Directors and Officers Liability Exposure for AI-Initiated Banking Losses
Banks lack clear rules for who pays when AI agents make unauthorized transactions.
AI-initiated banking losses expose directors and officers to a question that regulation has not settled. Who answers when software acts beyond its authority? The answer depends not only on what the agent did, but on whether the bank’s leaders put functioning controls around its power to act. This is where an uncertain transaction dispute can become a personal oversight problem.
Why agentic AI execution has outpaced the legal frameworks built to govern it
An AI agent initiates a payment, routes funds to the wrong account, and causes a loss. The transaction has happened without a human directing that individual action. Yet someone must decide whose instruction it was, whether it was authorized, and who bears the consequences. Agentic systems now make payments, run compliance workflows, and complete transfers with little human direction for each transaction.
Regulation E, principal-agent doctrine, and model risk frameworks were built for instructions that came from humans and for deterministic systems. They do not map cleanly onto software that interprets an objective and chooses how to pursue it. The IMF’s April 2026 note, How Agentic AI Will Reshape Payments, identifies the structural tension between probabilistic decision-making and payment infrastructure built for predictable rules, legal certainty, and clear accountability. Payment rails need an instruction they can recognize. An autonomous agent, however, makes decisions as a party other than the institution or the customer, so existing frameworks have no clear way to say who is responsible for every wrong outcome.
Why the regulatory vacuum left by SR 26-2 falls on directors and officers personally
The Fed, OCC, and FDIC jointly issued SR 26-2 in April 2026, the first overhaul of model risk guidance in over a decade. The agencies explicitly excluded generative and agentic AI because they regard the technology as “novel and rapidly evolving.” That exclusion leaves a gap. Directors and officers cannot point to compliance with that guidance as an answer to whether they adequately governed an agentic system. Corporate-law duties still apply when there is no specific regulatory standard.
Caremark’s mission-critical risk standard requires the board to oversee systems whose failure could threaten the institution’s core operations. McDonald’s extended the oversight duty to officers within their areas of responsibility. For a bank using AI at scale in credit decisioning, AML monitoring, or payment execution, those duties are difficult to treat as peripheral. A chief compliance officer’s certification that monitoring exists does not establish that it functions, just as a general counsel’s approval of a vendor contract does not establish supervision of the vendor. The exposure begins with the governance decision. Treating a mission-critical deployment as ordinary procurement could create a D&O liability problem before the tool executes its first transaction, although a loss alone does not establish personal liability.
How payment execution specifically concentrates D&O exposure
Most payment regimes require a payment order to be traceable to an authorized instruction from an account holder or its legally recognized agent. An autonomous system complicates that requirement because its individual transactions may not correspond to explicit human instructions. Permission to pursue an objective is not necessarily permission for every payment made in pursuing it. Lead Bank’s CEO Jackie Reses frames the problem directly. “Who is responsible? The human who misprogrammed? The model? The bank?”
The IMF note identifies authorization traceability as a central risk in agentic payments. If software hallucinates or exceeds its parameters, existing regulation does not cleanly resolve whether the result is unauthorized use or user negligence. Regulation E limits consumer liability for unauthorized transactions based on when they are reported, but when a customer delegates to an AI agent, the authorized-delegation exception may apply. That distinction changes the path to recovery. It can leave the bank facing the customer’s claim even though the bank had no part in choosing the agent’s action or building the software.
For directors and officers, the difficulty is establishing which authority was granted, where its limits applied, and who was responsible for enforcing them. Payments bring authorization ambiguity, consumer-protection obligations, and oversight of delegation into the same dispute. Even after the technical cause is clear, the legal meaning of the instruction may remain unsettled.
How third-party agents extend a bank's exposure beyond its own governance perimeter
A bank’s own AI program does not define the outer boundary of its exposure. A customer’s browser extension or shopping agent can go beyond its instructions while using the bank’s underlying payment rails. The bank may never have approved that agent. Nevertheless, it can become the institution the customer approaches when the agent buys the wrong item or sends funds to the wrong account. If the bank’s governance covers only tools it has deployed itself, it leaves out this route into the bank.
Recovery options can make that exposure harder to manage. Third-party consumer AI tools are not built for customer service or remediation, and many use arbitration clauses that block customers from obtaining redress. Stablecoin rails further narrow the available remedies because, unlike card networks, they do not offer chargeback rights. The bank has fewer tools to make customers whole. That constraint can persist even where it wants to help.
The IMF note also warns that agents that use similar models and react to the same signals can act in ways that track and amplify one another across institutions. An institution’s agents may therefore contribute to effects beyond its own customer base. Oversight must extend beyond deployment approval. Which agents may operate over the bank’s rails, what limits govern them, and who authorized those limits? The board cannot control every outside agent, but its governance must cover the risks those agents bring to the bank.
What the liability waterfall looks like in practice, and where governance failures cause it to collapse onto the bank
Lead Bank’s liability waterfall assigns responsibility according to the cause of failure. Under its framework, a consumer is not liable when an agent exceeds delegated authority, while a bank is liable where it controlled delegation limits and failed to enforce them. An AI provider is liable when failures stem from model defects, insecure tool use, or safeguards that fall short. A merchant is liable where it knowingly induces an agent to exceed its authority. These are proposed allocations.
The condition attached to the bank’s responsibility is revealing. Control over delegation creates an obligation to enforce it. A policy defining an agent’s authority does not, by itself, demonstrate that the bank prevented actions outside that authority. Nor does an unverified compliance certification establish that responsibility belongs with the provider or merchant. Under the waterfall, governance that exists only on paper leaves the bank exposed at the very point where it might otherwise distinguish its role from another party’s failure.
Reses identifies behavioral drift monitoring, attestations, know-your-agent refreshes, transaction credentials, and revocation capabilities as tools within current technological capabilities. Their availability changes the oversight discussion from whether controls are imaginable to whether relevant controls were implemented. Their availability sharpens the Caremark inquiry into whether directors installed oversight mechanisms for a known mission-critical risk, although a missing tool alone does not establish personal liability.
What board-level oversight of AI execution actually requires, versus what most banks are doing
Board-level oversight requires a mechanism that directors install to see whether AI controls function. A briefing every quarter on deployment status can show progress without showing whether the limits on live execution work. For a mission-critical system, that leaves the board dependent on the very management process it is supposed to oversee. The notes’ central governance concern is this structural gap, rather than a measured claim about how many banks have closed it.
Officers have a parallel responsibility within their functions. The chief compliance officer overseeing compliance AI, the chief financial officer overseeing payment execution AI, and the chief risk officer overseeing risk-scoring AI must supervise actual performance. Auditability makes that duty concrete and examinable. A defensible record requires granular per-decision traceability showing what the system decided, why, on whose authority, and what human reviewed the outcome. Without that record, a board cannot demonstrate oversight simply by producing its deployment policy.
Scholars in this area are developing the concepts of AI due care and AI loyalty oversight, emphasizing informed, technologically literate, and ethically grounded supervision. These emerging frameworks sit alongside existing duties. They are beginning to influence how D&O insurers and regulators assess board conduct.
How the IMF's three-layer framework maps where governance controls must sit
The IMF note divides agentic payments into three layers, which it calls intent and orchestration, authorization and control, and settlement. For directors and officers, this provides a map of where oversight attaches, without requiring endorsement of a particular policy approach. Each layer presents a different governance question. At Layer 1, the agent interprets objectives and plans actions, so the institution must define and document the permitted scope of intent rather than leave the model to infer its own boundaries.
Layer 2 is where planned actions meet enforceable authority. An agent-initiated action is either validated against rules or allowed to pass through without the necessary constraint. This is the critical point for D&O visibility. A failure here corresponds to the bank’s failure to enforce delegation limits in the waterfall. Knowing that an agent understood a customer’s objective does not establish that a particular transaction was permitted.
Layer 3 is settlement, where finality occurs and the authorization question is functionally closed. A missed authorization control cannot be retroactively enforced after settlement. The framework places controls where they can still affect execution, while preserving a record for later examination. The note’s broader argument is that outcomes depend as much on institutional design and governance choices as on the technology itself.
What governance structures reduce D&O exposure, and how AI deployment on existing banking rails enables rather than prevents them
The lesson for directors and officers is to require governance that defines and enforces agent authority at the transaction level. That structure also needs an examinable per-decision record and human review or approval at the authorization point for transactions above defined risk thresholds. These features serve different purposes. Enforced limits constrain action, human involvement addresses transactions requiring additional judgment, and audit records allow directors, regulators, and insurers to examine what happened. None substitutes for the others.
Existing banking rails can support this model through their audit mechanisms, regulatory reporting hooks, and control points that agentic systems can use without having to build them again. The IMF note discusses compatible approaches, including mandate-based authorization, separation of decision-making from execution, agent identity frameworks, programmable payment controls, audit trails, and tiered human-in-the-loop models.
PaymanAI is one example of this model, executing payments, transfers, and account analysis through voice or text on existing banking rails, with configurable controls, full audit trails, and SOC 2 certification. Such platforms provide transaction-level visibility, but the wider operational question of proving that an AI system consistently functions as intended and stays within its configured boundaries remains unsolved. When a loss occurs, the defensible response must identify a functioning control at the authorization layer and a record proving that it was enforced.
