FSB Final Report on Agentic AI in Finance: "Human-in-Command" Sound Practices Headed Into National Supervision

FSB Final Report on Agentic AI in Finance: "Human-in-Command" Sound Practices Headed Into National Supervision

In October 2026, the Financial Stability Board delivered its final report on Sound Practices for responsible adoption of artificial intelligence to G20 Finance Ministers and Central Bank Governors in Bangkok, accompanied by a chair's letter from FSB Chair Andrew Bailey. Though non-binding, the framework — especially Sound Practice 10 — establishes the supervisory baseline that national regulators are expected to translate into examination requirements.

The human-in-command mandate. The FSB acknowledges that traditional, decision-by-decision review is incompatible with the velocity of autonomous systems: firms must instead focus on high-level oversight, "defining autonomy boundaries and setting guardrails rather than attempting to audit every individual output."

For agents handling financial transactions, Sound Practice 10 imposes significantly more rigorous controls:

• "human approval or dual authorization for any transaction exceeding a specific threshold value¹"
• restricted access to payment systems
• comprehensive audit trails for every transaction an agent executes
• and, explicitly, "AI-in-the-loop monitoring—using AI to oversee other AI—to supplement human supervision"

Non-binding ≠ optional. "National regulators, including the Federal Reserve, OCC, FDIC, SEC, and CFPB, typically translate such international frameworks into concrete examination requirements." Federal Reserve Governor Michelle Bowman (July 2026) said regulators are expected to align with existing frameworks and tailor expectations to use-case materiality. Skadden's analysis advises firms "to benchmark their current governance against these standards immediately."

Context: the FSB framework arrives in the same legislative vacuum as everything else — the Warner AI AGENT Act (agent-fiduciary bill, S. 5051) is stalled in Senate Commerce, the Hawley-Murphy AI Agent Accountability Act has no committee action, and consumer agents (Meta's Muse, xAI's GrokBot) are shipping under vendor-defined liability terms.

What it means for enterprises in financial services: dual-authorization thresholds, agent transaction audit trails, and autonomy-boundary documentation are about to become exam findings. Boards should treat the 12 practices as the de facto standard for agent governance ahead of formal rulemaking. For the broader fragmentation picture, see Agent Liability Is Being Written Without a Statute: Five Jurisdictions, One October Week; for the contractual-gap angle, see Agentic AI Liability: Autonomous Supply Chain Decisions Expose Contractual Gaps for Enterprise Deployers.