Global banking regulators are intensifying their examination of how financial institutions deploy artificial intelligence, warning that autonomous software agents, cyber vulnerabilities, and shared third-party technology dependencies could threaten global financial stability. On October 15, 2026, the Basel-based Financial Stability Board (FSB) published a final report establishing 12 non-binding practices for responsible AI adoption across the banking sector. Simultaneously, three major financial authorities in the United States, including the Federal Reserve, are actively questioning lenders about their deployment of advanced AI models, according to The Japan Times.

The parallel initiatives reflect a growing consensus among central banks and financial supervisors that rapid advances in generative and agentic AI require updated operational guardrails. While financial institutions have relied on machine learning and statistical models for years, the shift toward autonomous software agents and complex foundation models introduces distinct operational and systemic challenges. Regulators are particularly focused on the risk of cyberattacks, unexpected behavior by autonomous software agents, and the concentration of external technology providers supplying the banking industry.

Inside the FSB’s 12 Sound Practices

Chaired by Bank of England Governor Andrew Bailey, the FSB coordinates international financial authorities and central bank experts across 24 countries and jurisdictions, while conducting outreach with approximately 70 additional jurisdictions. The board’s final report follows a public consultation that ran from June 10, 2026, to July 22, 2026, which generated around 160 responses from industry stakeholders across various sectors and regions.

Rather than establishing a rigid, binding international standard, the FSB designed the 12 sound practices as a flexible toolkit. The framework is split into two primary categories covering organization-wide governance and lifecycle risk management. Financial institutions are encouraged to integrate these controls into their existing frameworks for cybersecurity, information and communication technology, and third-party vendor management.

According to the FSB final report, the core components of the guidance include:

  • Strategic Direction and Governance: Corporate boards and senior management are urged to align AI adoption directly with their institution’s specific business model and risk appetite, establishing clear lines of accountability and organizational adaptability as technology evolves.
  • Materiality and Model Selection: Banks should systematically assess the risk and materiality of AI use cases from inception, selecting systems that match both their technical needs and risk tolerance.
  • Data Governance and Explainability: Institutions are expected to maintain accurate, reliable, and secure data for training and testing models. Where feasible, banks should prioritize explainable AI models or implement compensating controls, while providing appropriate transparency to stakeholders.
  • Performance Monitoring and Human Oversight: The framework emphasizes ongoing performance evaluations and testing proportionate to a model’s complexity, alongside effective human oversight mechanisms.

Focus on Agentic AI and Human Oversight

A primary focus of the finalized guidance is the emergence of agentic AI—software systems designed to autonomously pursue complex goals and execute multi-step actions with minimal human intervention. Following the summer consultation period, the watchdog significantly refined its stance on how banks should view and manage these autonomous systems.

According to Reuters, the FSB removed draft language from its earlier June report that had characterized AI agents as “synthetic employees.” In the final October document, the board warned that AI agents do not reason like humans and are capable of interpreting pre-defined goals in unexpected ways.

To mitigate the risk of rogue or malfunctioning agents disrupting banking operations or markets, the final report calls for heightened human oversight in higher-risk deployments. Specifically, the FSB recommends that financial institutions implement clear, risk-based triggers that force an AI agent to pause and seek explicit human approval before executing critical actions.

U.S. Supervisory Inquiries and Systemic Concerns

While the FSB provides the overarching international framework, national regulators are conducting direct fact-finding missions at the institutional level. Six people familiar with the matter told The Japan Times that banking watchdogs are stepping up efforts to contain AI risks, with two of those sources noting that three top U.S. regulators—including the Federal Reserve—are actively quizzing domestic banks on their deployment of advanced AI models.

Supervisory discussions have highlighted concerns that frontier AI advancements may require banks to make costly investments in cyber recovery capabilities and look more closely at their reliance on external technology providers. If multiple major financial institutions rely on the same underlying foundation models, data providers, or cloud infrastructure, a single technical failure or targeted cyberattack could ripple across the broader financial system.

Despite the heightened attention, regulatory reactions remain in an exploratory phase rather than an enforcement crackdown. The FSB characterizes its finalized list of practices as non-binding guidance meant to be applied proportionately, while Reuters reports that banking watchdogs are currently focused on gathering information from lenders and are not yet being prescriptive about specific operational mandates.

What This Means for Banks and Consumers

For financial industry executives, compliance officers, and engineering teams, the message from global supervisors is that AI governance cannot be isolated within IT departments. Even without new binding regulations on the books in the United States, the alignment between the FSB’s toolkit and ongoing inquiries by the Federal Reserve signals what examiners will look for during routine supervisory reviews. Banks deploying generative or agentic tools will need documented materiality assessments, audit trails for training data, and demonstrable human-in-the-loop override switches.

For banking consumers, the regulatory push centers on institutional resilience and decision transparency. By pressing banks to favor explainable AI models and establish human approval triggers for high-risk actions, supervisors aim to prevent automated glitches from freezing payment networks, mismanaging accounts, or making unaccountable decisions in areas like fraud detection and customer service.

How will U.S. banking agencies enforce these AI practices?

The FSB’s 12 sound practices represent global, non-binding guidance rather than enforceable U.S. law. According to Reuters, regulators including the Federal Reserve are currently questioning banks to gather information rather than issuing prescriptive rules. However, U.S. supervisors frequently expect banks to manage emerging technologies through existing risk management, cybersecurity, and third-party vendor oversight frameworks.

What criteria require an AI system to seek human approval?

Under the FSB framework, the intensity of human oversight should be tied to the materiality, complexity, autonomy, and explainability of the specific AI tool. For higher-risk agentic AI use cases—where software can act autonomously—the FSB recommends establishing predefined, risk-based triggers that require the software agent to halt and obtain human authorization before proceeding.

How are regulators addressing banks’ reliance on external AI vendors?

Both the FSB report and ongoing national inquiries highlight third-party dependencies as a primary systemic risk. Regulators are encouraging financial institutions to fold AI vendor assessments directly into their existing third-party risk management and cyber-resilience frameworks to guard against outages or vulnerabilities at shared technology providers.

Sources

Read More