Agentic AI in finance: controls to set before it acts

Before you let an AI agent actually do things in your finance team (post a journal entry, release a payment, change a number in a report, approve or decline an applicant), set three controls first: a clear boundary on what it may do on its own, a full audit trail of every action it takes, and a way to switch it off fast. Those three are what US bank examiners are pressing on right now, and the good news is they sit on top of rules your model risk people already know.

A chatbot that drafts a reconciliation is one thing. An agent that acts on its own is another, and the line you draw between them is most of the job. Draw it wrong and you've handed an irreversible action to software you can't fully explain. Draw it right and you get the speed without betting the close on it.

Agentic AI in finance: where to let an agent act, and where to stop

Sort every task by two questions. First, can the action be undone? Second, does a person or a regulator need to be told why it happened?

Low-risk work is reversible and hurts nobody outside if it's wrong: pulling data, drafting a reconciliation, flagging anomalies for a human to check, writing a first pass of the variance commentary. Let the agent run on these and have a person review the output. That's where the time savings live, and the downside is small.

High-risk work is the opposite. Moving money, posting to the ledger during close, filing a return, denying someone credit: these are hard or impossible to undo, and some of them owe an explanation to a customer or a supervisor. Here the agent proposes and a named person approves. Don't let an agent take an irreversible action on its own just because it technically can.

The credit desk is the sharp edge. The moment an agent declines an applicant, legal duties kick in, and "the model did it" is not a defense. If you run AI anywhere near lending decisions, read how the decisioning side of this is moving faster than most lending policies before you wire an agent into it.

Take the AI check: 10 questions, about 3 minutes, and see where AI would pay off first in your firm.

Agentic AI governance: the audit trail and kill switch examiners ask about

The questions supervisors are asking are practical: can you see what the agent did, can you audit it after the fact, and can you stop it quickly? None of that is new ground.

The model risk management guidance US banking agencies have used for years is built on "effective challenge," which it defines as "critical analysis by objective, informed parties who can identify model limitations and assumptions and produce appropriate changes." It also puts the duty in one place: it is "senior management's responsibility to ensure effective challenge takes place." An agent doesn't change that. Someone senior owns it, and someone independent has to be able to push back on it.

And this is live, not hypothetical. The Financial Stability Oversight Council named the use of AI in financial services a vulnerability for the first time in its 2023 annual report. Treasury then ran a request for information on AI and got 103 comment letters back from the industry and others. Expectations are forming in the open. Build your paper trail now, while it's cheap, instead of reconstructing it under exam.

AI agents risks for finance teams: the controls to set first

If I were standing an agent up, I'd start here, in this order:

Least privilege. The agent gets access to exactly what its task needs and nothing more (one system, read-only where it can be, a scoped service account, etc.). Most of the damage comes from an agent that can reach further than its job.
A human gate on anything irreversible. Payments over a threshold, close postings, customer-facing decisions: the agent prepares the work, a person releases it.
A complete, tamper-proof log. Every action, with inputs, outputs, timestamp and the model version that ran. If you can't replay what happened, you can't audit it, and you can't defend it.
A named owner. Not "the AI team," a person. (Same reason nobody on your team wants to be the one who can't say who approved a payment.)
A kill switch you've actually tested. A shutdown that's never been pulled isn't a control, it's a hope. Pull it in a drill and time how fast the agent really stops.
A dry run before production. Let it propose for a full cycle while a human does the real posting, then compare the two.

One more for anyone touching credit: the CFPB has made clear that even for adverse decisions made by complex algorithms, creditors must provide accurate and specific reasons. An agent that declines people still owes each of them a reason they can act on. And keep sensitive inputs out of tools you don't control, which is a whole discipline of its own: here are five things your team should never paste into a public AI tool.

Frequently asked questions

What is agentic AI in a finance team?

An AI agent is software that doesn't just answer questions, it takes actions toward a goal across several steps and systems: it can pull data, post entries, send payments, or approve and decline. The difference from a chatbot is that it does the thing rather than describing it. That's exactly why the controls around it matter more than they do for a tool that only drafts text.

Where should an AI agent never act on its own?

Anywhere the action can't be undone or owes someone an explanation. Moving money, posting to the ledger at month-end close, filing with an authority, and credit decisions all fall here. Let the agent prepare the work and have a named person approve it. The CFPB has made clear that even for adverse decisions made by complex algorithms, creditors must provide accurate and specific reasons, so an autonomous decline is a real risk, not a convenience.

What audit trail do regulators expect for AI agents?

In practice, enough to reconstruct and challenge any action: what the agent did, when, on what inputs, with which model version, and who approved it. US model risk guidance frames this as "effective challenge" by objective, informed parties, and it makes senior management responsible for ensuring that challenge happens. If you can't replay an action and show who owned it, you don't really have a trail.

Can agentic AI help the month-end close?

Yes, for the reversible parts: pulling balances, drafting reconciliations, flagging variances for a human to review. Keep the irreversible postings behind a human gate. If your close is painful enough that you're reaching for an agent to fix it, start with the design: your month-end crunch is a design choice, not a law of nature.

Sources

FDIC, 2017 (fdic.gov)
U.S. Department of the Treasury / Federal Register (govinfo.gov), 2024-06-12 (govinfo.gov)
U.S. Department of the Treasury, 2024-12 (home.treasury.gov)
Consumer Financial Protection Bureau, 2023-09-19 (consumerfinance.gov)