Reading time ~12 mins

The Financial Stability Board finalises its twelve AI practices for financial firms and adds controls for AI agents, including checks that human oversight works. A study finds Microsoft 365 mail at every Dutch banking group under ECB supervision, new Dutch guidance treats AI added by software updates as a contract decision, and SEB joins a shared Swedish AI computing pool. US banks split three ways on customers' AI agents, Citi links its coding agent to lower vendor spend, and FIS sells an AI agent for money-laundering investigations. Nate B. Jones argues that a viral tool for taking software apart shows people what to ask AI to build.

Regulatory

The Financial Stability Board finalises its twelve AI practices for financial firms and adds controls for AI agents. Authority

On 15 October the Financial Stability Board, which coordinates financial regulators across the G20, published the final version of its Sound Practices for Responsible Adoption of Artificial Intelligence. This brief led with the consultation draft on 29 June. The twelve practices are nonbinding. Four cover governance across the organisation, starting with the board's role in aligning AI with the business model, risk appetite and strategy. Eight cover risk across the life of an AI system, from assessing each use case to human oversight, cyber risk and reliance on outside providers. The FSB calls them a toolkit to fit into existing frameworks and strongly encourages boards and senior management to use them. About 160 responses to the consultation shaped the final text. According to the FSB's overview of those responses, the main addition is a set of considerations for highly autonomous AI such as agents. The FSB says it did not fully consult on these and that they may still change.

Three changes stand out. Documentation should now let a firm reconstruct the actions an AI system took, particularly an agent's. Human oversight has to be meaningful rather than nominal or a box-ticking exercise. Overseers need the ability, authority and incentive to intervene. Firms should check that they do, for example by tracking how often people override AI recommendations. The practice on outside providers now covers AI built into bought software, concentration, exit plans and contract terms on liability for actions taken by autonomous agents. The listed forms of oversight also include kill switches that halt or slow an AI system. A new case study describes a large international bank whose in-house agent proposes card-fraud rules that analysts review and approve. It contributed to three quarters of the bank's card-fraud rules and helped cut fraud losses by more than 20% in the first half of its 2026 financial year. The FSB made no changes on systemic risk.

Singapore's agent framework and an MLCommons working group both asked for evidence that human approval of agent actions works, as this brief reported on 1 and 9 October. The ECB and De Nederlandsche Bank sit on the FSB, and the same demand now comes from it, in a text addressed to boards. Many bank agent pilots rest their risk case on a person approving each step, and that case now has a global reference that asks for proof the person intervenes.

Financial Stability Board: Sound Practices for Responsible Adoption of AI | Financial Stability Board: press release

Perspectives

Nate B. Jones argues that a viral tool for taking software apart shows people what to ask AI to build, rather than ending software Perspective

Nate B. Jones, an independent AI commentator, wrote on 15 October about REA, short for Reverse Engineer Anything, in a Substack post and a talk. REA is an open-source add-on for AI coding assistants such as Claude Code and Codex. It lets them investigate existing software, including programs whose source code the user does not have. In his free preview he describes the use: point the agent at an application or a supported browser session and ask how a feature works, and the agent explains the mechanism with REA's inspection tools. He writes that it had passed 200,000 stars on GitHub, the main site for sharing code, and topped its daily trending list. GitHub's public count stood at about 272,000 on 16 October. The loudest reactions call REA the death of software. Nate B. Jones says: "I think that misses how few people understand the software they're already using, much less the software they're trying to build."

His argument is about requirements, the description of what software must do. Nate B. Jones says: "That gap between the business requirement and how something's put together is one of the hardest problems in tech." He links it to software built by describing it to an AI, often called vibe coding. Nate B. Jones says: "It's why so much of what people vibe code looks right and falls apart soon after it's launched." His example is the percent button on the Windows calculator. Enter 200 plus 10% and it gives 220. Enter 200 times 10% and it gives 20. A request for a percent button says nothing about that difference. The same hidden context sits in business features: when the clock starts for a reminder, which permissions change when a request is approved, how much work an undo removes. Nate B. Jones says: "Sometimes seeing how a system works is what lets you recognize the requirement in the first place."

His larger case is an accounting application. A community developer used REA to investigate parts of QuickBooks Desktop, then wrote an independent application in Python and SQLite rather than a copy. The free preview says the author published the investigation with the comparisons used to check the new software. Nate B. Jones says: "If all you do is copy an accounting screen, you can reproduce where the number appears without understanding how that number was produced." The meaning sits in the calculations and the ledger, he argues. Recording a payment raises linked questions: whether it covers the whole invoice, whether one payment can cover several, what stays outstanding. That is why he thinks the people who know the work gain most, such as someone who handles invoices every day and knows which mistakes create extra work. In his view engineering is moving from understanding a system toward deciding how it should behave, and a person still decides what to build.

The talk also sets limits. REA shows only the code that runs on the user's own device. A company's private server code stays out of view, and trying to reach it would be hacking. Capable coding agents could already do this with careful prompting, the talk adds, so REA mainly makes it simple. His evidence is published investigations and community projects, not measured results, and the post is written for individual builders. For subscribers, his post adds which programs a reader is permitted to examine with the tool.

For a bank, the argument meets two groups. Business teams that now describe tools to AI builders, an approval flow or a payment reminder, face the gap he describes, and what they leave unsaid is where such a build fails. The code a bank's mobile and web apps place on customers' devices is the client-side kind REA opens. A free add-on to coding assistants many developers already use can now help anyone who installs it get that code explained in plain language.

Nate's Substack (By Nate B. Jones)

Netherlands & Sovereignty

New Dutch guidance tells public buyers to treat an AI feature added by a software update as a contract and risk decision. Authority

iBestuur, a Dutch trade publication for the public sector, reported on 13 October on a new guide for government buyers, developed under the Dutch Digitalisation Strategy. It covers software updates that add AI functions after the product was bought. Its core advice is not to treat such an update as a routine change. Buyers should agree in advance that suppliers report AI updates in time and, where possible, that a new feature is switched on only with the buyer's consent. A substantial change can have consequences under procurement law, so buyers should check whether it still fits the original contract. They should check what data the feature processes and whether their data trains the supplier's models, and agree terms on liability, explainability, human control and access to their own data. They should also name internal owners to keep checking future updates. The guide is advisory and written for public buyers, and this account rests on iBestuur's summary. Its contract points apply to any organisation that buys software. Today's final FSB practices make the same point for financial firms, now that they cover AI built into bought software. A bank's AI inventory starts from systems the bank chose to deploy, and a feature switched on by a supplier's update can reach staff without passing through it.

iBestuur

A study of public internet records finds Microsoft 365 mail at all six Dutch banking groups under ECB supervision, and at none of nine French groups. Advisory

Lindstead, a Dutch advisory firm, published a snapshot of public DNS records, the internet's address entries, taken on 4 October for institutions licensed by De Nederlandsche Bank. Of the 360 whose domains receive mail, 282, or 78%, showed strong evidence of mail running on Microsoft 365. All six Dutch banking groups under ECB supervision showed it, against none of the nine French banking groups the study compared. A tenant is one customer's own space inside Microsoft's cloud, and 52 of 111 Dutch pension funds send mail from one of five shared tenants, often their administrator's. 55 of 328 organisations had verified their domains with OpenAI or Anthropic, which the study says does not show actual AI use. It also says DNS records cannot show contracts, workload volumes, where core systems run or whether staff use Copilot, Microsoft's AI assistant. Lindstead sells advice on digital dependency, and no one has yet repeated the count. On 15 October this brief reported that the Dutch Tax Administration is pulling back from Microsoft's cloud. The reliance of all six Dutch groups, the bank included, on one mail provider can now be read from outside by a supervisor or a journalist. They can set it against each bank's register of critical technology providers under DORA, the EU's operational resilience law.

Lindstead

SEB starts using a shared AI computing platform that it set up with four Swedish industrial firms. Corporate

Skandinaviska Enskilda Banken (SEB), the Swedish bank, said on 15 October that it has started using Sferical. The platform is a shared AI system set up with AstraZeneca, Ericsson, Saab and SKF and run in Sweden on about 1,200 NVIDIA graphics processors, the chips that train and run AI models. Each partner's computing and data stay separate, while the platform lets them collaborate. SEB will first use it to give staff ready-to-use AI services. The bank says the platform gives it more flexibility and control, supports a controlled roll-out with security and governance, and reduces its reliance on any single provider. It published no figures on cost, capacity or workloads. On 15 October this brief reported that Starling is training its own transaction model on a UK-owned cloud. SEB shows a third route beside a hyperscaler and a national facility: computing capacity pooled with large companies from other sectors. In the Netherlands the national option, the Groningen AI Factory, is not due to be fully operational before early 2028, and no similar pool of Dutch firms has been announced.

SEB

Industry & competition

Bank of America and Wells Fargo help design a protocol for customers' AI agents, while Schwab blocks agents it has not authorised. Media

On 14 October this brief reported that BBVA had joined the design of the Personal Agent Protocol, led by Meta and by Sierra, a firm that builds AI customer-service agents. Sierra published a draft on 9 October and named 35 new design partners, among them Bank of America, Wells Fargo, Synchrony, Visa, Mastercard, PayPal and Adyen. In the draft, a company publishes one file at a standard web address. A customer's agent identifies itself, the customer signs in, and the agent receives a token limited to the access the customer approved. Sierra's post does not address liability. American Banker reported on 15 October that Schwab blocks AI agents it has not authorised and points clients to Charley, its own assistant. Schwab cites the risk that agents such as Meta's Muse could compromise client data. Some observers, the outlet writes, see the block as protecting Schwab's cash business. The Verge reported the same day that Bank of America's chief executive, Brian Moynihan, wants people to authorise payments made by AI agents until the risk of agent errors falls. His concern is that customers would turn to their bank after an agent's mistake. Both outlets are paywalled, and these accounts rest on their published summaries. U.S. Bank's chief executive said this week that the bank has not yet seen outside agents moving customers' deposits between banks. Large US firms now hold three positions on the same question: admit agents under a shared protocol, block them, or have a person approve each payment. Moynihan's reason holds under all three, since a customer whose agent pays the wrong party calls the bank, whoever built the agent.

Sierra | American Banker: bring your own AI agent | American Banker: Schwab | The Verge | PYMNTS

Citi says 14,000 of its engineers use an AI coding agent, and links bringing work in-house to a 30% fall in technology vendor spend. CxO voice

On its third-quarter results call on 13 October, Citi's chief executive Jane Fraser said 14,000 engineers use Devin, an AI agent that writes and changes code. She linked more in-house technology work to a 30% year-on-year fall in spending on technology vendors, and said products launch 30% to 40% faster as AI speeds up development. About 100 of Citi's most manual processes have been or are being redesigned end to end with AI and automation. AI tools for client-service staff operate in 82 countries, and Citi reports client response times 21% faster. Fraser said this year's financial benefits from AI and automation significantly exceed the investment, without giving a figure or a method. This brief carried Citi's earlier adoption figures on 24 September and 1 October; the coding and vendor-spend figures are new. Citi gave no baseline for any of them, and did not say how much of the vendor saving comes from AI rather than its wider transformation programme. A global peer now presents an AI coding agent as a reason to bring outsourced technology work back in-house. That moves agentic coding from a developer productivity question to a sourcing question, the kind settled in multi-year outsourcing contracts.

Citigroup: third-quarter 2026 earnings call transcript

Innovation

FIS offers any US bank an AI agent for money-laundering investigations that cannot close a case without an analyst. Vendor

FIS, a large supplier of banking software, said on 15 October that its AML Investigations Agent is commercially available to any US bank, including banks that are not FIS clients. AML stands for anti-money laundering. FIS built the agent with support from Anthropic, and it runs Anthropic's Claude models in FIS's private cloud. FIS says the agent links each recommendation to the underlying records, logs an audit trail and keeps each bank's investigation logic separate from other clients'. An analyst must confirm before any case can close. Amalgamated Bank, a US bank, is a design partner and has begun deployment. The time savings FIS cites for reviewing alerts, investigating cases and drafting suspicious activity reports are projections from workflow analysis, not measured results. A supplier of core banking software now sells financial-crime investigation as a packaged agent. Its record of each step and its analyst sign-off match what today's FSB practices ask of agents, and the FSB also asks firms to check that such sign-offs are real rather than nominal.

FIS