The Financial Stability Board has published its final set of 12 sound practices for AI in banks and other financial firms, a toolkit meant to help them use AI without putting the financial system at risk. The guidance covers everything from board oversight to AI agents that act on their own. It is voluntary, but supervisors in major economies are expected to treat it as a benchmark for how banks should manage AI.
What the FSB Guidance on AI in Banks Covers
The Financial Stability Board, or FSB, coordinates financial regulators across 24 countries and jurisdictions, including the United States. It is chaired by Andrew Bailey, the Governor of the Bank of England, and is based in Basel, Switzerland.
The final report, released on October 15, 2026, follows a draft version the group put out for public comment in June. Alongside the final text, the FSB also published a summary of the feedback it received on that draft.
The board says firms should treat the practices as a flexible toolkit rather than a checklist. Each bank, insurer, or asset manager can tailor them to its own size, business, and risk level, and fold them into the cyber and vendor risk systems it already runs.
Why Regulators Are Paying Attention Now
Banks have used machine learning for years, but generative AI and autonomous agents raise the stakes. The FSB warns that as AI spreads, it may amplify existing risks and introduce new ones. The guidance zeroes in on a few areas:
- Models whose decisions are hard to explain or challenge
- AI agents that might read their goals in ways people never intended
- Cyber threats that target AI systems or use AI to attack
- Heavy reliance on a small group of cloud, chip, and model providers
- Poor data quality and weak tracking of where data comes from
The FSB also makes a point that may surprise some critics. It says firms face risks from not adopting AI too, including weaker competitiveness and less ability to spot and handle cyber threats.
The 12 Sound Practices at a Glance
The FSB splits its practices into two groups. The first four deal with how a whole organization governs AI, and the other eight follow an AI system through its life, from the first idea onward.
| Group | Practice | In plain terms |
|---|---|---|
| Governance | Board and senior management role | Leaders set AI strategy and match it to risk appetite |
| Governance | Governance framework | Clear roles and accountability for AI |
| Governance | Risk management and documentation | Track every AI use and fold it into risk systems |
| Governance | Continuous learning | Keep adapting as AI changes |
| Lifecycle | Materiality and risk assessment | Judge each use case at the start and as it grows |
| Lifecycle | Technology selection | Pick the right AI tool for the job |
| Lifecycle | Data governance | Keep data accurate, secure, and traceable |
| Lifecycle | Explainability | Understand AI decisions or add extra controls |
| Lifecycle | Performance evaluation | Keep checking that AI works as expected |
| Lifecycle | Human oversight | Real human control where it matters |
| Lifecycle | Cyber and ICT risk | Defend against attacks on and through AI |
| Lifecycle | Third-party dependencies | Manage the risk of outside AI vendors |
New Attention on AI Agents
The biggest changes since the June draft involve agentic AI, meaning systems that carry out multi-step tasks with little human help. Firms are expected to keep records good enough to trace and rebuild what an agent saw, decided, and did after the fact.
Human oversight scales with the stakes. Higher-risk or hard-to-reverse actions, such as large financial transactions, call for a person to sign off, while smaller tasks can run on their own if there is a solid audit trail. Similar ideas show up in tools like ServiceNow’s new agent permission controls.
The FSB also dropped an earlier idea of treating AI as “synthetic employees.” Its reasoning is that AI agents do not reason like people, and their behavior can shift as they gain new tools or prompts. The board admits its thinking on agents is still developing and may change.
Why AI in Banks Needs a Shared Playbook
Vendor risk got sharper treatment too. Banks are expected to do AI-specific checks on their providers, plan for outages, and secure contract rights such as audit access, data portability, and a clean exit if a service ends.
There is also a gap closer to home. According to Tech Times, the main US model risk guidance updated by bank regulators in April explicitly leaves generative and agentic AI out of scope, and no replacement timeline has been set. That makes the FSB toolkit one of the few detailed references American banks can lean on for now.
Bank security teams are already feeling the pressure from AI-powered attacks. Bank of America, for example, recently brought in extra help to fix AI-found flaws, and many firms now rely on AI threat detection to fight back.
What This Means for You
You will not read the FSB report at your bank branch, but its ideas could shape how your bank uses AI on your accounts. Here is what to keep in mind:
- Expect more AI in fraud alerts, loan reviews, and customer service, with people still signing off on high-stakes moves.
- If an AI-driven decision affects you, the push for explainability may make it easier to get a reason.
- Stay alert to AI-powered scams, since cyber threats are a named risk in the guidance.
- If you work in finance, check your company’s rules before using any AI tool, because workplace AI governance is getting stricter.
Business owners outside banking can borrow the same playbook. Knowing where AI is used, who is responsible for it, and what happens if a key vendor fails is good practice for anyone adopting AI business tools. You can find more stories like this on our AI news page.
Sources
This article is based on the official announcement from the Financial Stability Board, with added detail from Tech Times and PYMNTS.
Conclusion
The Financial Stability Board’s 12 sound practices give banks and other financial firms a shared playbook for adopting AI responsibly. They stress strong board oversight, careful risk checks for every use case, real human control, and close watch over vendors and AI agents. The guidance is voluntary and flexible, so smaller firms can scale it to fit. Still, as AI spreads through lending, fraud detection, and customer service, this toolkit is likely to become a benchmark that regulators and banks measure themselves against.
