As AI systems move from generating answers to taking actions, financial institutions are discovering that the most important technology investment may not be the agent itself, but the control infrastructure surrounding it.
For most of the past decade, the central question in financial AI was whether a model could make a prediction accurately enough to improve a business process. Credit scoring, fraud detection, customer segmentation and transaction monitoring all fitted that pattern. The model produced an output; a person or a conventional application then decided what to do with it. Agentic AI changes that architecture. An AI agent can interpret a goal, choose tools, retrieve data, call external systems, sequence tasks and potentially initiate actions without a human approving every intermediate step.
That shift matters disproportionately in finance because actions can move money, alter customer records, approve access, trigger investigations or affect regulated decisions. The joint Bank of England and FCA survey found that 75% of responding firms were already using AI in 2024, while 55% of reported AI use cases involved some degree of automated decision-making. Yet only 2% were described as fully autonomous. That gap helps explain why institutions are investing first in governance, identity, monitoring and model-risk infrastructure: autonomy is advancing faster than the control assumptions built for earlier generations of software.
From Model Governance to Action Governance
Traditional model-risk frameworks are designed around a relatively bounded object: a model with defined inputs, outputs, owners, validation procedures and intended uses. Agentic systems are harder to contain because a single task may involve several models, retrieval systems, APIs, databases and third-party services. Risk therefore moves beyond whether a model is statistically sound. Institutions must also govern what the system is permitted to do, which data it may access, which tools it may call, how much authority it has and what happens when its reasoning takes an unexpected path.
This is why an AI control layer is emerging as an architectural concept. It is not one product. It is the collection of services that sit between AI systems and the institution’s critical data and execution environments: identity and access management, policy enforcement, prompt and tool controls, model inventories, approval thresholds, logging, monitoring, validation, data-loss prevention, human escalation and incident response. NIST’s AI Risk Management Framework already frames AI risk across governance, mapping, measurement and management rather than as a narrow model-performance problem. Its generative-AI profile extends that logic to risks such as confabulation, information security, data privacy and human over-reliance.
The First Control Problem Is Identity
A conventional employee has a user account, role, permissions and an auditable history. A software service has a service identity, credentials and narrowly defined access. An autonomous agent sits awkwardly between the two. It may operate on behalf of a person, a team or a business process; switch between applications; create sub-tasks; and use tools whose permissions were originally designed for deterministic software. That creates a basic question: whose authority is the agent exercising?
Financial institutions therefore need machine identity to become more granular. An agent should not inherit unrestricted access merely because its human sponsor has it. Controls may need to bind permissions to a specific purpose, task, transaction value, geography, customer segment or time window. High-risk actions can require step-up authentication or human approval. The objective is to make delegated authority explicit, revocable and reviewable before agents become capable of acting across multiple systems.
Tool Use Is Where AI Risk Becomes Operational Risk
A language model that produces an incorrect summary creates one class of problem. A model that can call a payment API, modify a standing instruction or release confidential information creates another. The moment AI gains access to tools, model risk becomes entangled with cyber risk, fraud risk, conduct risk and operational resilience.
This is one reason regulators are focusing less on whether firms use AI and more on how they govern it. In June 2026, the FCA reiterated that it expects firms to rely on existing frameworks, including the Consumer Duty, the Senior Managers and Certification Regime and established governance and control expectations. It specifically highlighted oversight, testing, monitoring and fair customer outcomes.
A practical control layer can restrict which tools an agent sees, validate parameters before execution, check outputs against policy, impose transaction ceilings and route exceptions to humans. It can also prevent an agent from combining individually permitted actions into a prohibited sequence. This is important because agent failures may be compositional: no single step looks dangerous, but the chain of steps produces an unacceptable outcome.
Financial Institutions Already Have a Foundation: Model Risk Management
Banks are not starting from zero. The discipline of model risk management already provides concepts that translate well to agentic AI: inventory, ownership, independent validation, monitoring, change control, materiality and escalation. In April 2026, the Federal Reserve, OCC and FDIC issued revised model-risk guidance that superseded SR 11-7 and emphasised a risk-based approach tailored to the nature, scale and use of models. The revised framework also highlights vendor and third-party products, an increasingly important issue as institutions consume foundation models and AI services from external providers.
But agentic systems stretch the model-risk perimeter. A model can behave acceptably in testing while the surrounding workflow fails because of permissions, orchestration, stale context or a bad external tool. Validation therefore has to move from model-only testing toward end-to-end scenario testing. Institutions need to know not just whether the model answers correctly, but whether the whole system behaves safely when data are incomplete, tools fail, prompts are manipulated or two agents pursue conflicting objectives.
Why Observability Becomes a Core Financial Control
Autonomous systems are difficult to govern if their actions cannot be reconstructed. Banks therefore need detailed event trails showing what an agent was asked to do, what information it accessed, which models and tools it called, what decisions it made, which policies were applied and where humans intervened. This is more than technical telemetry. It is the foundation for audit, dispute resolution, compliance investigation and post-incident learning.
The Bank of England has noted that growing AI adoption can introduce risks through model complexity, third-party dependencies and concentration. Its 2024 survey found that one-third of AI use cases relied on third-party implementations, while firms reported materially lower levels of complete understanding for externally provided models. That makes observability especially important: a bank may not be able to inspect every component of a vendor model, but it still needs evidence about how the system behaved inside its own environment.
Third-Party Concentration Raises the Stakes
The control-layer argument is also an infrastructure argument. Foundation models, cloud platforms, vector databases, agent frameworks and cybersecurity services are often provided by a relatively small set of vendors. The same Bank of England and FCA survey found notable concentration among third-party cloud, model and data providers. If many institutions build agents directly around provider-specific capabilities without a governing abstraction layer, switching costs and dependency can deepen.
A well-designed control layer can reduce some of that dependency by separating institutional policies from any one model provider. Model routing, permissioning, redaction, logging and approval logic can remain under the institution’s control even when the underlying model changes. This does not eliminate concentration risk, but it can make the architecture less brittle and reduce the risk that governance has to be rebuilt whenever a model or vendor changes.
Human Oversight Has to Be Designed, Not Assumed
“Human in the loop” is often treated as a universal safeguard, but it can become superficial when agents operate at machine speed or generate too many alerts for meaningful review. Effective oversight requires deciding which actions genuinely require human judgment, what information the reviewer receives, how much time they have, and whether they can understand the basis of the system’s recommendation.
The Bank of England has observed that current AI use in finance remains concentrated in lower-materiality applications, even as adoption increases. That cautious pattern is rational. Institutions can learn how to govern AI in internal productivity, cybersecurity and fraud workflows before delegating authority in areas such as lending, trading, payments or customer remediation.
Control Layers Also Solve a Speed Problem
Governance is often presented as a brake on innovation. In practice, the absence of reusable controls can slow deployment. If every AI project needs to reinvent access rules, legal review, testing, monitoring and escalation, pilots remain isolated. A common control layer creates a repeatable route from experimentation to production. Developers know the guardrails in advance; risk teams can approve standard patterns; and business owners can see which forms of autonomy are permitted.
This is similar to what happened with cloud computing. Early adoption was often slowed by uncertainty about data location, access, resilience and vendor risk. Over time, common landing zones, policy-as-code and standard security patterns turned governance into infrastructure. AI is likely to follow a similar path. The institutions that scale agents safely may be those that make controls programmable rather than relying on manual committees for every deployment.
The Counterargument: Too Much Control Can Freeze Useful AI
There is a genuine risk of over-engineering. An institution can build such an elaborate approval structure that low-risk AI use cases become uneconomic. Not every agent needs the same level of control, and a research assistant that drafts an internal memo should not be governed like an agent that can approve a payment or alter a credit decision. Risk-based proportionality is therefore essential.
This is consistent with both modern model-risk practice and broader AI governance. The Federal Reserve’s 2026 guidance stresses that model-risk practices should reflect a bank’s risk profile and model usage, while the FCA has favoured existing outcomes-based frameworks rather than a separate prescriptive AI rulebook.
The better architecture is therefore tiered. Low-impact agents may operate with broad freedom inside a sandbox. Medium-risk agents may require policy checks and detailed logging. High-impact agents may need independent validation, narrow permissions, human approval and continuous monitoring. The control layer becomes valuable precisely because it can enforce different levels of autonomy without forcing every use case through the same process.
What This Means for Banks, Fintechs and Technology Providers
For banks and insurers, the competitive question is shifting from who has access to the strongest model to who can connect models safely to proprietary data and real business processes. Foundation models are increasingly commoditised; controlled access to accounts, customer information, workflows and transaction systems is not. Institutions with strong identity, data governance and model-risk capabilities may therefore be able to adopt more powerful agents with less incremental risk.
For fintechs and software vendors, the opportunity lies in the infrastructure between models and execution. Products that provide policy enforcement, model gateways, evaluation, audit trails, agent identity, secure tool access and continuous monitoring may become as important as the models themselves. Vendors will also face higher expectations around transparency and resilience as institutions seek evidence they can integrate into their own control frameworks.
For regulators, the challenge is to preserve accountability when decisions are distributed across models, agents, tools and providers. The BIS has highlighted that AI adoption can amplify existing risks around confidentiality, model reliability and reputation even inside central banks. The same logic applies across the financial system: institutions can outsource technology, but not responsibility for outcomes.
The Strategic Sequence: Controls First, Autonomy Second
The most important feature of agentic AI is not that it can generate better language. It is that software is acquiring agency: the ability to choose actions, use tools and pursue goals across systems. In finance, that changes the unit of governance from the model to the entire chain of authority and execution.
That is why control layers are being built before widespread deployment of fully autonomous agents. Institutions need a way to identify agents, limit permissions, inspect decisions, validate workflows, manage vendors, enforce policy and stop activity when something goes wrong. These capabilities are not evidence that financial institutions are resisting AI. They are the precondition for using more of it.
The next phase of financial AI is therefore likely to be defined by a paradox: the institutions that give machines more autonomy may first need to impose more structure. The winners may not be those that launch the most agents fastest, but those that create the control infrastructure that makes autonomy safe enough to scale.
References
1. Bank of England and FCA – Artificial intelligence in UK financial services (2024)
4. FCA – AI in financial services: shaping our approach through industry engagement (2026)
5. FCA – Artificial intelligence in financial services
6. NIST – AI Risk Management Framework 1.0
7. NIST – Generative AI Profile for the AI Risk Management Framework
8. Federal Reserve – Revised Guidance on Model Risk Management, SR 26-2 (2026)
9. Federal Reserve – Supervisory Guidance on Model Risk Management (2026)