Agentic AI and the Control Layer in Finance

Why autonomous financial systems need governance that works before, during and after execution

Artificial intelligence in finance is moving into a more consequential stage.

For years, most AI adoption in financial services was relatively contained. Models supported fraud detection, credit decisioning, document processing, customer support, market research, compliance reviews and operational automation.

Those use cases were important, but they were usually built around human-led workflows.

Agentic AI changes the question.

An AI agent is not only a tool that produces an output. It can chain together actions, interact with systems, make decisions within defined objectives and operate at speed across multiple steps.

In finance, that creates a different risk profile.

The issue is no longer only whether an AI model is accurate. The issue is whether an autonomous system can be governed, monitored, interrupted, explained and recovered when something goes wrong.

That is why agentic AI is becoming a regulatory and operational control question.

From model risk to action risk

Traditional AI governance often focuses on model risk.

Is the model biased?
Is the output accurate?
Is the model explainable?
Was the model trained and validated properly?
Can the institution document how it is used?

These questions still matter.

But agentic AI introduces another layer: action risk.

A financial institution may not only receive an AI-generated recommendation. It may allow an agent to execute a workflow: initiate a transaction, adjust a trading strategy, interact with a customer, monitor a portfolio, trigger an escalation, or coordinate several systems at once.

That creates new questions.

What is the agent allowed to do?

Who approved the objective?

How are limits defined?

Can the agent act outside expected behaviour?

How quickly can the firm stop it?

What evidence is created during execution?

Who is accountable if the agent causes harm?

These are not theoretical concerns. They are practical questions that need to be answered before agentic systems move deeper into financial operations.

Human oversight may not be enough

One of the most important points in the current regulatory debate is that “human in the loop” may not be enough.

In slower workflows, human review can be an effective control. A person can approve an output, check a recommendation or stop a process before execution.

But autonomous agents may operate too quickly, too frequently or across too many micro-decisions for manual oversight to remain realistic.

This does not mean humans become irrelevant.

It means oversight has to change.

Instead of relying only on humans approving every action, firms may need stronger system-level controls: pre-defined permissions, hard limits, escalation triggers, real-time monitoring, recovery procedures and the ability to stop activity quickly when behaviour becomes unsafe.

The control layer has to be designed into the system itself.

Trading, payments and operational workflows

Agentic AI could appear in many parts of finance.

In trading, autonomous systems could identify opportunities, react to market signals, adjust positions and execute strategies. The risk is that many agents may respond in similar ways during stress, amplifying volatility or liquidity pressure.

In payments, AI agents could eventually act on behalf of users or businesses: making purchases, renewing subscriptions, paying invoices, selecting payment methods or interacting with merchants. This raises questions about consent, authorisation, fraud, disputes, liability and customer protection.

In operations, agents could support investigations, onboarding, compliance monitoring, reconciliation, treasury workflows or customer servicing. These use cases may create efficiency, but they also require strong evidence trails and exception handling.

The common issue is control.

If an agent is allowed to act, the institution needs to understand the conditions under which it acts, the limits around those actions and the recovery path if the outcome is wrong.

The importance of kill switches and recovery design

The language of “kill switches” may sound dramatic, but the concept is simple.

If an autonomous system behaves unexpectedly, there must be a reliable way to limit, pause or stop it.

That is not only a technology feature. It is an operating model requirement.

A meaningful control framework should include clear thresholds, escalation routes, ownership, audit trails and recovery procedures. It should define who can stop an agent, under what conditions, and what happens after the system is paused.

For critical financial workflows, recovery design is just as important as prevention.

What happens if an AI-driven process corrupts data, triggers incorrect transactions, misroutes instructions, blocks legitimate activity or creates downstream operational disruption?

The answer cannot be improvised during an incident.

It needs to be designed in advance.

Accountability cannot be outsourced to the model

Agentic AI also creates an accountability problem.

If a system acts autonomously, responsibility still needs to sit somewhere.

Financial institutions cannot rely on the idea that “the model did it.” Regulators, customers, counterparties and internal governance bodies will expect clear accountability.

That means firms need to define ownership across the full lifecycle:

who selected the model, who approved the use case, who set the limits, who monitors performance, who handles incidents, who communicates with affected customers, and who is responsible for remediation.

This is where governance becomes practical.

AI policy documents are not enough. Firms need operating procedures that connect AI governance to compliance, risk, legal, technology, business ownership and incident management.

Cyber risk becomes more complex

Agentic AI also changes the cyber risk environment.

AI agents can help defenders detect vulnerabilities, test controls and respond faster. But the same type of capability can also be used by attackers to identify weaknesses, chain exploits, automate social engineering or scale attacks against financial institutions and critical third-party providers.

For financial services, this matters because the sector depends on a wide ecosystem: banks, fintechs, cloud providers, software vendors, market infrastructure, data providers, telecoms and energy systems.

A more autonomous cyber threat environment makes operational resilience even more important.

Security controls, patching discipline, third-party risk management and incident response need to keep pace with the speed at which agentic systems can act.

What financial firms should take from this

The practical lesson is not that firms should avoid agentic AI.

The lesson is that autonomy requires a stronger control architecture.

Before deploying agentic systems in material workflows, firms should ask:

What can the agent do?

What can it never do?

Which systems can it access?

Which decisions require human approval?

Which limits are hard-coded?

How is behaviour monitored?

What evidence is captured?

How can the system be stopped?

How is recovery handled?

Who is accountable?

These questions should be answered at the design stage, not after deployment.

The firms that manage this well may gain efficiency without losing control. The firms that move too quickly may create new forms of operational, conduct, market and cyber risk.

MetaNord’s view

At MetaNord, we see agentic AI as part of a wider shift in financial technology.

The industry is moving from tools that assist people toward systems that can act inside financial workflows.

That shift creates opportunity, but it also raises the standard for governance.

In financial services, innovation is only useful when it can operate with visibility, limits, accountability and resilience.

Agentic AI will not be judged only by what it can automate.

It will be judged by whether firms can control it.