Updated 16 October 2026
In brief: Banks are moving AI agents from drafting text to acting in KYC, AML, credit and payments. In April 2026 the US banking agencies replaced SR 11-7 with SR 26-2. Model validation alone no longer controls what an agent does at run time. This guide sets out the Bank Agent Control Set (five controls every bank needs), how to compare governance platforms, and a six-step path from shadow mode to bounded autonomy.
Who this is for: Chief Risk Officers, Chief Compliance Officers, heads of model risk and CIOs deciding how far AI agents may act in regulated banking workflows.
AI agent governance for banks is the set of controls that decide what an AI agent may see, what it may do, who must approve it, and what record it leaves, so that every agent action can be defended to a risk committee, an auditor or a regulator. In 2026 it has moved from a policy topic to an operating requirement, because agents are no longer only answering questions. They are opening cases, clearing alerts and changing records.
It covers what changed, what to control, and how to compare tools on the two capabilities that matter most: runtime policy enforcement and audit evidence.
What changed for banks in 2026
- Agents act. A model that drafts text can be reviewed before use. An agent that calls systems has already acted by the time anyone looks.
- Model risk guidance was revised. In April 2026 the US banking agencies issued SR 26-2, Revised Guidance on Model Risk Management, replacing SR 11-7. The guidance itself states that generative AI and agentic AI models are not within its scope, so banks have to govern agents with their own controls. Take your own compliance advice on how this applies to you.
- UAE banks have explicit expectations. The Central Bank of the UAE's February 2026 guidance note on AI expects licensed institutions to keep an inventory of AI models, report regularly to senior management and the board, and keep the clear and immediate ability, with human intervention, to stop using an AI model.
- Explanations are still owed. Duties to explain decisions to customers and supervisors do not relax because an agent was involved.
- Volume outruns review. Sampling a few outputs by hand does not scale once agents handle routine work across many cases each day.
The practical result: banks cannot rely on model validation alone for agents. They need controls that work at the moment of each action.
Why traditional model governance is not enough
| Traditional model governance | AI agent governance | |
|---|---|---|
| Unit of control | The model | Each decision and action |
| When control applies | Before deployment, then periodically | At run time, every time |
| Behaviour | Fixed inputs and outputs | Plans steps, chooses tools, varies by context |
| Evidence | Validation reports | A record of each decision |
| Main risk | The model is wrong | The agent does something it had no authority to do |
What controls does a bank need for AI agents?
We call these five controls the Bank Agent Control Set.
- Agent identity and scoped access. Each agent has its own identity and only the data and tools its task needs.
- Governed context. The agent is given current, authoritative data and the right version of each policy. See context rot for what goes wrong otherwise.
- Runtime policy enforcement. Limits, approvals and prohibitions are checked by the platform before an action executes. See AI policy enforcement for enterprise agents.
- Human authority. Clear rules for what an agent may do alone, what a person approves, and how a person can stop it.
- Audit evidence. A complete, tamper-resistant record of each decision. See how decision traces build trust and how AI agent audit trails support bank compliance.
Start with an inventory. In a one-day agent control review we list your agents and the decisions they touch, check each against the Bank Agent Control Set, and show where the gaps are before a supervisor asks.
How to evaluate AI agent governance platforms
| Capability | What to ask the vendor | Warning sign |
|---|---|---|
| Runtime policy enforcement | Is the rule checked by the platform before the action, or only requested in the prompt? | "The model is instructed to follow policy" |
| Audit evidence | Can you show, for one past decision, the inputs, rule version, approver and outcome? | Only raw logs or summaries |
| Policy versioning | Can a decision be judged by the rule in force that day? | Rules are overwritten |
| Human approval | Can approval thresholds be set per decision type and changed without code? | Approval is all or nothing |
| Access control | Are agent permissions scoped per task and per customer data class? | One service account for all agents |
| Deployment and residency | Can it run in our environment and region? | Data must leave your boundary |
| Integration | Does it work with our core banking, case management and data platforms? | Requires replacing them |
| Graduated autonomy | Can an agent move from supervised to independent on evidence, and back? | A single on/off switch |
For a market view, see enterprise AI agent governance platforms.
Where banks are using governed agents
- KYC and onboarding: collecting documents, tracing ownership, preparing files for analyst decision.
- AML alert handling: gathering evidence and drafting case narratives, with clear limits on what can be closed without a person.
- Credit operations: assembling applications and checking policy conditions before a human decision.
- Payments and reconciliation: matching and exception handling within tolerances.
- Regulatory reporting: preparing figures with lineage back to source.
A phased path
- Inventory. List every agent, its owner, the systems it touches and the decisions it influences.
- Classify. Rank decision types by risk and set who may approve what.
- Shadow. Run agents alongside staff, recording decisions without acting.
- Supervised. Let agents act after approval, with full records.
- Bounded. Allow independent action on low-risk types within limits.
- Review. Report blocks, escalations and reversals to the risk committee and adjust.
Questions for your board risk committee
- How many AI agents do we run today, and who owns each one?
- Which customer-facing or regulated decisions do they make or prepare?
- For any decision last month, can we show the data, rule version and approver within a day?
- Which actions can an agent take without a person, and where is that written down?
- How quickly can we stop an agent and reverse its actions?
Common mistakes
- Treating agent governance as an extension of the model inventory.
- Relying on prompts as controls.
- Keeping logs that engineers can read but auditors cannot.
- Giving agents broad access "for now".
- Leaving ownership of each decision type unclear between business, risk and technology.
Related: the same controls apply in the public sector, where agents act on behalf of the state. See Agentic AI in Government: 5 Controls Public Leaders Need.
How ElixirData supports banks
ElixirData's Context OS checks policy at two points, before an agent reasons and before it acts, and records every decision as a Decision Trace. It runs alongside existing core systems. See banking and financial services.
Frequently asked questions
What is AI agent governance?
The controls that determine what an AI agent may access and do, who approves its actions, and what evidence it leaves.
Does model risk management cover AI agents?
Its principles remain useful, but validation of a model before deployment does not control what an agent does at run time. Banks need action-level controls as well. Confirm the position for your jurisdiction with your compliance team.
Who should own AI agent governance in a bank?
Typically risk and compliance own the rules, technology owns the platform, and each business line owns its decision types, under a shared committee.
What evidence will an auditor ask for?
For a sampled decision: what the agent was asked, what data it used, which policy applied, what it did, who approved it, and the outcome.
Can a bank let agents act without human approval?
For low-risk, well-bounded decision types with a record of correct handling, it can be appropriate, within limits the risk committee sets. Higher-risk decisions stay with people.
Can it run in our own environment, alongside our core systems?
Yes. Context OS supports in-country deployment with data residency controls and tenant isolation, and connects to existing data platforms through integrations rather than replacing core banking or case-management systems.
Book a one-day agent control review →
Prefer to see it first? Request a demo of governed agents on banking workflows.
Related on ElixirData: Risk & Compliance · Banking & Financial Services
Sources
- Board of Governors of the Federal Reserve System, SR 26-2: Revised Guidance on Model Risk Management, 17 April 2026, and the guidance attachment.
- Central Bank of the UAE, Guidance Note on Consumer Protection and Responsible Adoption and Use of AI/ML, February 2026.
This article is general information, not legal or regulatory advice.
