Why it matters
Banks are moving from AI that drafts and recommends to agents that initiate payments, open cases and act inside customer journeys. Supervisors are applying existing rules on accountability, outsourcing and consumer protection to these systems, and expect banks to show who is responsible for every action an agent takes.
Most banks are starting with agents that work inside controlled processes, such as gathering documents for a loan file or preparing a fraud case for review. The open questions are how much authority an agent should have over money movements, how customers are told when they are dealing with an agent, and how firms evidence that controls work in practice.
By the numbers
14%of financial institutions report AI agents at scale in risk, legal and compliance, the highest of any industry 1
5%is the average for that function across all industries 1
17%report agents at scale in IT, and the same share in knowledge management 1
IT
Knowledge management
Service operations
Risk, legal and compliance
Human resources
Marketing and sales
Source: McKinsey, The state of AI in 2026: On the road to ROI, 25 August 2026
What's changing
- Model risk frameworks are being extended to cover autonomous actions, including limits, escalation and human sign-off for higher-risk steps.
- The EU AI Act classifies creditworthiness assessment of individuals as high-risk, which brings documentation, oversight and data-quality duties.
- Fair-treatment and consumer-duty rules apply to outcomes produced by agents in the same way as to decisions made by staff.
How leaders are responding
- Keeping an inventory of agents with named owners, permitted actions and transaction limits.
- Logging every agent action so it can be reconstructed for complaints, audits and supervisory reviews.
- Starting with internal operations, such as reconciliation and case handling, before giving agents customer-facing autonomy.
What good looks like
- An agent register that names an accountable owner, permitted actions and limits for every agent
- Tiered autonomy: agents act alone only on low-value, reversible steps
- Complaint and audit trails that can replay any agent decision end to end
What to watch
- Supervisory statements and speeches on AI agents in financial services.
- Guidance on the EU AI Act's high-risk obligations as they phase in.
- Industry approaches to agent identity, authentication and audit trails.
Where to start
Map where agents already act today, including features inside vendor software. Then set approval thresholds and logging standards before expanding their scope.
Questions for your leadership team
- Which actions can our agents take today without human approval?
- Could we explain an agent's decision to a customer and to a supervisor?
- Who signs off a new agent capability before it is released?
Sources
- McKinsey, The state of AI in 2026: On the road to ROI, 25 August 2026
