Thesis: Banks are not struggling with agentic AI because the models are unreliable; they are struggling because governance architecture, who can authorise an action, what gets logged, and what a human must approve before it executes, is being treated as a compliance afterthought rather than a delivery workstream built alongside the agent itself.
The decision in front of you is not “which model”
A CTO or CFO signing off an agentic AI programme this year is not choosing between large language models. That decision was largely made two years ago, when copilots went into production across contact centres and research desks. The decision now is harder: how much autonomy to grant a system that can take a sequence of actions across core banking, KYC, and customer-facing systems with limited human review at each step.
Deloitte’s 2026 research on AI agent risk found that only around one in five organisations has a mature governance model for autonomous agents, even though roughly 74% expect at least moderate agent use by 2027. EY-Parthenon’s survey work with MIT puts adoption higher still: over 70% of banking firms report using agentic AI to some degree, with 16% describing it as fully deployed. Governance has not kept pace with either figure. That gap is what this guide is about: how to design the control layer so it is built alongside the agent from the start, rather than added once something has already gone wrong.
What “agentic” actually changes
A copilot answers a question or drafts a document inside a single turn, with a human reading every output before it goes anywhere. An agentic system plans a sequence of steps, calls tools or systems to execute them, and only surfaces to a human at defined checkpoints, if at all. Morgan Stanley’s AI @ Morgan Stanley Debrief sits at the supervised end of that spectrum: it generates meeting notes and follow-ups for financial advisors, and the firm reports raising document-retrieval accuracy across 100,000 proprietary research reports from around 20% to 80%. Every output still passes through a human advisor before a client sees it.
Morgan Stanley is now also piloting the other end of the spectrum: opening its ShareWorks and Equity Edge platforms to external AI agents that connect directly, bypassing the human-oriented interface entirely. That is the real inflection point for governance. The question stops being “did a human check this output” and becomes “what stops the agent from taking an action nobody authorised.”
The regulatory picture is not going to resolve this for you
Banks in the US, UK and EU are each operating with rules that were not written with autonomous, multi-step agents in mind, and none of the three regimes closes that gap cleanly.
In the US, the Federal Reserve, OCC and FDIC issued SR 26-2 in 2026, their first update to model risk management guidance in fifteen years, replacing SR 11-7. Reporting on the update indicates generative and agentic AI are formally excluded from the letter’s scope, while supervisory expectations for sound risk management are not reduced in practice. Treat that as a grey zone to fill internally rather than a green light: the primary PDF should be read directly before any compliance team relies on the exclusion.
In the EU, the European Banking Authority’s 2025 mapping exercise found no major contradiction between the EU AI Act and existing banking and payments law, but it also found no added synergy for high-risk obligations such as human oversight and data governance. In practice, EU banks must satisfy both regimes side by side, not one via the other.
In the UK, the FCA has confirmed a technology-neutral, principles-based approach: no AI-specific rulebook, leaning instead on Consumer Duty, the Senior Managers and Certification Regime, and operational resilience rules, with a joint FCA/ICO statutory code of practice for AI-driven automated decision-making announced in June 2025.
None of this gives a CTO a checklist to implement against. It means the governance architecture has to be designed to satisfy the intent of existing model risk, data governance and consumer protection obligations, because a formal exclusion or a principles-based stance is not the same as reduced scrutiny when something goes wrong.
Governance architecture: the four components that need to be in place from day one
The banks with credible agentic programmes did not bolt governance onto an existing deployment. They built the control layer into the first release.
Human-in-the-loop control points, scoped to the specific action rather than the whole workflow. Bank of America frames the next phase of Erica, its virtual financial assistant, explicitly as agentic proofs-of-concept “with verification safeguards” before any employee-facing autonomous action goes live. Wells Fargo’s rollout of Google Agentspace across roughly 215,000 employees keeps concrete use cases, contract review, KYC checks, debit-card replacement, under human supervision at the point of execution, rather than only at review. The design question for each agent is less “will a human see this eventually” and more “which specific actions require sign-off before they execute, and which can run unsupervised because the blast radius is genuinely small.”
Audit trails and action logging, built to answer a regulator’s questions rather than help a developer debug. Deloitte recommends an “agent control room” pattern: real-time auditing, centralised action logging, and kill switches that can suspend an agent’s permissions immediately. This has to log what the agent was authorised to do at that moment as well as what it actually did, because the two can drift as an agent’s tool access expands over time.
Explainability that survives a supervisory review. An agent that misclassifies a transaction or fabricates a regulatory citation, a documented failure mode in fraud and anti-money-laundering contexts, needs to produce a reasoning trace a compliance officer can inspect rather than a confident-sounding output. This is the practical meaning of SR 26-2’s continued expectation of sound risk management even where formal scope is unclear.
A single named governance owner. DBS Bank’s PURE framework, Purposeful, Unsurprising, Respectful, Explainable, is overseen by a dedicated Responsible AI Committee rather than left to informal coordination between engineering and compliance. Without a named owner, the control layer decays the first time a deadline pressures someone into skipping the review step.
Achieving determinism: the reproducibility problem behind the governance problem
Every control described above assumes a stable object to control: an action a human can review, log or audit today and get the same answer on if a regulator asks the same question next quarter. Agentic AI does not naturally provide that. Thinking Machines Lab’s research into LLM inference found that non-determinism persists even at temperature zero, not chiefly because of floating-point rounding but because production inference kernels are not batch-invariant: server load varies the batch an individual request lands in, which changes the numerical reduction order and, with it, the output. An empirical study of ChatGPT’s code generation quantified the scale of the problem directly: across 829 tasks, between roughly 48% and 76% of tasks, depending on benchmark, produced different test outputs on repeated, identically configured calls, and confirmed that setting temperature to zero reduces but does not eliminate the variation.
For a copilot drafting a document, that variability is a quality issue. For an agent authorising a transaction, flagging a fraud case, or generating the reasoning trace a compliance officer will inspect months later, it is a governance failure: the same input producing a different output on different days undermines the audit trail and the explainability standard set out above, whatever a regulator eventually says about scope.
The emerging engineering answer is to give up on full determinism inside the model itself, in most architectures that is not achievable, and instead isolate the non-deterministic component and wrap it in deterministic infrastructure. One production pattern for LLM agents consuming event streams uses composite idempotency keys and a persistent decision log, so a retried request replays the original cached decision rather than re-invoking the model and risking a different answer to the same event. A related pattern for agent runtimes records model ID, decoding parameters, prompt and response as an append-only event history, turning any incident into a reproducible test fixture that replays with the exact recorded output rather than a fresh, possibly different, inference. Combined with version-pinning the model and prompt in production, and treating any change to either as a release that requires re-validation, this is what makes the audit trail from the governance section above actually defensible under scrutiny: not a promise that the agent behaves identically every time, but a record precise enough to reconstruct exactly what it did, and why, on demand.
Delivery: a phased approach that matches the governance maturity you actually have
The rollout patterns visible across the industry converge on a sequence, whether the institution is a global bank or a regional one.
Start with a single, narrow, supervised use case. Citi’s phased rollout of Citi Sky to Citigold clients only, a defined client segment with a minimum eligible balance, is a tiering strategy as much as a technical one: it limits the blast radius of a new agentic system to a bounded population before wider release.
Instrument the control room before you expand scope, rather than waiting for an incident to force the issue. The logging, escalation path and kill switch described above need to exist before the second use case goes live. Retrofitting them once volume has made manual review impractical is too late.
Solve the core banking integration problem deliberately, rather than assuming the agent framework will absorb it. Legacy core banking platforms were built for batch processing, not for an agent that needs to check a balance, flag a transaction, and update a record inside one continuous task. Middleware investment, more than a bigger model, is usually the actual blocker. This is where mid-market institutions face a materially different problem to the megabanks in the case studies above: Fiserv’s agentOS platform, with named beta and co-development partners including First Interstate Bank, Boulder Dam Credit Union, Salem Five, City National Bank, Bank OZK and SouthState, exists specifically because a regional bank cannot resource a bespoke integration layer the way JPMorgan or HSBC can.
Increase autonomy in step with measured override rates, rather than a project timeline. If human reviewers are overriding an agent’s proposed action on a meaningful share of cases, that is the governance system working as designed, not a signal to accelerate. Expanding scope should be tied to a falling override rate over a defined observation period, rather than a quarter-end deadline.
What this means for the CTO/CFO decision in front of you
The banks getting agentic AI right, DBS, Wells Fargo, Citi, the Fiserv agentOS community-bank partners, don’t stand out for having the most sophisticated model. They stand out because they treated governance architecture as part of the build, sequenced delivery to match their own control maturity, and were honest about which use cases justified full autonomy and which did not.
Zartis works with banking CTOs and CFOs as an AI transformation partner: advising on the governance architecture that satisfies model risk, data governance and consumer protection obligations across US, UK and EU regimes, and then building and integrating the agent against your actual core banking environment rather than handing over a framework and a headcount. If you are deciding how much autonomy to grant your next agentic use case, talk to us before you set the rollout timeline, not after you’ve already committed to one.