We wanted to write this one because the same conversation keeps coming up with the financial-services leaders we work with. Most of them have seen the same agent demo by now. The software reads an alert, pulls the transactions, checks the watchlists, writes the narrative and, in the version that gets the biggest reaction, files the report itself. It’s impressive for about ninety seconds, and then the compliance officer in the room asks who signed it, and the demo has no answer.
We don’t think that question is a technicality. In regulated work, every decision that matters needs a person who made it, a record of what they saw, and a reason that still holds up when an examiner reads the file eighteen months later. An agent that acts on its own can be fast, but it can’t be accountable. The agents we see make it past the pilot are the ones that were built around that from day one, rather than patched up after the first exam.
Part seven of this series is about the pattern behind those agents, and it fits in one sentence: the AI prepares, a named human decides.
The Rulebook Is Thinner Than You Think
It’d be convenient if regulators had written a rule for agentic AI. For the most part they haven’t, and we think that’s worth understanding before you design anything.
Sources: U.S. Treasury, February 2026; NCUA, January 2026; OCC, Federal Reserve and FDIC, April 2026.
Let’s start with what’s actually out there. In February 2026 the U.S. Treasury released the Financial Services AI Risk Management Framework, developed with the Cyber Risk Institute. It sets out 230 control objectives that adapt NIST’s AI risk work to financial institutions, and it’s built to become the standard examiners reference. In January, the NCUA made clear it’s issuing no AI-specific rules, and it examines AI under the safety-and-soundness, third-party and fair-lending frameworks it already uses. And the revised OCC, Federal Reserve and FDIC model-risk guidance issued in April deliberately excludes generative and agentic AI, which leaves an acknowledged gap institutions have to govern for themselves.
When you put those together, the takeaway is that nobody’s going to hand you a checklist for agents. Your existing obligations still apply in full, and governing the agent itself is on you. Gartner made a related point in May 2026: applying one uniform governance model across every agent leads to failure. Each agent needs its own identity, least-privilege access, and oversight that matches how much it’s allowed to do on its own. That’s the same way IT has always treated service accounts, and it’s why the guardrails for agents belong with IT: identity, access, logging and retention. The business decides what the agent is for. IT makes sure it can be trusted and audited.
We should say that none of this is legal guidance. Your compliance team and your examiners have the final word on what your institution needs. This is just the practical reality we design for.
The Pattern: Four Stages, One Gate
The agents that hold up under scrutiny all follow the same shape, whatever the workflow happens to be.
1. Plan. The agent states its goal and the steps it means to take before it touches anything, so a reviewer can see the plan and not just the result.
2. Work, with every tool call logged. Each step names the system it used, whether that’s the core, the ERP, a watchlist service or the contract library, and records what came back. The log is timestamped and kept, so you can replay the path to the answer.
3. Produce a cited finding and a work-paper. The output should be a document a professional would recognize rather than a chat reply: the finding, the figures behind it, and where each figure came from.
4. Stop at the human gate. The agent pauses. A named person reviews the work-paper, approves it or sends it back, and signs. The agent never takes the final action itself, and a send-back gets logged just like an approval.
We think the gate is what makes the other three worth having. Without it, the log is a record of what a machine decided. With it, the log becomes the evidence file behind a human decision, and that’s what an auditor wants to see.
Four Agents, Four Named Owners
To make this a bit more concrete, here are four agents we use to show the pattern. They run on fictional data and describe a design pattern, not any organization’s production system. The part to pay attention to is where each one stops.
BSA/AML alert triage. The agent pulls the flagged transactions, builds a 90-day activity pattern, screens counterparties against sanctions lists, checks for prior cases and drafts the SAR narrative with every figure cited. Then it stops. The BSA Officer decides whether a SAR is warranted and files it. The agent never files.
Invoice and AP audit. The agent reads the invoice, matches it to the purchase order, checks the contracted rates in the master agreement and recomputes the charges. In our example run it finds two lines billed well above the contract rate and drafts a vendor dispute with a corrected total. AP approves the dispute before anything goes out, and no payment is held or released automatically.
New-member or customer onboarding. The agent validates the ID document, runs the Customer Identification Program (CIP) checks, screens sanctions lists, looks for duplicate records and sets up the new accounts unfunded. A staff member approves the identity and opens the relationship, and until then the account just sits there.
Mortgage and loan renewal offers. The agent pulls the current loan and payment history, checks today’s rate sheet, tests relationship-pricing eligibility, models the new payment and drafts the offer letter. The lender reviews it and sends it, and nothing goes to the borrower automatically.
If you look at what the four have in common, the agent does the gathering, cross-checking and drafting, which is the part that used to take an analyst most of an afternoon. The judgment, the signature and the outbound action stay with the person who’s accountable for them today. The org chart stays the same, and what changes is what lands on the desk. That’s also why the people who own the decision today should drive the design. They know what a good work-paper looks like and where the afternoon actually goes. Not every one of these needs a custom-built agent, either. Some fit the agent features already in the platform you license, and matching the right layer of the platform to the problem is a big part of what keeps the cost in line with the payback.
Peers Are Already Running It This Way
This isn’t just a design on paper. In May 2026, FIS and Anthropic announced a Financial Crimes AI Agent, with BMO and Amalgamated Bank named as adopters. Investigations that took hours drop to minutes, and a person still approves the outcome. In June 2026, Investec reported more than 800 custom agents in use across 8,000 employees, freeing roughly 350,000 hours a year, all under a formal governance framework.
We take two lessons from those announcements. First, the human gate doesn’t cap the value, because the time saved is in the preparation, and that’s where the hours always were. Second, governed doesn’t have to mean small. Investec got to that scale with a governance framework in place, and it didn’t wait for regulators to write one.
What the Gate Is Not
A gate only works if the person at it is really deciding. There are three ways we’ve seen it go wrong that are worth designing against.
A rubber stamp. If the reviewer approves everything that comes in, either the agent’s perfect or nobody’s reading. Track approval and send-back rates, and sample approved work-papers the way you’d sample any other control.
A gate without the evidence. A reviewer who only sees the conclusion can’t really challenge it. The work-paper and the tool-call log have to be in front of them when they decide, not sitting in a system they’d have to request access to.
An unnamed decider. “The team approves” isn’t an owner. Each gate needs a role and a person, and the signature gets recorded against that person.
Getting Started
If you’re moving from agent demos toward agents your examiners will see, these are the steps we’d take first:
- Pick one workflow where preparation is the bottleneck, such as alert triage, invoice review or onboarding checks, and where the decision already belongs to a single role. The team that owns it should drive the design, with IT setting the guardrails.
- Design the gate first. Write down who decides, what they have to see in order to decide, and what the agent’s never allowed to do on its own.
- Define the work-paper the agent has to produce: the finding, the figures, and the source for every figure.
- Log every tool call and keep it on the same retention schedule as the decision it supports.
- Map the agent to the frameworks you’re already examined under, including third-party risk, model-risk practice and fair lending, and use the Treasury framework’s control objectives as a cross-check.
Talk to Us
CB5 Solutions helps organizations understand the layers of AI, get the most from what they buy, and build an AI program that pays back inside their IT standards. We start every engagement with one business problem and a governance baseline. Let’s pick yours.
Next, this afternoon: Usage Is Not ROI: Building an AI Value Scorecard Your Board Will Trust. The one-page view of adoption, capacity, quality and risk.