The global supervisory architecture for agentic AI is shifting from theoretical debate to operational reality. By delivering its final report on Sound Practices to G20 Finance Ministers and Central Bank Governors in Bangkok, the Financial Stability Board has effectively signaled that the era of unconstrained autonomous experimentation in finance is closing. While these 12 practices remain non-binding, they establish a baseline for risk management that institutions ignore at their own peril, as detailed in the accompanying letter from FSB Chair Andrew Bailey.
The Human-in-Command Mandate
At the core of this framework is Sound Practice 10, which mandates a shift toward a human-in-command model. The FSB acknowledges that traditional, decision-by-decision review is incompatible with the velocity of autonomous systems. Instead, the board requires firms to focus on high-level oversight, specifically defining autonomy boundaries and setting guardrails rather than attempting to audit every individual output.
For agents handling financial transactions, Sound Practice 10 imposes a significantly more rigorous set of controls. To mitigate systemic risk, the framework requires institutions to implement human approval or dual authorization for any transaction exceeding a specific threshold value. Furthermore, it demands restricted access to payment systems and the maintenance of comprehensive audit trails for every transaction an agent executes. As these systems scale, the FSB explicitly expects firms to deploy AI-in-the-loop monitoring—using AI to oversee other AI—to supplement human supervision.
From Non-Binding to De Facto Requirement
Although the FSB’s guidance lacks the force of law, its influence on the operating environment is substantial. National regulators, including the Federal Reserve, OCC, FDIC, SEC, and CFPB, typically translate such international frameworks into concrete examination requirements. As Federal Reserve Governor Michelle Bowman noted in July 2026, regulators are expected to align with existing frameworks and tailor expectations to use-case materiality. Legal experts at Skadden have observed that the framework is likely to influence supervisory practice despite being nonbinding, making it prudent for firms to benchmark their current governance against these standards immediately.
The Liability Vacuum
The FSB’s intervention arrives during a period of legislative paralysis. The Warner AI AGENT Act, which would treat AI agents as fiduciaries, has stalled in the Senate Commerce committee, while the Hawley-Murphy AI Agent Accountability Act remains without committee action. In this void, the industry is effectively writing its own rules. Consumer-facing agents like Meta’s Muse and xAI’s GrokBot are already operating under vendor-defined liability terms, while the tools-not-actors doctrine championed by some observers seeks to place liability on developers rather than users.
As detailed in our Policy Radar, the legal status of the agent itself remains an open, urgent debate. The FSB provides a structure for internal governance, but it does not resolve the external legal liability of autonomous actions. For a deeper look at how these standards intersect with current market trends, see our recent FSB piece. The standing question remains: who answers when an agent’s purchase, booking, or email goes wrong? For builders and investors, the immediate task is to align with these emerging supervisory expectations while navigating a landscape where the law is still catching up to the code.