How does the FSB regulate AI in banking?

The FSB has tracked AI in finance since a 2017 report on AI and machine learning, but its work accelerated after generative AI: a November 2024 report assessed the financial-stability implications of AI (third-party concentration, correlated models, cyber, and market herding), and an October 2025 report gave authorities concrete indicators for monitoring AI adoption and flagged the sector's reliance on a small number of critical AI suppliers.

The June 2026 consultation, 'Sound Practices for the Responsible Adoption of AI,' is the closest the FSB has come to firm-level expectations: 12 practices covering governance, risk management, and oversight of AI — including agentic AI, whose capacity to act autonomously and at speed the FSB singles out as a risk that can outpace human oversight. National supervisors typically translate FSB sound practices into examination expectations.

What does the FSB say about AI governance in financial services?

The Financial Stability Board's position on AI governance is set out in its June 10, 2026 consultation 'Sound Practices for Responsible Adoption of Artificial Intelligence', which proposes twelve sound practices for financial institutions and puts governance first: boards and senior management should set the strategic direction for AI and oversee it (Sound Practice 1), accountability for AI outcomes should be clearly assigned (SP2), AI risks should sit inside the enterprise risk-management framework rather than beside it (SP3), and the organisation should build the skills and resourcing to adapt (SP4). The lifecycle practices that follow — materiality-based risk assessment, model selection, data governance, explainability, performance management, human oversight with extra measures for highly autonomous agentic AI, cyber and ICT controls, and third-party AI risk (SP5–SP12) — are the governance programme in operation. The practices are proportionate, apply to traditional, generative and agentic AI, and are deliberately consistent with what the FSB's November 2024 stability report identified as the vulnerabilities to govern: third-party concentration, correlated models, cyber risk, model and data governance gaps, fraud, and misaligned systems. The final report is due in October 2026 as a deliverable to the US G20 presidency, and the FSB Chair's August 31, 2026 letter added frontier-model autonomy and cyber capability to the list of what boards must now oversee.

The FSB's AI governance work is nine years old, but the operative document is the June 2026 consultation. The 2017 report on AI and machine learning in financial services had already flagged opaque models, shared data sources that could correlate firms' behaviour and third-party providers that might become systemically important outside the regulatory perimeter. The November 2024 report re-ran that analysis for generative AI and settled on six vulnerabilities; the October 2025 monitoring report gave authorities indicators for each and found that generative AI runs on a handful of chip, cloud and model suppliers. The sound practices are the FSB's answer to the question those reports left open — what should each institution actually do — and they are written for boards, not data scientists.

Read together, the twelve practices describe one governance loop. The board sets direction and appetite (SP1) and assigns accountability (SP2); AI risk is measured inside the existing enterprise framework, not in a parallel AI committee (SP3); the institution invests in the skills to run it (SP4). Each use case is then assessed for materiality (SP5), given a model chosen for the job (SP6), fed governed data (SP7), made explainable to the degree the decision requires (SP8), monitored in production (SP9), and kept under human oversight that tightens rather than loosens as autonomy grows (SP10), with cyber (SP11) and vendor (SP12) controls wrapped around it. Vice Chair Bowman, who chairs the FSB committee that wrote them, framed the first question for any bank as whether an AI use is material to its operations or its legal obligations — proportionality is built in.

What changes after October 2026 is mostly emphasis, not obligation. The FSB cannot bind banks; national supervisors adopt its practices through their own guidance and examinations, and the US, EU and UK frameworks already say much the same in their own vocabulary. The direction of travel is toward agentic systems: the consultation pays 'specific attention to generative and agentic AI', Sound Practice 10 asks for extra human-oversight measures for highly autonomous agents, and the Chair's August 2026 letter to the G20 treats frontier models' autonomy and cyber capability as a stability concern in their own right. A bank that can map its AI programme to the twelve practices today will find the final report, and the supervisory questions that follow it, familiar.

WHAT THIS MEANS IN PRACTICE

• Map the bank's existing AI policy to the twelve practices by number and record the gaps; supervisors in several jurisdictions are expected to use the FSB list as an examination frame once the final report lands in October 2026.
• Put AI risk inside the enterprise risk framework and the board's risk appetite (SP1–SP3) rather than in a standalone AI committee that reports nowhere.
• Classify every AI use by materiality first (SP5, and Bowman's opening question); the control set follows from that, and lower-risk uses are allowed a lighter touch.
• Treat human oversight as scaling up with autonomy (SP10): define who can override an agent, at what threshold automation stops, and what the record shows afterwards.
• Apply the 2023 third-party toolkit to model, cloud and data vendors (SP12) — concentration among a few providers is the vulnerability the FSB has named most consistently since 2017.
• Read the Chair's August 2026 letter as a board-level cyber instruction: response and recovery capabilities and critical-provider resilience are what the FSB now expects to see tested.

What has the FSB actually published on AI?

Which of the 120 largest US banks answer to the FSB on AI?

13 of the 120 bank pages on this site name the FSB among the authorities their AI programme answers to. Each page lists the documents that apply and why.

• Final 'Sound Practices for Responsible Adoption of AI' report, expected October 2026 as a deliverable to the US G20 presidency — likely to become the global reference for bank AI governance
• What 'steps within its mandate' the FSB takes on frontier-AI cyber risk after the Chair's 31 August 2026 letter to the G20 — a possible work stream on model release, AI/cloud provider concentration and response-and-recovery expectations
• How the FSB resolves industry pushback in the 124 published consultation responses (proportionality, overlap with existing model-risk and third-party rules, treatment of agentic AI)
• Whether the FSB moves from monitoring to recommending policy action on AI third-party concentration
• National supervisors (ECB, PRA, OCC, Federal Reserve) importing the 12 sound practices into examination programs