Configurable AI Controls as a Regulatory Risk Management Tool for Banks

Banks spent two decades governing AI that recommends, scores, and predicts. Agentic AI acts: it initiates payments, approves loans, and executes multi-step decisions without a human checking in at each step. That single shift is why 2026's governance conversation feels so urgent, and why so many banks are getting it wrong. Adoption has already blown past the pilot stage. 81% of financial firms have adopted AI at some level, up from 40% that had deployed AI as of January 2024, and agentic AI specifically is on track for a roughly six-fold jump in usage among finance teams between 2025 and 2026, with 44% expected to be running it next year.

Governance hasn't kept pace with any of that, and pretending otherwise is the mistake. McKinsey's 2026 survey found only about a third of organizations report mature governance levels. Cisco's AI Readiness Index for 2025 found just 31% of organizations feel fully equipped to control and secure agentic systems, even though 83% plan to deploy them anyway. Deloitte's 2026 State of AI in the Enterprise report puts the number lower still: one in five companies has a mature model for governing autonomous agents. None of this is a capability problem. It's an accountability problem, and it shows up the exact moment an AI system stops advising and starts acting.

What makes agentic AI categorically different from the AI banks have governed before

Older banking AI made suggestions. A model flagged a transaction as suspicious, scored a borrower's risk, or surfaced a product recommendation, and a person decided what to do with the output. Agentic AI collapses that separation. It plans a sequence of steps, picks tools to execute them, and carries out multi-step tasks on its own, often without anyone checking in along the way.

Four attributes drive the change in risk profile. The system acts without continuous instruction, which is a different thing entirely from following a script. It reasons toward a goal, choosing its own means to get there instead of following a fixed decision tree. It reaches into external systems: applications, databases, even other agents, rather than staying inside one contained environment. And it parses unstructured input, conversational text, scanned documents, ambiguous requests, in ways legacy rule-based systems were never built to handle.

Calling this "a chatbot getting smarter" misses the point entirely. It's a shift in who, or what, initiates a consequential financial action. According to industry analysis from Neontri, agentic systems can now initiate payments, transfers, and regulated decisions straight from a conversational prompt. So the question a bank has to ask isn't whether a system "uses AI." It's whether that system can touch a customer, a transaction, a regulated decision, or a critical operation. If it can, the old governance category doesn't apply, full stop.

There's a systemic layer too. Research out of arXiv:2604.21672 has warned that automation now threads together trading, credit, and compliance systems across institutions, and correlated agent behavior, many banks' systems reacting the same way at once, could amplify volatility in ways no single bank's governance was built to catch. Research out of Princeton and Emory (arXiv:2512.11933) explains why older model-risk frameworks break down here: they assumed static algorithms, validated once and left alone. Agentic systems learn continuously, exchange signals with other systems, and produce behavior nobody explicitly programmed. Validating that once, at launch, tells a bank almost nothing about what the system will do six months later.

The regulatory landscape banks must navigate in 2026, and where it leaves agentic AI ungoverned

The Federal Reserve, OCC, and FDIC issued SR 26-2 on April 17, 2026, replacing SR 11-7 (2011) and SR 21-8 (2021). It swaps out annual revalidation for risk-based oversight tied to how material a model actually is, and it applies most directly to banking organizations with more than $30 billion in assets under Federal Reserve supervision.

Buried in footnote 3 is the detail that matters most: generative and agentic AI are explicitly carved out, "not within the scope of this guidance." But the same footnote adds that a bank's own risk management and governance practices should still guide appropriate controls for whatever the rule doesn't cover. The carve-out doesn't remove the obligation. It relocates it. The practical consequence is that banks of all sizes face questions about how they govern the AI that SR 26-2 declines to name. That's the trap: a bank that reads footnote 3 as permission to wait is going to get asked the hardest questions first.

Europe is moving on a parallel track. The EU AI Act classifies credit scoring and similar financial uses as "high risk," triggering documentation, transparency, human oversight, and ongoing monitoring requirements. General-purpose AI obligations kicked in August 2, 2025. Transparency rules follow in August 2026. The high-risk provisions themselves got pushed back through the Digital Omnibus, which provisionally defers Annex III obligations, credit scoring and AML among them, to December 2027 (Regulation (EU) 2026/1744, adopted June 29, 2026, in force July 27, 2026). Customer-facing conversational AI doesn't get that grace period. Its disclosure requirement still lands in August 2026, which sounds like a simple labeling rule until you realize that disclosing where AI is making decisions invites exactly the scrutiny a bank needs to be ready for.

Germany's BaFin weighed in during December 2025 and framed AI as an ICT risk management issue under DORA, not an innovation topic and not an ethics footnote. In the US, the consumer protection overlay hasn't moved at all, and that's precisely the point. ECOA and Regulation B still require specific, accurate reasons for adverse credit decisions no matter what generated them. The CFPB confirmed back in 2022 that a bank can't point to model complexity as a defense. Explainability isn't a nice-to-have. It's the law.

The Financial Services AI Council's BAICS v1.0 standard is trying to fill the gap industry-wide, acknowledging plainly that generative and agentic AI create risks, unpredictable behavior in high-stakes decisions, limited explainability for credit or fraud outcomes, that traditional IT and model governance were never built to catch. Put it all together and a pattern emerges. Regulators haven't written agentic AI out of accountability. They've written it into the bank's own obligation to design controls fit for what the technology actually does.

How configurable controls map onto what regulators are actually asking for

Strip away the jargon and regulators are asking for four things, laid out clearly in analysis from another vendor: accountability (an executive owns every AI outcome), transparency (someone can explain how a specific decision got made), auditability (every automated action leaves an immutable record), and continuous validation (testing that never really stops, not a one-time check at launch).

Configurable controls are what those four pillars look like once they leave the policy memo. Not commitments on paper, architecture that produces evidence on demand.

Start with transaction limits and approval thresholds. Sound governance frameworks for payment agent controls generally call for human approval or supervisory intervention on high-risk or high-value transactions. That's not bureaucratic friction bolted on top of automation. It's the mechanism that keeps a regulated decision in human hands the moment it crosses a line the institution defined in advance, and it maps directly onto the broader expectation SR 26-2 establishes: that each institution exercise its own judgment about where automation is appropriate.

Then there's the split between deterministic guardrails and probabilistic model layers, and this distinction matters more than it sounds like it should. A hard rule, a sanctions-list match, a policy-set transaction ceiling, fires before any model gets involved. It doesn't wait for an inference. It doesn't depend on a probability score crossing some threshold. This is the architectural line regulators actually care about: some outcomes are non-negotiable, and those get governed by rule, never by a model's best guess.

Audit trails do double duty. Every logged agent action supports model oversight expectations and ECOA's requirement that adverse decisions trace back to a specific reason. A Cornell survey (arXiv:2604.21672) found agentic AI in compliance work can automate regulatory monitoring while still preserving the audit trail that accountability depends on. That answers a worry a lot of compliance officers carry around: that automation and auditability are somehow in tension. They're not, as long as the logging gets built in from the start instead of bolted on after.

Role-based permissioning decides which agents can take which actions in which contexts, and it's what turns the three-lines-of-defense model from an org chart into something the system itself enforces. Kill switches round it out. Governance frameworks for agentic systems treat ex-ante interruption and containment as a core safeguard, not a last resort, and their presence in the architecture is itself evidence, the kind an examiner is looking for, that the institution has real control over what it deployed.

The three-lines-of-defense model applied to agentic AI deployment

Line 1 sits inside the agent itself: transaction limits, escalation rules, confidence thresholds below which the system stops and asks, full logs of every action taken. These aren't soft suggestions. They're the first, hardest constraint on what the agent gets to do without a person stepping in.

Line 2 is the independent risk function: checking model performance, reviewing escalated cases for patterns worth flagging, holding the authority to suspend the agent outright if something looks wrong. Independent has to mean independent here. That function can't sit inside the team that built and runs the agent, or the whole structure collapses.

Line 3 is internal audit, confirming Line 1 controls actually work the way they're supposed to and that Line 2 has stayed genuinely separate. None of that verification happens without the audit trail the agent produces. Take the logging away and Line 3 has nothing left to check against.

A failure that surfaces consistently across banking AI deployments is collapsing all three lines under one technology team. It happens more easily than it sounds like it should: the same group that built the agent ends up monitoring it and auditing it too, because they're the only ones who understand how it works. That's exactly backwards, and it's the mistake worth naming plainly. Configurable-controls design has to make the three lines structurally separate, not separate on paper, with permissions, logging, and override authority built into the tooling so the separation holds whether or not anyone's watching. Independent certifications at the platform level are the outside check that the architecture actually holds up, not badges on a sales deck, but evidence the controls were tested by someone with no stake in the outcome.

What early bank implementations show about configurable controls in practice

Numbers from Neontri's research on bank deployments put agentic AI's productivity upside at more than 60%, with annual savings above $3 million at some institutions. The pattern holds across specific use cases too: 25 to 40% faster loan approvals, 45 to 65% less manual work in trade finance processing.

A few examples put flesh on those percentages. Independent Bank in Michigan cut its integration pipeline development time by a factor of 12, automated its ATM fleet processes so turnaround on issues dropped from weeks to 48 hours, and rolled out automated check fraud detection alongside it. A major UK bank built AI agents into its loan approval workflow and saw loan fraud drop 35%. Bank of Singapore cut compliance drafting time by 20 to 50% using generative AI, without giving up regulatory accuracy in the process. BNY Mellon runs Eliza, an orchestrator managing 13 specialized agents, to give its sales teams faster insight and speed up how quickly they can serve clients.

None of these gains happened because the controls got out of the way. They happened because the agents were operating inside boundaries a regulated bank could actually stand behind in production. Take the guardrails away and not one of these banks would have been able to deploy at all, at least not without an examiner shutting it down the first time something went wrong.

Credit unions face a version of this that's arguably more urgent, given staffing pressure and rising member expectations that aren't slowing down. The Filene Research Institute points to member service, lending, fraud detection, compliance, financial wellness, collections, and back-office work as the clearest openings for agentic AI in that space, while stressing that strong governance around fair lending, privacy, explainability, and audit trails isn't optional. It's the price of entry.

How to evaluate whether an agentic AI platform's controls are genuinely governance-ready

Not every vendor's version of "governance" means the same thing, and that's exactly where a lot of banks get burned. Worth knowing what to actually check before signing anything.

The strongest platforms build compliance into the architecture itself instead of layering it on as a setting someone can toggle off later. That means audit logging on every agent action, role-based access controls, guardrails that constrain what an agent can say or do, and certifications, SOC 2, PCI-DSS, AML/KYC, that back up the claim rather than just asserting it. A useful distinction in agentic AI governance is that guardrails need to work at both design time (data constraints, validation checks built in before deployment) and runtime (human-in-the-loop review, anomaly detection while the system is live). A platform that only does one is only half governed, no matter what the sales deck says.

Deployment matters too. Replacing a bank's core infrastructure to bolt on an AI layer isn't a prerequisite, and platforms that work within existing systems cut integration risk while preserving the institutional knowledge already baked into legacy controls. Interface doesn't decide governance quality either. Voice, text, whatever channel a customer uses, none of it matters as much as whether every action taken through that channel gets logged, permissioned, and routed for escalation when it needs to be.

A banker evaluating a vendor has a short list of questions worth asking directly:

• Can transaction limits and approval thresholds be set at the institution level, by transaction type and counterparty?
• Are the audit logs immutable, and can they be exported for an examiner to review?
• Is the override and kill-switch mechanism documented, and can it be tested independently?
• How does the platform separate Line 1, 2, and 3 functions in the system itself, not just in an org chart?
• What certifications does the platform hold, and how are they maintained over time rather than just at launch?

Platforms built specifically for financial institutions, designed around institutional control, configurable guardrails, complete audit trails, and deployment on a bank's existing rails, tend to be better positioned to meet SR 26-2's expectations than general-purpose agentic tools retrofitted for banking after the fact. That's not a small distinction. It's the difference between a platform that was designed to survive an exam and one that's hoping it does.

Some skepticism from bankers here is earned. A 2024 review by the Bank of England and FCA found 55% of reported AI use cases among UK financial firms involved some degree of automated decision-making, but only a small share were fully autonomous. The industry is heading toward bounded autonomy, not full hand-off, and the right platform is the one that makes that boundary concrete and auditable rather than aspirational.

Why configurable controls are the condition for AI autonomy, not the limit on it

Go back to where this started: barely a third of organizations report mature governance, yet 83% plan to deploy agentic systems anyway. That gap isn't a reason to stall adoption. It's the argument for building the controls first, before the systems scale past the point where retrofitting them is even possible.

SR 26-2's carve-out and the EU AI Act's high-risk provisions aren't loopholes a bank can quietly step through. They're a signal, maybe the clearest one regulators have sent so far, that the burden of proof sits with the institution now. A bank that treats configurable controls as red tape slowing down its AI rollout has the relationship backwards, and this is worth saying plainly: the controls are what make the rollout defensible in the first place, to an examiner, to a customer disputing a declined loan, to an auditor asking where a specific action came from six months after the fact.

Autonomy without an audit trail isn't autonomy a bank can stand behind. It's exposure wearing a better outfit. The banks moving fastest on agentic AI right now aren't the ones with the least governance in their way. They're the ones that built the guardrails first, then found out how much room those guardrails actually left them to move.