A broad coalition of U.S. and international regulators is coalescing around a common oversight framework for AI-powered workflow agents in banking. The effort signals a shift from fragmented, sector-specific guidance toward cross-jurisdictional standards governing autonomous systems that handle document routing, customer verification, and automated loan approvals. The initiative draws on recent enforcement actions, industry feedback, and overlapping international guidance to establish consistent controls over model provenance, decision-making guardrails, and incident response - with direct compliance obligations for both banks and their technology vendors.
Background
The urgency reflects a deepening tension: agentic AI has emerged as a defining technology trend of 2025 - autonomous systems capable of making decisions and executing complex tasks with limited or no human input - yet regulatory delay has left financial institutions navigating compliance obligations without explicit guidance.1Regulatory Roundup - November 2025: Oversight Tightens as AI, AML, and Geopolitics Converge
The regulatory environment surrounding agentic AI remains ambiguous. Existing frameworks regulating AI more broadly have yet to explicitly address agentic systems, and regulators have instead relied on general risk management principles applied by analogy. The proliferation of third-party AI vendors prompted regulators globally to issue comprehensive oversight requirements; the U.S. Interagency Guidance on Third-Party Relationships from June 2023 recognizes that AI models pose similar risks whether developed internally or purchased from vendors, requiring consistent oversight.
The governance gap remains acute. According to survey data cited by the Wisconsin Bankers Association, 97% of institutions surveyed lacked controls governing internal AI use, and 63% reported having no AI governance policy.2NIST Issues Preliminary Draft of Cyber AI Profile, a Framework Poised to Alter Security Operations in the AI-Driven Threat Landscape Internationally, the Financial Stability Oversight Council (FSOC) elevated AI as a significant area of focus in its December 2024 Annual Report, identifying increasing reliance on AI as both an extraordinary opportunity and a mounting risk demanding enhanced oversight.
Details
The regulatory convergence spans multiple jurisdictions and standard-setting bodies. In Germany, BaFin published guidance on ICT risks associated with AI use in December 2025, explicitly classifying artificial intelligence as part of ICT risk management under DORA - a classification that significantly increases requirements for governance, transparency, and accountability. Regulators expect AI systems to be fully integrated into existing ICT risk management frameworks, including identification, protection, detection, response, and recovery in accordance with DORA.
At the international level, the BIS published a report on AI use for policy purposes submitted to G20 Finance Ministers and Central Bank Governors in October 2025, while the FSB published a report outlining next steps for authorities on AI monitoring in the financial sector that same month. The EU AI Act reaches a significant enforcement milestone in August 2026, requiring organizations using high-risk AI - including credit scoring and automated loan approval systems - to demonstrate documented governance, risk controls, transparency, and human oversight, with real penalties for noncompliance.
In the United States, NIST released a preliminary draft of its Cyber AI Profile (NISTIR 8596) in December 2025, providing organizations including banks with a new roadmap for AI-specific risk management. The profile emphasizes human oversight of AI-mediated actions and extends supply chain diligence to cover data provenance and integrity. It calls for preserving logs, inputs, outputs, and decision chains to ensure provenance, as well as tracking datasets, versioning, and associated metadata. The draft also specifies AI-specific incident response procedures: containment (such as disabling model autonomy), triage (analyzing model logs), and recovery (restoring validated model versions).
Banking industry groups have engaged directly with this standardization effort. The Bank Policy Institute and peer associations submitted comments to NIST's CAISI initiative focused on two areas where standardization can accelerate adoption and strengthen supply chain risk management: documentation and controlled sharing for agent deployments, and secure interactions and automated integrations with counterparties. The comments noted that NIST's CAISI can play an important role in convening industry, researchers, and government to develop voluntary, consensus-based guidance.
For vendor relationships, regulators are moving toward requiring explicit contractual provisions. Regulators emphasize that institutions cannot outsource accountability: if a vendor's model is too opaque to validate, the institution must demand transparency or adopt alternatives. Organizations are expected to extend supply chain risk management to model and data supply chains, require AI-specific contract terms, conduct AI-relevant due diligence and continuous monitoring, and include key suppliers in incident planning and response.
Deloitte, in analysis published in March 2026, noted that regulatory frameworks for agentic AI in banking are still evolving. To scale agentic capabilities responsibly, banks should treat AI agents as active operators within their systems and design controls accordingly.
Outlook
AI oversight in financial services is moving toward a "sliding scale" approach, where regulatory scrutiny correlates with the risk, sensitivity, and potential impact of each use case - with AI used in credit scoring, loan approvals, and fraud detection facing the highest level of oversight. PwC analysis advises firms to ensure internal risk assessments and third-party contracts thoroughly address risks posed by new AI applications, including potential data leaks and bias, and to incorporate AI governance into existing third-party risk management, technology risk management, and model risk management frameworks rather than creating entirely new ones. NIST plans to release an initial public draft of the Cyber AI Profile in 2026, following its January 30, 2026 comment period close, with the finalized profile expected to map to the NIST AI Risk Management Framework.
