The Framework Your Pilot Is Waiting For Does Not Cover It

In April 2026, US banking regulators replaced fifteen-year-old model risk guidance and, in a footnote, placed agentic AI outside it. By October, Brussels and Singapore had moved as well, and London had confirmed it would rely on the framework it already had. Read together, these positions leave the governance of AI agents in banks to each bank's own policy. For a BFSI global capability centre in India waiting for its parent to approve agentic work, that is the most consequential regulatory fact of the year, and the easiest to miss.

The pattern runs roughly like this. A centre builds an agent for an operations workflow: periodic KYC refresh, say, or break resolution in reconciliations. It clears the centre's own architecture and information security review. It performs well on test cases. It goes to the parent's model risk function for approval, and stops.

Nobody says no. Questions arrive in rounds. Is this a model? If it is, which tier, and how does the validation team assess the conceptual soundness of a foundation model the bank did not build? If it is not, which policy governs it? The group AI policy, typically written for predictive models and productivity assistants, says little about a system that updates customer records on its own. So the pilot is extended, and then extended again.

The Bank of England heard a version of this from the banks it supervises. Its summary of industry roundtables, published in February 2026, reported that second-line risk functions "continue to approach the use of AI with caution", which participants said may delay deployment pipelines. That is usually read as a capacity problem. It is better read as a scope problem.

Each of the regimes a typical BFSI parent answers to moved this year. None of them closed the question.

United States. On 17 April 2026 the Federal Reserve, OCC and FDIC issued revised model risk guidance, SR 26-2 (OCC Bulletin 2026-13), replacing SR 11-7. It is most relevant to banking organizations with more than $30 billion in assets. A footnote describes generative and agentic AI as novel and rapidly evolving and places them outside its scope, pointing banks to their broader risk management and governance practices instead. The agencies said a request for information on AI would follow; as of late October 2026, none had been published. Meanwhile, on 13 October 2026, Reuters reported that the same three agencies were putting written and verbal questions to banks of every size about their AI agents: what limits apply, how actions are monitored and approved, whether decisions can be tracked and audited, what keeps an agent within its authority, whether people stay involved in key decisions, and how the systems would be shut down. The report was framed largely around cyber risk, and its sources said supervisors were still gathering information rather than prescribing.

Singapore. On 7 October 2026 MAS issued Guidelines on AI Risk Management. Unlike SR 26-2, they cover all forms of AI, agents included. Oversight and risk management expectations apply from 7 October 2027, and life cycle controls by 7 October 2028. Institutions may draw on their group's AI framework, provided it meets the guidelines. MAS intends to consult in 2027 on what further guidance on agentic AI would be useful.

European Union. The AI Omnibus, published in the Official Journal on 24 July 2026, moved the obligations for stand-alone high-risk systems, which include credit scoring and creditworthiness assessment, from 2 August 2026 to 2 December 2027.

United Kingdom. PRA SS1/23 has applied since 17 May 2024 to banks with internal model approval for regulatory capital. It is technology-agnostic and was designed to capture AI models. In a letter of 1 April 2026, the Bank of England and PRA said they would keep applying that framework rather than write AI-specific rules, and they have set no expectations specific to agents. Whether a system that takes actions is a model under SS1/23 is a question each bank answers for itself.

The routes differ; the destination is the same. As of November 2026, how an AI agent in a bank is governed is settled by the bank's own policy. For a GCC, that means the parent's policy, and the parent's second line interpreting it.

It is tempting to treat this as a delay: headquarters will update the policy, and approvals will then flow. That misreads the problem.

Model risk management was built for a model whose output a person then uses. A credit score informs an underwriter. A forecast informs a treasurer. The control sits between the output and the decision: validate the model before use, monitor its performance afterwards, and rely on the person acting on the output to catch what validation missed.

An agent's output is the action. It sends the customer message, closes the alert, posts the adjustment. By the time anyone reviews the output, it has already happened. The control therefore has to sit in the execution path: what the agent is permitted to do, up to what limit, with which approvals, leaving which record, and how it is stopped. A validation report produced before deployment cannot carry that weight, however rigorous. Participants in the Bank of England roundtables made a related point: validation centred on how inputs map to outputs is not tenable for complex AI systems, and agents strain the idea of a human in the loop.

An agent is also not one model. It is a model, instructions, tools, permissions and data, and a change to any of them changes its behaviour. A framework organised around a model inventory and a periodic validation cycle does not stretch to that by adding a paragraph. That is why policy rewrites take time, and why waiting for one is a weak plan.

Set aside the question of which framework applies. To approve an agent in production, the parent's second line needs a short list of things:

• An inventory entry, so the system is known, owned and counted.

• A materiality tier, set by what the agent can touch and how reversible its actions are.

• Defined human review thresholds, stating which actions need approval before they execute and which are sampled after.

• A kill path: a tested way to stop the agent, revert to the manual process and keep the workflow running.

• Decision logs detailed enough for a reviewer to reconstruct, a year later, what the agent saw, what it did and under whose authority.

• A named owner in the business, accountable for the workflow's outcomes.

None of these depends on which regime the parent sits under. Inventory and risk materiality assessment are explicit in the MAS guidelines. The questions US supervisors were reported to be asking in October 2026 map almost one for one onto the list. A control set built to this list can be designed to map to every regime above without waiting for any of them to settle.

The centre does not need headquarters to write the agentic policy first. It needs to build controls the second line can test.

In practice that means four things. Choose a first workflow where actions are bounded and reversible: KYC and AML operations, reconciliations and servicing are typical candidates, and claims operations for insurer parents. Build the controls into the workflow itself, not into a document beside it. Map each control to the regimes the parent answers to, in the parent's own risk taxonomy, and to India's DPDP Act for the personal data the centre processes, whose core obligations apply from May 2027. Then hand the second line an evidence pack it can test: control descriptions, test results, log samples and a kill path that has been drilled.

This keeps each line of defence where it belongs. The centre, as first line, builds and operates the controls and produces the evidence. The parent's second line validates them. The centre is not asking anyone to take its word; it is giving the second line something to examine. It also hands headquarters a working answer to the question regulators have left open, which is more useful than another memo asking for one.

Waiting is also a decision. A pilot extended into a third quarter is a decision not to learn what production would have taught, and to let the business case age.

Regulators told banks, in four different ways this year, that the agentic question is theirs to answer. Within the bank, the centre closest to the work is best placed to answer it, provided it builds so that the answer can be checked. The centres that do will ship. The ones waiting for a framework that was never written for what they built will still be waiting when the rules move again in 2027.

How Kalmi maps these controls for capability centres: kalmi.tech/gcc.