FSB finalises 12 AI sound practices for banks, with new controls for AI agents

What the FSB published

The Financial Stability Board (FSB), which coordinates national financial authorities from 24 countries and jurisdictions along with the main international standard-setting bodies, has published its final report on sound practices for responsible AI adoption in finance. The 75-page document, released on 15 October 2026 with a press release, sets out 12 practices meant to help banks, insurers, asset managers, payment firms and other financial institutions use artificial intelligence while keeping its risks in check.

It is the finished version of a consultation report the FSB put out on 10 June 2026. The FSB, chaired by Bank of England Governor Andrew Bailey and hosted by the Bank for International Settlements in Basel, says the final text reflects public feedback and will be updated as AI and its uses change. The boards and senior managers of financial institutions are “strongly encouraged” to reference the practices when they build or revise their AI governance, risk management and control frameworks.

The report is explicit that this is not a rulebook. The sound practices are “non-prescriptive and do not constitute a binding international standard,” it says, describing them as a practical toolkit that firms can tailor to their own size and risk profile and fold into existing frameworks, including those for cyber and third-party risk. Its executive summary also warns about the opposite danger: institutions should be aware of the risks of not adopting AI, such as reduced competitiveness and a weaker ability to detect and manage cyber threats.

The 12 sound practices

The practices fall into two groups. The first four deal with organisation-wide governance: who sets the direction, who is accountable, how AI risk enters the risk framework and how the firm keeps adapting. The remaining eight follow an AI use case through its life, from the first risk assessment to retirement. The FSB says the order does not signal priority, and several practices cut across more than one stage.

Proportionality runs through the whole document. More robust practices may suit institutions that are large, complex or highly connected, or that use AI in critical functions. Smaller and less complex firms, and lower-risk use cases inside bigger ones, may warrant only the relevant practices or modified versions of them. The table below condenses the one-line summaries in the report's annex.

What changed after the consultation

The FSB received around 160 responses to the June draft from banks, insurers, asset managers, payment firms, technology providers, academics and public authorities. Its overview of consultation responses says most respondents welcomed the principles-based, technology-neutral approach and its emphasis on proportionality, while a few asked for more prescriptive practices.

The biggest change concerns agentic AI, meaning systems that plan and carry out multi-step tasks with some autonomy. Several respondents asked the FSB to say more about it, suggesting controls such as pre-execution authorisation, least-privilege access, immutable audit trails and runtime monitoring. The final report updates its discussion of agentic risks, adds specific considerations for highly autonomous AI and includes a new agentic case study. The FSB notes that these additions were “not fully consulted on” but distilled from the responses, and that sound practices for agentic and multi-agent systems are still emerging.

Other changes include a clearer split between the board's role and senior management's, guidance for small firms that can lean on existing roles and outside expertise, more case studies from insurers and nonbanks, stronger language on documentation so that an agent's actions can be traced and reconstructed, and a broader practice on third-party AI. Requests to tackle sector-wide risks such as herding were declined. The report stays focused on individual institutions, and the FSB says it will keep watching AI-related systemic risk through its regular vulnerability assessments.

How the FSB wants firms to fence in AI agents

The report lists the risks it sees in agents: unauthorised actions that an agent treats as shortcuts toward its goal, erroneous actions that can creep into any of hundreds of intermediate steps, exposure of customer data and trade secrets, disruption of the APIs and systems agents connect to, the impracticality of real-time human monitoring at scale, memory poisoning, in which attackers plant malicious data in an agent's knowledge base, and sub-agents that scatter decision-making across many processes.

Its answer is to pair human oversight with deterministic controls, rules that hard-limit what an agent can do. Examples in the report include prohibiting actions outside the firm's risk appetite, running agents in isolated environments where possible, limiting their access to APIs, data, networks and other agents to what the task needs and widening it only as confidence grows, setting risk-based triggers for human approval, such as transactions above a certain value or actions that could cause irreversible harm, and splitting goals into steps that each have to pass a check. Oversight can range from a human in the loop to “human-in-command”, and the FSB describes a “kill switch” that can halt an AI system outright or gradually hand its work back to people. Each agentic use case should have a documented accountable individual.

A new case study shows why. A large life insurer that began using agents in consumer claims processing chose to build them in-house for more transparency and control. During testing in a protected environment, the agents could be coerced into trying to reach databases and systems they had no permission to use, in one case trying to delete data files. The insurer tightened permissions, registered and tracked each agent individually, kept sub-agents to a minimum and went live with constrained autonomy and one person ultimately accountable.

Another case study describes a large international bank whose in-house fraud agent proposes new detection rules that analysts must approve before they go live. The report says the agent contributed to three quarters of the bank's card fraud rules and helped cut fraud losses by more than 20% in the first half of the 2026 financial year compared with a year earlier. Neither institution is named.

AI models that find and chain vulnerabilities

The cyber sections reflect how quickly AI-assisted hacking has moved. The report warns that some advanced models can autonomously find and exploit vulnerabilities through source code analysis, web application testing, binary analysis and protocol fuzzing, chain flaws together and reverse engineer patches, capabilities that “significantly compress the timeline from vulnerability discovery to exploitation.” It also points to AI-made impersonations of executives who can approve large payments, and to AI-generated images or video used to get past know-your-customer checks.

Under Sound Practice 11, firms are asked to assess whether they can keep up with those shorter exploitation windows, to patch promptly but with risk-based priorities, and to use compensating controls such as virtual patching when a fix is not yet available or cannot be applied straight away. Banks already feel that pressure: Bank of America added 1,000 contractors to patch software flaws after frontier models such as Anthropic's Mythos began exposing old bugs in its own and its vendors' code.

Third-party AI and concentration

The FSB gives a lot of space to dependence on outside providers. It notes that cloud, hardware and foundation-model providers are often highly concentrated and sometimes vertically integrated, that vendors may swap the models behind their services without adequate notice, and that AI is increasingly embedded in third-party software that is not sold as AI at all. Reliance on the same models, data or infrastructure could also lead institutions to behave in correlated ways, amplifying herding and procyclicality when markets are under stress.

Respondents told the FSB that they often cannot get enough information from vendors, especially about frontier models, to do proper due diligence, and that smaller firms have little leverage with large providers. The final Sound Practice 12 now covers embedded AI and sub-outsourcing, and suggests seeking more granular and timely assurances from providers, building business continuity and exit plans for critical AI services, and working across the sector on standard contract terms, assurance tools and joint scenario tests. Institutions stay accountable for AI outcomes even when the AI comes from someone else.

How regulators are using it

National authorities moved quickly. Canada's Office of the Superintendent of Financial Institutions issued a statement endorsing the sound practices on 15 October, saying they complement its own guidelines on governance, third-party risk, technology and cyber risk, operational resilience and model risk. In Hong Kong, the HKMA cited the FSB report the same day when it set new AI rules for banks and floated a registry of AI agents; its guidance echoes many FSB themes, including named owners, inventories of AI tools and kill switches.

The practices also arrive as banks draw lines around agents they do not control. JPMorgan, for example, has blocked outside AI agents from moving money in Chase accounts, and other large US banks have imposed similar limits. The FSB report is about the AI that financial institutions adopt themselves; how supervisors should treat agents that customers bring to their accounts is a separate question it does not try to answer.

What is still unclear

Because the practices are voluntary, their real effect depends on how supervisors in each jurisdiction take them up, and the report sets no timelines or reporting requirements. The agent guidance is admittedly early: the FSB says it was not fully consulted on and may merit more thorough treatment in future. The case studies are anonymous and, by the FSB's own description, illustrative rather than benchmarks, so figures such as the 20% cut in fraud losses cannot be checked independently. The systemic questions respondents raised, from herding to reliance on a handful of AI providers, are left to the FSB's wider monitoring rather than settled in this toolkit.