In April, US bank regulators rewrote model risk guidance for the first time in fifteen years, and wrote agentic AI out of it.
A model gives you an estimate. An agent gives you an outcome. That difference sounds small until you watch it happen in a bank. A card dispute agent reads a customer complaint, pulls the transaction, checks the merchant’s history, decides the claim is credible, and posts a provisional credit to the account. Every model inside that workflow may have been validated, documented and monitored. And still, when an auditor asks whether the agent was allowed to post that credit, the model governance file has nothing to say.
This is the gap most banks are about to discover, and US regulators have now put it in writing. The revised interagency model risk management guidance (SR 26-2) issued by the Federal Reserve, FDIC and OCC on April 17, 2026 replaces SR 11-7, and a footnote states that generative AI and agentic AI models “are not within the scope of this guidance.” The guidance is expected to be most relevant to banking organizations with over $30 billion in total assets, a line that places larger US regional banks inside its scope. For their CROs and CIOs, the agents now in pilot sit outside the framework their model risk teams know best.
Model risk management was built to answer one question: is this model fit for purpose? Agents force a second one: is this system permitted to do what it just did, and who answers for it?
The answer to the second question changes from agent to agent. It depends on one variable more than any other: how much autonomy the agent has been given.
IN BRIEF
- SR 26-2 (April 2026) excludes agentic AI from US model risk guidance, leaving agent controls to each bank.
- Autonomy level (L0 to L4) is the variable that sets the governance burden for each AI agent.
- Seven controls work as a dial whose weight shifts as autonomy rises.
- Tier agents on autonomy and action-space, and make promotion to a higher level depend on evidence.
The old question still matters
Nothing about agents retires the existing controls. The underlying model can still hallucinate, leak sensitive context or encode bias, and a weak model makes a worse planner. Validation, documentation, change control and output monitoring all stay.
But those controls describe how a model behaves on a test set. They do not tell you whether an agent was authorized to write to a core system, whether it read a fee-waiver policy correctly, or whether anyone can reconstruct its chain of tool calls after a customer is credited twice. Standards bodies are converging on the same point: existing principles such as accountability, transparency and fairness still apply, but they have to be translated for systems that act, adapt and interact with other agents.
Model governance remains necessary. It stops being sufficient the moment the system gets hands.
The variable that matters: autonomy
Most governance advice on AI in banking treats “agentic AI” as one category and hands you one list of controls. That matters more each quarter: KPMG’s Q2 2026 AI Quarterly Pulse Survey found that over half of the organizations across the banking industry are adopting AI agents in some capacity. In practice, a drafting assistant and an agent that can release payments are different risks, and they should carry different governance burdens.
A more useful way to see it is as a ladder. There is no single industry-standard version, and published frameworks slice the spectrum differently (IMDA’s Model AI Governance Framework for Agentic AI, for example, describes a spectrum running from a human operating every action to observation after the fact). This is the working ladder we use:
The levels describe a design choice about how much judgment you hand over. They carry no maturity ranking, and each step up changes what you have to govern.
Take a disputed card transaction as the example.
- At L0, the agent explains the dispute process to a contact-center employee. The employee does the rest. Model governance is largely enough.
- At L1, the agent pulls the transaction, summarizes the customer’s history and drafts a recommendation. A human reads it, decides and acts. The new risk is data: what the agent can retrieve, and whether it retrieved the right thing.
- At L2, the agent prepares the provisional credit and a person approves it before it posts. The risk moves to the quality of the approval. If the approver clicks “accept” 99 times out of 100 without reading, the control exists only on paper.
- At L3, the agent posts credits below a set threshold on its own, and escalates anything ambiguous, high-value or involving a flagged customer. Now the boundary between “decide alone” and “stop” is the most important design artifact in the system. If that boundary lives only in a prompt, it can be bypassed or forgotten.
- At L4, a network of agents handles intake, fraud checks, merchant communication and settlement with no routine human in the loop. A person may only see the exceptions that surface later. An error in one agent’s output becomes another agent’s input, and the human approval you relied on at L2 is no longer structurally possible.
The process and the underlying models stay the same at every level. The governance problem changes five times.
Agentic AI governance should scale with the level
This is where the seven controls most agent-governance guidance lists (permitted actions, access, decision boundaries, human approvals, traceability, exception handling, shutdown) become more useful. They work as a dial, and their weight shifts as autonomy rises.
Three patterns are worth drawing out.
Approvals peak at L2 and then stop scaling.
Continuous human oversight of every step does not scale, and it creates its own failure: people stop reading and approve. The practical answer is risk-based approval, where low-impact, reversible steps run and irreversible or high-stakes steps pause for a named approver. Then measure it. An approval that is never refused has stopped working as oversight. The imbalance is already visible: in the Bank of England and FCA’s 2026 survey of UK financial firms, human approval and pre-deployment review were each reported by more than 90% of respondents, while ongoing monitoring and periodic review or recertification were each reported by around half.
Boundaries become the control at L3.
Once the agent acts alone, the decision boundary is the safety system. Prompt-level guardrails fall short here. Anything that matters should be enforced in the layer that executes the tool call, so a blocked action stays blocked even if the agent is persuaded otherwise.
At L4, containment replaces permission.
When you cannot approve each step, you need to be able to isolate, pause and stop. Sandboxes isolate a suspicious run, circuit breakers cut off loops and surges, and a kill switch revokes identity and credentials for one agent or a whole fleet. You also need discovery, because you cannot shut down an agent you did not know was running.
Two axes of AI risk in banking: autonomy and action-space
Autonomy alone leaves out half the picture. An L3 agent that can only update a ticket is a very different risk from an L3 agent that can release a payment. What the agent can reach matters as much as how freely it decides. In most banks, broad action-space concentrates in a handful of business lines: payment release, card and deposit credits, credit-limit changes in lending, and case disposition in AML operations.
So tier agents on two axes: autonomy level and action-space (which tools, which systems, read or write, reversible or not).
Banks already tier models by materiality. This extends the same instinct to agents: a model risk committee that tiers on two axes can answer, for any agent, how much review it needs before it goes live. The window to build that matrix is now. The same Bank of England and FCA survey found only 2% of respondents deploying agents with broad autonomy, and no more than 9% expecting agents to initiate, execute or block payments, or change limits, thresholds and controls.
Autonomy should be earned through promotion
The most common governance failure will be a quiet one: creep.
Someone removes an approval step because the queue is slow. A broader token is issued because it is easier than scoping three narrow ones. A new tool is connected because the protocol makes it trivial. Quietly, an L2 agent is operating at L3, and nobody re-ran the review.
The fix is to treat autonomy as something an agent earns, with evidence:
- Promotion criteria. Before an agent moves up a level, require evidence such as a stable override rate, low exception rate, tested policy adherence, and proof that blocked actions stay blocked.
- Demotion triggers. Define in advance what drops an agent back a level: a spike in overrides, repeated loops, a policy breach, an unexplained plan drift.
- A named owner and a review date for every agent’s current level, so the level is a recorded decision that someone owns.
What changes at L3 and L4: accountability
Up to L2, accountability sits in the moment: a person approved the action. From L3 upward, that moment mostly disappears. Accountability moves to design-time evidence (boundaries, tests, approvals of the policy itself) and post-hoc evidence (action lineage, sampled review).
That is a real shift for boards, regulators and responsible AI programs in banking, and it changes what the second pass of a model risk review has to look at: purpose, owner, permitted tools, data classes, autonomy level, approval points, log design, exception paths, and how to revoke the agent quickly if it misbehaves.
Supervisory expectations at L3 and L4 remain open. SR 26-2 calls generative and agentic AI “novel and rapidly evolving” and leaves their controls to each bank’s own governance practices, so banks that document autonomy levels now will shape good practice.
There is also a human cost. If employees only supervise agents, they can lose the skill the agent was meant to assist, and oversight without tradecraft becomes a signature on a screen. Training has to cover what the agent may do, what the person remains accountable for, and when to take the work back.
Govern the dial
Keep the model governance you have. It still catches a large class of failures, and an unvalidated model makes every agent built on it worse.
Waiting for an agent-specific rule is the expensive option. Retrofitting levels, boundaries and kill switches onto agents already in production costs more than designing them in. In EY-Parthenon’s 2025 survey of 100 retail and commercial banks, 79% of respondents said they would prioritize improving governance if they were to restart their GenAI implementation.
Stop asking one question of every agent. Ask how much autonomy it has been given, what it can reach, and what evidence supports that choice. If your framework cannot say who acted, under what authority, at what level of autonomy, on which system, and how you stop it, you are still governing a model. The agent has already moved on.
Pick the agent in your bank with the broadest write access. Could you show an examiner, today, its approved autonomy level, who signed that level off, and how quickly you could revoke its credentials?
Agentic AI Governance in Banking Starts With the Autonomy Dial: Key Questions Answered
1. What is agentic AI governance in banking?
Agentic AI governance is the set of controls that decides whether an AI agent is permitted to do what it does, and who answers for it. Model risk management asks whether a model is fit for purpose. Agentic AI governance adds a second question: was the system authorized to act, and can the bank reconstruct and stop that action?
2. Does US model risk management guidance cover agentic AI?
No. The revised interagency guidance issued by the Federal Reserve, FDIC and OCC on April 17, 2026 (SR 26-2), which replaces SR 11-7, states that generative AI and agentic AI models are not within its scope. It says a banking organization’s own risk management and governance practices should guide the controls for tools it does not cover.
3. What are the autonomy levels for AI agents in banking?
A working ladder runs from L0 to L4: L0 passive assistant (no tools, no actions), L1 advisor (read-only recommendations), L2 gated executor (every write needs approval), L3 supervised autonomy (acts alone inside defined boundaries and escalates exceptions) and L4 autonomous operator (sets sub-goals and coordinates other agents). The levels describe a design choice and carry no maturity ranking.
4. How should banks tier AI agents for governance?
Tier agents on two axes: autonomy level and action-space, meaning which tools and systems the agent can reach, whether it can read or write, and whether its actions are reversible. An L3 agent that can release payments needs the highest scrutiny, while an L0 or L1 agent with narrow reach needs only light-touch governance.
5. What is autonomy creep and how do banks prevent it?
Autonomy creep is when an agent quietly operates above its approved level, for example after an approval step is removed or a broader access token is issued. Banks prevent it by treating autonomy as earned: promotion criteria backed by evidence, demotion triggers defined in advance, and a named owner and review date for every agent’s current level.
About The Author
Anoop Karumathil Melethil has two decades of experience in conceptualizing, creating, and driving technology-focused marketing initiatives across tier 1 as well as mid-size global IT services organizations. He has built his expertise in building marketing functions from the ground up, encompassing areas including but not limited to media, public relations, influencer marketing, digital marketing, employer branding, thought leadership, brand outreach, field marketing, ABM, and internal communication.
Source
- Federal Reserve, FDIC and OCC, SR 26-2: Revised Guidance on Model Risk Management (April 17, 2026).
- SR 26-2 Attachment, Supervisory Guidance on Model Risk Management (footnote 3, scope; Section II, $30 billion relevance).
- Bank of England and FCA, Artificial intelligence in UK financial services, 2026 (October 26, 2026).
- KPMG, Q2 2026 AI Quarterly Pulse Survey: Banking (June 2026).
- EY-Parthenon, AI in banking: GenAI survey insights (September 19, 2025; 100 retail and commercial banks).
- IMDA, Model AI Governance Framework for Agentic AI (2026).
