Control Framework Gaps When Banks Migrate From RPA to Agentic AI Systems

Moving banks from RPA to agentic AI changes what their controls must govern, from fixed instructions to decisions made at runtime. The control gaps are specific enough to map before deployment. Closing them requires banks to locate where an agent departs from deterministic behavior and build safeguards into that boundary, rather than rely on monitoring to reveal the mismatch after launch.

Why RPA controls fail when agents start making decisions

When a field changes format, an RPA bot following a fixed script halts. An agent can interpret the unexpected input and continue. Rather than follow a predetermined sequence, it interprets an objective, plans steps, invokes external tools, and acts with limited or no human intervention. Software that once stopped at an unfamiliar condition can now decide how to proceed.

That change moves the control boundary. A bank can review a script before deployment because its instructions define the path it will take. Reviewing an agent's objective does not show every path the agent may take to reach it. The IMF's 2026 note, How Agentic AI Will Reshape Payments, identifies the underlying tension as probabilistic decision-making operating against the deterministic requirements of payment infrastructure.

This distinction also applies when agents extend existing automation. In an RPA “self-healing” design, an LLM can reason through an unexpectedly formatted input and let the workflow continue. The surrounding process may still look familiar. Yet the step that previously enforced a stop now permits a decision, exposing assumptions beneath vendor reviews, change gates, model assessments, and audit conventions.

Where existing bank control frameworks were built and why that matters now

Model risk management in the SR 11-7 lineage evaluates inputs, logic, and outputs under defined conditions. Its review process assumes logic that is fixed and testable in advance. Vendor oversight similarly assesses processes, controls, and outputs as defined deliverables, with an expectation of consistent behavior across invocations. These are useful foundations for their intended systems. The mismatch arises when a reviewed capability chooses its course of action at runtime.

Change management exposes a different part of that mismatch. A gate can review a discrete software change before deployment, but a new plan formed during inference is not a conventional release event. After execution, audit trails can record which rule fired or instruction ran without explaining why an agent selected a multi-step plan from an ambiguous objective. Neither framework is generally broken, but each depends on a boundary that agents cross.

The published preprint Agent Security Meets Regulatory Reality (A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systems) documents how this was visible in a production KYC deployment. Auditors had to check more than whether an action was authorized. Auditors needed to reconstruct, from one case identifier, the factors behind an outcome and whether every applied policy was current and approved. That is a different evidentiary burden. A record of execution alone cannot answer it.

The regulatory scope gap and what SR 26-2 does and does not cover

The revised interagency model risk management guidance, SR 26-2, explicitly excludes generative AI and agentic AI models from its formal scope. The guidance describes them as “novel and rapidly evolving” and leaves their governance to institutions' existing risk management and governance practices. The exclusion does not remove the expectation of control. The agencies say that principles such as materiality, ongoing monitoring, and effective challenge still apply to tools that fall outside the guidance's scope.

Those principles do not spell out how to build runtime agent architecture. A bank therefore has to translate broad governance expectations into controls for delegated authority, policy retrieval, and autonomous execution without agent-specific direction from its primary U.S. model risk framework. This leaves a gap in regulatory scope. It does, however, prevent the bank from treating formal coverage as the condition for beginning its own control work.

The EU AI Act follows a different timetable. Its August 2, 2026 milestone activates transparency rules and GPAI enforcement powers, while the Digital Omnibus postponed high-risk AI obligations to December 2, 2027. Those obligations call for structured risk management, explainability, and human supervision for high-risk uses such as automated credit scoring and AI-driven suitability assessments under Annex III. Banks still need to connect the applicable requirement to the agent behavior they intend to permit.

Work on agent-specific guidance gives banks more to go on, but still leaves them without a full set of binding rules against which to map their controls. The Singapore Model AI Governance Framework for Agentic AI takes up this new governance problem. China's TC260 agent security practice guides and draft mandatory standard, General Security Requirements for Artificial Intelligence Agent Application, also deal with agent security. The U.S. CAISI/NIST AI Agent Standards Initiative adds another effort.

The six specific control gaps agents expose in production

The first gap is authorization traceability. An RPA script embeds authorization in a defined trigger and rule, while an agent interprets a delegated objective in context. There may be no single authorization event that explains the resulting action. The IMF note identifies this as a primary risk channel because payment rails depend on clear accountability. If an agent misinterprets a mandate and misdirects funds, existing regulations struggle to distinguish unauthorized use from user negligence.

The second gap is identity and least-privilege enforcement. Human identity controls connect roles, segregation of duties, and access rights to named actors, whereas agents commonly receive service accounts, API keys, or tokens without individual accountability. Broad entitlements deepen that disconnect when institutions lack the infrastructure to scope agent access narrowly. The 2026 Singapore Consensus companion report on agentic risk management puts Least Privilege and Traceable Identity first among its principles because weaknesses here weaken the controls that come later.

The third gap is action auditability. Tool-call logs show what an agent invoked, but do not necessarily connect the call to the original objective or explain the decision behind it. The production KYC study reports that internal audit found logs that could not be tied back to the case they decided. The records existed, but the evidentiary link did not. The companion report distinguishes Auditability from Legibility for this reason, treating an action record and a reconstructable rationale as separate requirements.

The fourth gap is stale policy in the retrieval and reasoning layer. RPA policy updates require a script change that passes through a discrete change gate, while an agent can retrieve outdated policy without a corresponding software release. The KYC study reports that a stale retrieval-store policy caused systematic over-verification of customers who no longer required it. This was a governance failure. Version-controlled policy retrieval is therefore a new control category.

The fifth gap is prompt injection as transaction execution. A manipulated instruction in a stateless model changes an output, but in an agentic banking workflow it can lead to a transfer, an approved exception, or an exposed account record. The KYC study maps this risk to ECOA, Regulation B, and EU AI Act obligations, including discriminatory outcomes caused by injected instructions. The legal obligation follows the outcome. MCP servers bring these risks together because the integration layer that links agents to core banking systems can let one vulnerability reach across multiple systems.

The sixth gap is correlated agent behavior and systemic amplification. Unlike isolated RPA process queues, shared model endpoints and data feeds can connect agents across institutions to the same signals. The IMF note identifies the possibility of highly correlated automated responses across payment markets that amplify volatility. The boundary here extends beyond one bank. No bank-level framework now deals with cross-institution agent correlation, so banks and supervisors both need to act on this gap.

What closing the gaps requires architecturally before an agent goes live

For a bank preparing to deploy, the first design requirement is an enforceable mandate. The agent's delegated authority should be machine-readable and bounded by the architecture. Reasoning and execution should then be separate components with a logged, inspectable handoff. A chosen action is not yet an authorized action. The IMF note's intent, authorization, and settlement layers provide a way to preserve that distinction before an agent touches payment rails or account systems.

To close the auditability gap, every action in a regulated workflow must keep a persistent case identifier that links the tool call to the original objective and the policy version it used. The KYC study documents case-ID propagation and grounded-RAG-for-audit as engineering responses to its audit failures. The policy store must also be version-controlled, audited on the same cadence as model changes, and visible in the audit trail, so reconstruction can establish which approved policy governed the outcome.

Identity controls should give agents scoped, time-limited credentials tied to the bounds of each task, in place of broad service accounts. This limits authority at the point of action. The companion report pairs Least Privilege and Traceable Identity with Runtime Assurance and Interruptibility, recognizing that initial provisioning is not the whole control. A tiered human-in-the-loop design should send high-consequence or low-confidence actions for review and let routine actions go straight-through. Human Oversight and Interruptibility are runtime requirements.

These patterns do not make every gap purely local. Correlated behavior still requires a supervisory-level response, and a bank's own architecture cannot substitute for that. The pre-deployment review should preserve this distinction. The pre-deployment review can check that authority has bounds, actions can be reconstructed, policy is current, and people have ways to step in, without claiming that these safeguards resolve cross-institution dynamics.

Deploying on existing rails rather than replacing them reduces control surface complexity

Existing core banking systems can keep new decisions separate from the execution controls already in place. Systems including Temenos, FIS, Jack Henry, and Finastra have decades of deterministic transaction controls, reconciliation logic, and audit infrastructure built in. An agent executing through those rails inherits their execution-layer safeguards. That control advantage reduces the scope of infrastructure that must be newly governed.

The IMF note and the KYC study both call for this separation. The agent supplies a new reasoning layer, while the core system retains its governed execution role. The distinction must remain explicit. Existing rails do not explain why an agent chose an action, prove that its mandate allowed it, or establish that retrieved policy was current. Those responsibilities remain with the reasoning, authorization, and policy-retrieval layers above the core, including their handoff to execution.

Mapping the gaps before deployment is a prerequisite, not a project phase

The lesson for a bank's risk officer is to require the gap mapping before the pilot touches a live transaction. For each proposed agent, the mapping should identify which of the six gaps applies, which existing control would normally address the activity, and which architectural pattern closes the mismatch. The output is a specific control design. It establishes what the bank can bound and reconstruct, while making visible the limits that need a broader response.

Timing changes the cost of finding an omission. The KYC study's audit findings came from missing links in the architecture, which monitoring could not readily fix by adding alerts. ECOA, Regulation B, the EU AI Act, and FINRA's 2026 agent guidance reinforce accountability obligations that apply when an agent acts on a regulated transaction. A live pilot is a poor substitute for deciding how authority, policy, and evidence will connect before accountability obligations apply.

A bank with bounded agent scope can act without waiting for complete supervisory clarity. Its pre-deployment posture includes a defined mandate, scoped identity, version-controlled policy store, case-ID-propagating audit trail, and tiered human review for high-consequence actions. Waiting is itself a risk position when agentic reasoning is already being added to RPA workflows. The practical dividing line is whether the bank maps that change before deployment or first learns where its controls no longer fit from an audit finding.