI capabilities were already monitoring more than 80 million signals a day. According to the report, the agent has helped develop or update three quarters of the bank’s card fraud rules and contributed to a reduction of more than 20% in fraud losses in the first half of the 2026 financial year compared with the same period a year earlier.

The report adds one condition: “The process embeds human oversight to review and approve all new rules by the bank’s fraud analytics team before implementation.” The case with the strongest numbers thus keeps the closest form of oversight: every new rule is reviewed and approved by the bank’s fraud analysts before it goes live. Strong results and close human control are not at odds here.

A new case study in the final report shows the architecture at work. A large life insurer uses agents in consumer claims processing and built them in-house rather than buying them in, to gain more transparency and control. In testing, the agents could be coerced into trying to access databases and systems they had no permission for, “in one case trying to delete certain data files.” The insurer responded with additional access controls at the control plane, least-privilege permissions for each agent, individual registration of every agent, and activity logs that human overseers spot-check against the actions actually taken. In production the agents run with constrained autonomy.

Another new case study comes from a global systemically important bank with significant capital markets and broker-dealer activities. Rather than build separate governance for AI, it made targeted additions to its existing risk and control frameworks and set up a central AI governance committee chaired by a senior executive, with governance bodies in each business area beneath it. A third case, carried over from the draft, describes an insurer that cut underwriting turnaround from one business day for simple cases and two to three days for complex ones to around 45 seconds. The same insurer reports six million lines of code written with AI support in 2025, with roughly 80% adoption among developers. The coding figures are hard to interpret, because the report gives no baseline for them.

No standard, but proportionality by design

The report’s legal status is clear, and the final version restates it, as the draft did: “The sound practices do not establish an international standard, prescribe how financial institutions should adopt AI, nor are they intended to influence business decisions to adopt a particular AI technology.” As in the draft, it adds that applying the practices does not relieve an institution of its obligations under local law. The FSB also says it will update the practices as needed.

Linked to this is a principle of proportionality that the final report has shifted by a single word: “More robust practices may be appropriate for financial institutions that are large, complex or highly connected within their ecosystem and where AI is used or deployed in the financial institutions’ critical functions.” The draft read “large, complex, and highly connected”. Among the three size criteria, one is now enough, provided AI runs in critical functions. That brings more institutions into scope. Smaller, less complex or less interconnected firms may still apply only the relevant practices or adapt them. According to the FSB’s overview, the final report also explains how such firms can draw on existing roles and external expertise to do so. The practices are not meant as a checklist.

The report also needs to be placed alongside the work of other bodies. The International Organization of Securities Commissions (IOSCO) published its Supervisory Toolkit for AI Use in Capital Markets as a final report on 25 May 2026. The FSB describes its practices as broadly compatible with the work of other standard-setters and lists IOSCO’s work among its sources. The report mentions no joint initiative between the two bodies.

What this means in practice

For governance, risk and internal audit functions, five practical steps follow from the final report. None requires new structures, and all build on processes firms already run.

Christian Schablitzki – the agentic banker

Strategy & Management Consultant · Agentic AI expert for financial institutions

More than 20 years in investment banking and derivatives trading, followed by over 10 years advising financial institutions. Currently Partner at Infosys Consulting in Germany. Certified as Claude Partner – Claude Code (Anthropic), as well as in Google AI, Generative AI Leader (Google Cloud) and IBM RAG and Agentic AI.

LinkedIn profile → · agenticbanker.ai →