# Taiwan FSC Agentic AI Security Consultation: Consultation Document on the Security of Agentic AI in the Financial Industry (金融業運用代理AI安全諮詢文件)

Source: https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-agentic-ai-security-2026
Last updated: Nov 12, 2026

On 13 October 2026 Taiwan's Financial Supervisory Commission published a consultation document on the security of agentic AI in the financial industry (金融業運用代理AI安全諮詢文件) and took comments for 30 days, to 12 November 2026, on the government's public participation platform. It proposes that institutions manage agentic AI by use case, classify each use case into one of four risk levels (L1 to L4) on three axes, and apply zero-trust security controls that treat an agent as a non-human identity able to act. The FSC says the document does not replace existing laws, supervisory rules, outsourcing management or internal controls, and that the comments will inform later policy, guidance and supervisory communication.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [Taiwan (FSC / MODA)](https://www.bankingnewsai.com/ai-regulation/taiwan) |
| Type | Consultation |
| Status | Comment period open |
| Published | Oct 13, 2026 |
| Comment deadline | Nov 12, 2026 |
| Applies to | Financial institutions supervised by the FSC that deploy agentic AI able to connect to, operate, change or trigger their operational systems. Personal AI assistants used only for office or development support within the user's existing permissions may follow existing internal controls. A consultation document: the FSC says it does not replace existing laws, supervisory rules, outsourcing management or internal control requirements. Published in Chinese; the English title is this tracker's translation |
| Official text | https://www.fsc.gov.tw/ch/home.jsp?id=2&parentpath=0&mcustomize=news_view.jsp&dataserno=202610130003&dtable=News |

## Key points

- Scope: agentic AI that can connect to, operate, change or trigger an institution's operational systems. Personal assistants for summaries, drafting, meeting notes or code suggestions may follow existing internal controls and need not apply the document item by item; if they can call tools on their own, reach data across systems, send data out, write to systems or trigger formal processes, or their use, data, tools, permissions or automation change materially, the institution should reassess whether they fall within scope.
- Governance (Chapter 3): the use case is the unit of management. For each one the institution defines the business purpose, division of responsibilities, accessible data, callable tools, permitted actions and output or write destinations, and how anomalies are handled, the agent disabled and its actions traced. Governance runs through five life-cycle phases, from planning and approval to change, exception and retirement.
- Risk classification (Chapter 4): an illustrative method that institutions may adapt to their own risk management. Each use case is rated on data sensitivity, action impact and capability boundary or propagation, and the highest of the three decides its level, from L1 (low) to L4 (high). The level does not fall because controls are in place, and it is reassessed when data, tools, destinations, permissions or the degree of automation change materially.
- On the action-impact axis, L4 covers use cases that may affect core financial business, core or highly important systems, transactions or payments, limits or permissions, irreversible actions, final compliance decisions, major customer rights or operational resilience. High-risk L4 actions must not be executed automatically without the necessary authorisation, review or blocking mechanisms.
- Go-live baseline (4.3): high-risk use cases, those able to advance a formal process, and those that send data out, write, run in batches, retry automatically, cross systems or delegate, complete security testing before formal use, covering prompt injection, tool misuse, privilege inheritance, memory poisoning, agent-to-agent communication, bypass of human-in-the-loop review, abnormal outbound transfer and batch propagation. Until the conditions are met, simulation, shadow running, draft or preview modes are advised.
- Security controls (Chapter 5): zero-trust principles (no default trust, continuous verification, least privilege, traceability) applied across identity, device and execution environment, network, application and workload, data, behaviour control, and visibility and analytics, with basic controls and advanced requirements for each. Five controllability goals recur: observable, limitable, blockable, recoverable and traceable.
- Common principles: an agent connected to operational systems must not bypass their existing authorisation, segregation of duties, transaction checks, record keeping, review and recovery mechanisms; human confirmation or review is kept for irreversible, high-impact or major customer-rights actions; and a use case that lacks the necessary records or cannot be disabled, revoked, recovered or traced should not be formally automated.
- Third parties and sources: third-party models, platforms, tools and services fall under existing outsourcing and supply-chain governance, with compensating controls or narrower use where a vendor's information or controls are insufficient. The document draws on the Five Eyes guidance 'Careful Adoption of Agentic AI Services', the OWASP Top 10 for Agentic Applications for 2026 (mapped in Appendix A), NIST IR 8587 and the Cloud Security Alliance's Agentic Trust Framework.

## What changed for banks

The document takes the FSC's AI work beyond the principles of the 2024 Guidelines and into agentic AI, with a tiering method, go-live conditions and numbered control items. It was issued as a consultation document because, the FSC says, agentic AI technology, deployment patterns and governance models are still developing fast. It creates no obligation; the FSC says it will draw on the comments in later policy work, guidance and supervisory communication.

## Use cases it governs

- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)

## FAQ

### What was the deadline for comments on the FSC's agentic AI consultation?

12 November 2026. The consultation ran for 30 days from publication on 13 October 2026, on the government's public policy participation platform (join.gov.tw).

### How does the FSC propose to classify agentic AI risk?

By use case, on three axes: data sensitivity, action impact, and capability boundary or propagation. The highest axis sets the level, from L1 (low) to L4 (high). L1 and L2 use cases apply the basic controls; L3 and L4 use cases also review the advanced requirements, and high-risk L4 actions must not run automatically without authorisation, review or blocking mechanisms.

### Does the consultation document bind banks?

No. The FSC states that it does not replace existing laws, supervisory rules, outsourcing management or the internal control requirements institutions already have, and that it is published as a basis for discussion and as a reference for later policy, guidance and supervisory communication.

### Is the document available in English?

The FSC published it in Chinese. The English title used here is a translation, and the summary is drawn from the Chinese text.

## Related documents

- [Taiwan FSC AI Attack Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-ai-attack-recommendations-2026) — Challenges and Strategic Recommendations for the Financial Industry in Responding to AI Attacks (金融業應對AI攻擊的挑戰與策略建議) (Jul 14, 2026)
- [Taiwan AI Risk Taxonomy and Assessment Framework](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-moda-ai-risk-framework-2026) — Artificial Intelligence Risk Taxonomy and Assessment Framework (Version 1.0) (Jul 7, 2026)
- [Taiwan AI Basic Act](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-ai-basic-act-2026) — Artificial Intelligence Basic Act (人工智慧基本法) (Jan 14, 2026)
- [Taiwan FSC AI Guidelines](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-ai-guidelines-2024) — Guidelines for Artificial Intelligence (AI) Applications in the Financial Industry (Jun 20, 2024)
- [Taiwan FSC AI Core Principles](https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-ai-core-principles-2023) — Core Principles and Policies for Artificial Intelligence (AI) Applications in the Financial Industry (Oct 17, 2023)
- [OCC Bulletin 2026-54](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-54) — Super Intelligence: Supervisory Framework (Nov 4, 2026)
- [HKMA discussion paper on banks' use of Agentic AI](https://www.bankingnewsai.com/ai-regulation/documents/hkma-agentic-ai-discussion-paper-2026) — Discussion Paper on Agentic A.I. Governance in the Banking Sector (Nov 2, 2026)
- [Machado interview with Bloomberg (Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ecb-machado-bloomberg-interview-2026-10) — Interview with Bloomberg — Pedro Machado (Oct 30, 2026)

Last reviewed Nov 12, 2026. Cite the official text (https://www.fsc.gov.tw/ch/home.jsp?id=2&parentpath=0&mcustomize=news_view.jsp&dataserno=202610130003&dtable=News) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/taiwan-fsc-agentic-ai-security-2026
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (46 authorities, 276 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.