# An operating system for AI agents in your bank

Source: https://www.bankingnewsai.com/agentic-banking
Last updated: Oct 19, 2026

Eight control layers, an eight-gate lifecycle, five autonomy levels, where agents run across the bank's functions, and every documented regulator position on agentic AI — each claim linked to a primary source in the regulation tracker.

## The control plane: eight layers

0. **Governance and accountability** — decides who owns the outcome. [Details](https://www.bankingnewsai.com/agentic-banking/control-plane#governance)
1. **Identity and entitlements** — decides who the agent is. [Details](https://www.bankingnewsai.com/agentic-banking/control-plane#identity)
2. **Action gateway** — decides what the agent may do. [Details](https://www.bankingnewsai.com/agentic-banking/control-plane#actions)
3. **Data and knowledge** — decides what the agent may know. [Details](https://www.bankingnewsai.com/agentic-banking/control-plane#data)
4. **Models and vendors** — decides what the agent thinks with. [Details](https://www.bankingnewsai.com/agentic-banking/control-plane#models)
5. **Runtime and orchestration** — decides where the agent runs. [Details](https://www.bankingnewsai.com/agentic-banking/control-plane#runtime)
6. **Observability, evaluation and audit** — decides what the bank can see. [Details](https://www.bankingnewsai.com/agentic-banking/control-plane#observability)
7. **Human oversight and escalation** — decides when a person steps in. [Details](https://www.bankingnewsai.com/agentic-banking/control-plane#oversight)

## The lifecycle: eight gates

1. **Intake** — What will the agent do, for whom, and what could go wrong?
2. **Risk tiering** — Which tier, which autonomy level, which rulebook?
3. **Design** — What is the permission envelope and where does a human sit?
4. **Build and onboard** — Do we know what we are buying, and can we leave?
5. **Validate and test** — Does it do what we approved, and what happens when attacked?
6. **Approve and deploy** — Who signs, and is the oversight actually configured?
7. **Operate and monitor** — Is it still doing what we approved?
8. **Change, incident and retirement** — What changed, what broke, and when do we re-assess?

## Autonomy levels

| Level | Name | What the agent may do | Oversight |
| --- | --- | --- | --- |
| 0 | Inform | Retrieves, summarises and answers. Takes no action on any system. | Accuracy testing and source lineage; a route to a human where customers are involved. |
| 1 | Draft | Proposes an action, a document or code. A person executes it. | Human review before anything leaves the drafting stage — the standard supervisors set for AI-generated code. |
| 2 | Act with approval | Executes each action only after a person approves it. | Per-action approval by a competent reviewer, logged — the 'human-in-the-loop accountability' the OCC observed at banks in 2026. |
| 3 | Act within bounds | Executes autonomously inside a pre-approved envelope: allow-listed tools, value and rate limits, sampled review. | Extra oversight measures scaled to autonomy, a kill switch, continuous monitoring and human review on request. |
| 4 | Autonomous | Closed-loop, multi-step, self-directed operation across systems. | Rare in banking: 2% of use cases were fully autonomous in the UK's 2024 survey. The FSB names autonomous multi-step action as a risk and the FSB Chair flagged frontier models' autonomy to the G20. |

## Where agents run

| Function | Group | Agent uses | Defensible autonomy today | Sources |
| --- | --- | --- | --- | --- |
| Customer service | Front office | Chat and voice agents that answer, triage, and execute routine servicing; the most widely deployed agentic use in banking. | 2 | [CFPB Chatbots in Consumer Finance (issue spotlight, 2023)](https://www.bankingnewsai.com/ai-regulation/documents/cfpb-chatbots-in-consumer-finance-2023), [EBA report: Rising application of AI in EU banking and payments (Sep 2025)](https://www.bankingnewsai.com/ai-regulation/documents/eba-ai-adoption-report-2025) |
| Onboarding and KYC | Front office | Document collection, identity checks and case preparation; the front line against AI-generated identity fraud. | 2 | [FIN-2024-Alert004 (Deepfake Media)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2024-deepfake-media), [EBA report: Rising application of AI in EU banking and payments (Sep 2025)](https://www.bankingnewsai.com/ai-regulation/documents/eba-ai-adoption-report-2025) |
| Lending and underwriting | Front office | Agents that assemble applications, pre-screen and explain decisions; the credit decision itself stays under consumer law and, in the EU, the high-risk regime. | 1 | [ECOA / Regulation B adverse action (15 U.S.C. 1691(d); 12 CFR 1002.9)](https://www.bankingnewsai.com/ai-regulation/documents/cfpb-ecoa-regulation-b-adverse-action), [Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689), [SB 26-189](https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189) |
| Advice and wealth | Front office | Research, portfolio commentary and client preparation for advisers; automated recommendations are examined for accuracy and suitability. | 1 | [Division of Examinations FY2026 Priorities](https://www.bankingnewsai.com/ai-regulation/documents/sec-exam-priorities-fy2026) |
| Fraud and AML | Middle office | Alert triage, investigation drafting and case narratives; the FSB's consultation includes agentic fraud detection at a large bank as a case study. | 3 | [FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026), [Hill House oversight testimony (Jun 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fdic-testimony-oversight-prudential-regulators-2026), [Division of Examinations FY2026 Priorities](https://www.bankingnewsai.com/ai-regulation/documents/sec-exam-priorities-fy2026) |
| Credit and market risk | Middle office | Analysis, scenario narration and model documentation; the quantitative models remain under model risk management. | 1 | [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2), [Cook: Opportunities and Risks of AI (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fed-cook-speech-ai-economy-financial-system-2026) |
| Compliance and regulatory change | Middle office | Regulatory-document analysis, obligation mapping and policy drafting — the ECB's most-cited generative use after IT operations. | 2 | [Machado speech: 'Technology is neutral, governance is not' (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-machado-technology-neutral-governance-speech-2026), [EBA report: Rising application of AI in EU banking and payments (Sep 2025)](https://www.bankingnewsai.com/ai-regulation/documents/eba-ai-adoption-report-2025) |
| Treasury and ALM | Middle office | Forecast commentary, funding memos and counterparty document review around models that stay fully validated. | 1 | [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2), [BCBS 239](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-239) |
| Operations and payments | Back office | Exception handling, reconciliation and payment-investigation agents inside critical operations. | 2 | [BCBS Principles for Operational Resilience (2021)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-principles-operational-resilience-2021), [FIN-2024-Alert004 (Deepfake Media)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2024-deepfake-media) |
| Finance and reporting | Back office | Report drafting, variance analysis and data-quality checks over regulated risk data. | 1 | [BCBS 239](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-239), [BCBS 239 Implementation Newsletter (Jan 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-newsletter-bcbs239-implementation-2026) |
| IT and engineering | Back office | Coding agents, incident management and change automation — the fastest-growing generative use in European banks, with human code review now a supervisory ask. | 2 | [Machado speech: 'Technology is neutral, governance is not' (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-machado-technology-neutral-governance-speech-2026), [DFS Frontier AI Models Industry Letter (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ny-dfs-industry-letter-2026-05-21-frontier-ai-models), [Cook: Opportunities and Risks of AI (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fed-cook-speech-ai-economy-financial-system-2026) |
| Cyber and security operations | Back office | Detection, triage and response agents in the SOC — the one place supervisors are actively asking banks to use AI faster. | 3 | [NIST IR 8596 (Cyber AI Profile)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ir-8596), [ESA Statement on ICT risks from frontier AI models (JC 2026 25)](https://www.bankingnewsai.com/ai-regulation/documents/esas-jc-2026-25-frontier-ai-statement), [OCC Semiannual Risk Perspective, Spring 2026](https://www.bankingnewsai.com/ai-regulation/documents/occ-semiannual-risk-perspective-spring-2026) |

## Maturity

1. **Experiments** — Pilots in individual teams. No inventory, no tiering, shared credentials, vendor terms unread. Signals: Nobody can list every AI-enabled feature in production; Agents run on human or service-account credentials
2. **Copilots at scale** — Level 0–1 assistants deployed widely: summarisation, drafting, coding. An inventory exists; governance is policy, not enforcement. Signals: Inventory and owners exist; Human review of outputs is expected but not evidenced
3. **Governed agents** — Level 2–3 agents in defined use cases with guardrails, approval steps and measured human oversight. This is the practice supervisors describe at large banks in 2026. Signals: Tiering decides the control set; Approvals and overrides are logged and reported; Vendor AI under third-party risk management
4. **Agent operating system** — Identity, gateway, data access, runtime and observability are shared platform services; policy is enforced in code across every agent rather than re-implemented per use case. Signals: One identity and entitlement model for agents; One gateway, one trace store, one evaluation pipeline; New agents inherit controls by default
5. **Multi-agent operations** — Agents coordinate across functions at level 3–4 autonomy. The controls exist only in outline: NIST's multi-agent overlay is its least mature, and the FSB names autonomous multi-step action as a risk. Signals: Declared, traceable hand-offs between agents; Budgets and kill switches at the workflow level, not only per agent

## How regulators are moving

- Dec 2, 2027 — EU AI Act high-risk obligations (expected): Stand-alone Annex III systems, including credit scoring. ([Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689))
- Jan 1, 2027 — Colorado ADMT Act in force (expected): Notice, explanation and human review for consequential decisions. ([SB 26-189](https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189))
- Oct 15, 2026 — HKMA 'ART' Framework shifts oversight for AI agents: New supervisory guidance 'recognises a progressive shift from "human-in-the-loop" to "human-on-the-loop" oversight' as AI agents grow more capable, drawing on a GenA.I. Sandbox cohort where over 60% of use cases involved agents. ([HKMA "ART" Framework / AI supervisory guidance](https://www.bankingnewsai.com/ai-regulation/documents/hkma-art-framework-ai-guidance-2026))
- Oct 15, 2026 — FSB publishes final sound practices: The FSB published the final 'Sound Practices for Responsible Adoption of AI' report, finalising the 12 practices first proposed in June 2026, as a 2026 G20 deliverable. ([FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026))
- Oct 7, 2026 — MAS finalises AI risk management guidelines: Guidelines apply to all financial institutions, covering generative AI and AI agents; oversight expectations from Oct 2027, lifecycle controls from Oct 2028. ([MAS Guidelines on Artificial Intelligence Risk Management](https://www.bankingnewsai.com/ai-regulation/documents/mas-guidelines-ai-risk-management-2026))
- Sep 30, 2026 — California SB 947 signed ('No Robo Bosses Act'): First US law barring sole reliance on an automated decision system for employee discipline or termination; human corroboration required from Jul 1, 2027. ([SB 947](https://www.bankingnewsai.com/ai-regulation/documents/ca-sb-947-2026))
- Sep 30, 2026 — Bailey: 'regulation is not the right place to start': BoE Governor ties frontier AI's closed-loop recursive learning to financial stability; prioritises testing and 'credible points of intervention' over rulemaking. ([Bailey: Frontier AI and the Question of Governance (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-bailey-frontier-ai-governance-2026))
- Sep 28, 2026 — California AB 1609 signed: Bars representing a customer-service chatbot as human from Jan 1, 2027; requires a route to a human agent within 15 minutes. ([AB 1609](https://www.bankingnewsai.com/ai-regulation/documents/ca-ab-1609-2026))
- Sep 2, 2026 — FCA frontier AI and cyber review: Vulnerability discovery outpaces remediation; the surrounding 'harness', not the model, decides outcomes. ([FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fca-frontier-ai-cyber-resilience-2026))
- Aug 31, 2026 — FSB Chair to the G20: Frontier models' autonomy named as a stability concern. ([FSB Chair's letter to G20 (Aug 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-chair-letter-g20-august-2026))
- Jul 31, 2026 — ESAs on frontier AI under DORA: AI components in asset inventories; continuous monitoring. ([ESA Statement on ICT risks from frontier AI models (JC 2026 25)](https://www.bankingnewsai.com/ai-regulation/documents/esas-jc-2026-25-frontier-ai-statement))
- Jul 14, 2026 — HM Treasury adoption plan: 'Beyond isolated pilots' as government policy. ([HM Treasury Financial Services AI Adoption Plan (Jul 2026)](https://www.bankingnewsai.com/ai-regulation/documents/hmt-financial-services-ai-adoption-plan-2026))
- Jun 10, 2026 — FSB 12 sound practices: Human oversight scales with autonomy; agentic risks named. ([FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026))
- Jun 5, 2026 — UK survey asks about agents: First regulator dataset on agentic deployment, due late 2026. ([2026 BoE/FCA AI survey](https://www.bankingnewsai.com/ai-regulation/documents/uk-ai-in-financial-services-survey-2026))
- May 21, 2026 — DFS frontier-AI letter: Human review of AI-generated code; logging; faster patching. ([DFS Frontier AI Models Industry Letter (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ny-dfs-industry-letter-2026-05-21-frontier-ai-models))
- May 7, 2026 — OCC Risk Perspective: Banks 'measured' on agentic AI: guardrails, human in the loop. ([OCC Semiannual Risk Perspective, Spring 2026](https://www.bankingnewsai.com/ai-regulation/documents/occ-semiannual-risk-perspective-spring-2026))
- Apr 17, 2026 — SR 26-2 / Bulletin 2026-13: Model risk modernised; generative and agentic AI carved out. ([SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2))
- Feb 24, 2026 — ECB: 'governance is not neutral': 85%+ of large EU banks use AI; agentic accelerating. ([Machado speech: 'Technology is neutral, governance is not' (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-machado-technology-neutral-governance-speech-2026))
- Feb 19, 2026 — Treasury FS AI RMF: The sector's voluntary risk-management template. ([Treasury FS AI RMF and AI Lexicon (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/treasury-fs-ai-rmf-and-ai-lexicon-2026))
- Jan 12, 2026 — NIST CAISI agent-security RFI: First federal workstream on AI agents as such. ([CAISI RFI on AI agent security (2026)](https://www.bankingnewsai.com/ai-regulation/documents/nist-caisi-rfi-ai-agent-security-2026))
- Dec 11, 2025 — FSOC AI Working Group: 'Harnessing AI' becomes a Council priority. ([FSOC 2025 Annual Report](https://www.bankingnewsai.com/ai-regulation/documents/fsoc-annual-report-2025))
- Dec 10, 2025 — Basel third-party principles: Nth-party and concentration risk for AI and cloud. ([BCBS Third-Party Risk Principles (Dec 2025)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-third-party-risk-principles-2025))
- Sep 25, 2025 — EBA: 92% of EU banks deploy AI: 55% use general-purpose or agentic AI with consumers. ([EBA report: Rising application of AI in EU banking and payments (Sep 2025)](https://www.bankingnewsai.com/ai-regulation/documents/eba-ai-adoption-report-2025))
- Dec 19, 2024 — Treasury RFI report: Review each use case before deployment; regulators to clarify expectations. ([Treasury AI in Financial Services report (Dec 2024)](https://www.bankingnewsai.com/ai-regulation/documents/treasury-ai-financial-services-report-2024))
- Nov 14, 2024 — FSB: six AI vulnerabilities: Includes misaligned AI systems and provider concentration. ([FSB AI financial stability report (Nov 2024)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-financial-stability-implications-of-ai-2024))
- Nov 13, 2024 — FinCEN deepfake alert: AI-generated identities at account opening. ([FIN-2024-Alert004 (Deepfake Media)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2024-deepfake-media))
- Jul 26, 2024 — NIST AI 600-1: Twelve generative-AI risks, 200+ actions. ([NIST AI 600-1 (Generative AI Profile)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-600-1))
- Jul 12, 2024 — EU AI Act published: Credit scoring high-risk; logging and human oversight by design. ([Regulation (EU) 2024/1689](https://www.bankingnewsai.com/ai-regulation/documents/eu-ai-act-regulation-2024-1689))
- Mar 27, 2024 — Treasury AI cyber and fraud report: Capability gap, fraud data divide, data supply chain. ([Treasury AI cybersecurity risks report (Mar 2024)](https://www.bankingnewsai.com/ai-regulation/documents/treasury-ai-cybersecurity-risks-report-2024))
- Jun 7, 2023 — SR 23-4 third-party guidance: The framework that reaches vendor AI. ([SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4))
- Jun 6, 2023 — CFPB on bank chatbots: Every top-10 bank runs one; duties apply 'regardless of technology'. ([CFPB Chatbots in Consumer Finance (issue spotlight, 2023)](https://www.bankingnewsai.com/ai-regulation/documents/cfpb-chatbots-in-consumer-finance-2023))
- Jan 26, 2023 — NIST AI RMF 1.0: Govern–Map–Measure–Manage becomes the shared vocabulary. ([NIST AI RMF 1.0](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-100-1))

See also: [the control plane](https://www.bankingnewsai.com/agentic-banking/control-plane), [the lifecycle](https://www.bankingnewsai.com/agentic-banking/lifecycle), [what regulators say about AI agents](https://www.bankingnewsai.com/agentic-banking/regulation), [the build map](https://www.bankingnewsai.com/agentic-banking/build).

## FAQ

### What is an operating system for AI agents in a bank?

The shared set of controls every AI agent runs on, rather than controls re-implemented per use case: governance and accountability, agent identity and entitlements, an action gateway that limits what agents can do, entitlement-aware data access with lineage, model and vendor management, a sandboxed and budgeted runtime, observability and audit, and human oversight with escalation. The term is a design goal — no regulator prescribes it — but each layer maps to documents supervisors already cite.

### Are AI agents covered by bank model risk management?

Not in the United States since April 17, 2026. The revised interagency model risk guidance (SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026) says generative and agentic AI models are outside its scope and must be managed through broader risk-management and governance programs. The traditional models an agent calls — credit, fraud, liquidity — remain in scope, and vendor-supplied agents fall under third-party guidance (SR 23-4). The agencies have promised a request for information on AI and model risk.

### What autonomy level do banks actually run today?

Mostly levels 1 and 2 — drafting and acting with approval. The OCC reported in May 2026 that bank use of generative and agentic AI is primarily productivity and customer-experience tools with guardrails and human-in-the-loop accountability. The UK's 2024 survey found 2% of use cases fully autonomous. Level 3, acting within a pre-approved envelope, is emerging in fraud and security operations, where supervisors are most encouraging.

### What do regulators say about agentic AI specifically?

Four things, consistently. It is not yet inside model risk guidance (Fed, OCC, FDIC). Human oversight must scale up with autonomy (FSB Sound Practice 10, EU AI Act Article 14, Colorado). Agent-specific security — prompt injection, memory poisoning, AI-generated code — is an active workstream (NIST CAISI, DFS, the ESAs). And frontier models' autonomy is now a financial-stability topic (FSB Chair's August 2026 letter).

### Which documents should an AI agent program cite?

For US banks: SR 26-2 / Bulletin 2026-13 for the models inside the agent and the carve-out around it; SR 23-4 for vendor AI; NIST AI 600-1 for generative-AI risks; the CAISI agent-security RFI for agent-specific threats; Treasury's FS AI RMF as the assessment template. Internationally: the FSB's 12 sound practices, the Basel third-party principles, BCBS 239 for data, the EU AI Act's Articles 12, 14 and 26, and the ESAs' July 2026 statement under DORA.

---

Canonical page: https://www.bankingnewsai.com/agentic-banking
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (43 authorities, 244 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.