The Financial Stability Board, which coordinates financial authorities from 24 jurisdictions and delivers reports to the G20, released the final version of its guidance on how banks, insurers and other financial institutions should adopt artificial intelligence on October 15, 2026. The report sets out 12 sound practices and, compared with the draft circulated for comment in June, gives far more attention to AI agents: systems that can plan and carry out multi-step tasks with limited human involvement.
The practices fall into two groups. Four deal with governance across the whole organisation: the job of boards and senior executives in matching AI adoption to strategy and risk appetite, clearly assigned roles, folding AI risk into existing risk frameworks with proper documentation, and continuous learning. The other eight follow a system through its life, from judging how material each use case is and choosing the technology, to data governance, explainability, performance evaluation, human oversight, cyber and ICT risk, and reliance on outside AI providers.
The agentic material is the most concrete change. The final text tells institutions to pair human oversight with deterministic controls written into the "control plane", the technical layer that decides what an agent is permitted to do. Examples include barring agents from actions outside the firm's risk appetite, running them in isolated environments where possible, and setting thresholds that force an agent to get a person's sign-off, for instance before a payment above a set value or a step that could cause irreversible harm. Goals should be split into discrete stages with checks between them. The report also describes kill switches, tested in advance, that can pause an agent or cut its access to systems and tools, plus red-team exercises to see whether an agent escalates to a human or halts safely when a task goes wrong.
Record-keeping gets similar treatment. Firms are expected to give each agent a unique identifier so it can be told apart from human users, and to keep traces showing what set off an action, which tools and data it touched and what steps followed. Every agentic use case should have a named accountable person, and contracts with outside providers should spell out legal liability. Where real-time human review is impractical, the FSB accepts AI-based monitoring of agents, while stressing that institutions and people keep ultimate responsibility.
Reuters reported that the board also dropped wording from the June draft that suggested firms treat AI agents like "synthetic employees" when assigning controls. That phrase does appear in the consultation version, and the final report instead says agents do not reason like humans and can read predefined goals in ways nobody intended. The FSB said consultation feedback also led it to widen its discussion of benefits and risks, including AI as a workforce multiplier alongside the danger of deskilling, and to add material for smaller institutions and on third-party AI risk.
The release lands as financial authorities sharpen their focus on AI. FSB Chair Andrew Bailey, who is also Governor of the Bank of England, flagged AI-related risks in a letter to the G20's finance ministers and central bank chiefs, written before their October 15 meeting, and listed the finalised practices among the reports delivered to the group.
The guidance has clear limits. The FSB says the practices do not create an international standard, do not prescribe how firms should adopt AI and do not replace local legal requirements. Its leverage comes from its membership of national authorities, which can lean on the text in supervision, and from its explicit request that boards and senior executives use it when they revise their AI governance frameworks. The board also concedes that its treatment of agentic and multi-agent systems is still early and may need fuller coverage as the technology matures.