An AI agent that approves an exception or changes a customer record exercises authority on behalf of the institution. The board needs to know who granted that authority, what limits apply and who responds when the agent makes a mistake.
Banks and credit unions are encountering agentic AI through the platforms they already use for fraud operations, lending, collections and customer service. Unlike a tool that drafts an answer for someone to review, an agent can carry out a sequence of actions across systems. A product update can therefore change the institution’s risk exposure without looking like a new technology deployment.
The practical challenge is to bring those actions within existing governance. That requires a named owner, documented authority, controls around consequential decisions and evidence of what happened when the agent acted.
The challenge is already emerging in practice. In October 2026, Reuters reported that major US banks were blocking third-party AI agents from accessing customer accounts, amid concerns about agents taking actions beyond users' instructions. Meanwhile, Plaid CEO Zach Perret warned of growing fraud and security threats as AI platforms move from providing information to taking action.
These developments raise a critical governance question: how can financial institutions maintain control and accountability when AI agents act on behalf of customers or across organizational boundaries?
For a practical guide to connecting risk, controls and evidence across your institution, download Protecht’s Risk in motion eBook.
Accountability follows the activity
Using a vendor’s technology does not remove an institution’s responsibility for the activities it performs. US banking agencies’ third-party guidance and OSFI’s B-10 guideline place responsibility for managing those relationships with the institution. [1][2]
Their scope differs: the US interagency guidance applies to banks supervised by the issuing agencies, while OSFI’s guideline applies to federally regulated financial institutions. Credit unions need to assess the requirements of their own regulator.
In September 2026, the US banking agencies and NCUA proposed revised third-party guidance covering banks and credit unions. As of September 30, it remained a proposal; the agencies said existing banking guidance would be replaced when the new guidance was finalized. Institutions should distinguish that consultation from current expectations. [3]
The Financial Stability Board, the international body that monitors the global financial system, also released its final report on Sound Practices for Responsible Adoption of AI in October 2026, emphasizing the importance of organization-wide AI governance for financial institutions as well as providing its framework for managing risks when implementing AI or agentic AI.
Delegated authorities and approval matrices often assume that a person initiates each consequential action. An agent can operate outside those arrangements unless its permissions are explicitly mapped to them. For example, a service account may technically allow a payment or a record change even though nobody has approved that use of the agent. The gap lies between what the system permits and what management intended to authorize.
This review should happen before a capability is enabled. Bring the process owner, technology team and risk function together to compare proposed use with actual permissions. A pilot should have explicit limits and evidence requirements, including how staff will identify agent activity. Expansion should follow a review of exceptions and control performance, rather than a vendor’s release timetable.
Direct human oversight of consequential decisions
Oversight needs to reflect the action and its consequences. High-volume, well-defined tasks may be suitable for automation when limits, monitoring and escalation work reliably. Novel decisions, significant customer harm and actions that are difficult to reverse call for closer human involvement.
An agent processing routine cases can free staff to review anomalies and exceptions. That benefit depends on the quality of the handoff. Management should define what constitutes an exception, assign someone to review it and establish a response time that suits the potential harm. A queue that grows faster than staff can clear it creates a new operational weakness.
For each deployment, distinguish work governed by clear rules from work requiring judgment. Transaction volume alone does not make a task suitable for autonomous execution. An unusual dispute may require interpretation of an obligation or an assessment of customer vulnerability, even when it sits in a large processing queue. The agent can gather information while a person retains the decision.
Put authority and controls around each agent
There are several steps you should take to ensure agent management works effectively:
-
Start with an inventory of agents, whether built internally, bought separately or embedded in vendor platforms. Record an accountable owner, the actions each agent can perform, the systems it accesses and the authority it exercises. Ask vendors to explain which capabilities can act autonomously and how those capabilities are enabled or changed.
-
Document bounded authority through transaction limits, permitted actions, data-access restrictions and approval requirements. An agent that can update a customer address need not also be able to change payment details. Review permissions when its purpose changes, and test whether the technical restrictions enforce the limits management approved.
-
Design escalation around confidence, financial value, unusual activity and customer-harm indicators. The receiving team needs enough information to assess the case and enough capacity to respond. Test that handoff with realistic exceptions before expanding deployment.
-
Keep records that support an investigation: the information available to the agent, its output and action, the authority under which it operated, and any approval or notification. The record should distinguish an agent’s recommendation from an action executed by a person or another system. Retention and access controls also need to reflect the sensitivity of customer information.
-
Test how to stop an agent and identify which actions can be reversed. Some effects cannot be fully undone, such as disclosing information to an unauthorized recipient. Those actions need stronger prevention and approval controls. A shutdown procedure should specify who can invoke it and how service continues while the agent is unavailable.
-
Extend risk appetite to autonomous action by defining acceptable uses, prohibited activities and tolerances for errors and escalation. Review those limits against incident experience and changes in the vendor’s capabilities. US agencies’ revised model-risk guidance expressly excludes generative and agentic AI from its scope, while directing banks to govern such tools through their broader risk-management practices.[4]
Questions for the board
Directors should ask whether the agent inventory includes capabilities embedded by vendors and whether each has an owner and approved authority. They should also understand who decides which actions require human judgment, what agents escalated during the reporting period, and whether shutdown and recovery arrangements have been tested. A lack of escalations warrants investigation: it may reflect reliable processing, weak thresholds or failures in the handoff.
Next steps for your organization
Agentic AI can affect operational, third-party, compliance and customer risks at the same time. You need to link each deployment to the processes it supports, the obligations those processes must meet and the controls that limit its actions.
Incidents and near misses then become evidence for reviewing both the agent and the surrounding process. This gives management a practical basis for explaining who was accountable, what authority applied and whether the controls worked.
Governing agents requires a clear relationship between their authority, the processes they affect and the controls around their actions. Protecht connects risk assessments, controls, obligations, incidents and remediation workflows, helping teams record ownership, review exceptions and report the evidence supporting their oversight of autonomous activity.
Request a Protecht demo to see how connected risk and compliance workflows can support the decisions your institution needs to make.
Additional resources
Managing AI risks: Turning uncertainty into advantage: Discover how Protecht’s AI governance solution centralises AI oversight, aligns with ISO 42001 and the EU AI Act, and integrates AI risk into enterprise GRC.
AI project governance checklist: Assess your AI project risks with our structured governance checklist. Identify gaps, strengthen oversight, and align with global AI standards.
References
[1] US banking agencies, Third-Party Risk Management: A Guide for Community Banks, May 2024. https://www.federalreserve.gov/publications/third-party-risk-management-a-guide-for-community-banks.htm
[2] OSFI, Guideline B-10, Third-Party Risk Management. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline
[3] US agencies, Proposed Third-Party Risk Management Guidance, September 11, 2026. https://www.federalreserve.gov/newsevents/pressreleases/bcreg20260911a.htm
[4] US banking agencies, Revised Guidance on Model Risk Management, April 17, 2026. https://www.federalreserve.gov/frrs/guidance/supervisory-guidance-on-model-risk-management.htm