Reading time ~15 mins

Hong Kong's banking supervisor turns the FSB's final AI practices into bank expectations, and the UK's FCA lists AI controls it has seen fail. Bank of America puts about 4,000 people on flaws found by frontier AI, and JPMorgan stresses its whole balance sheet for a turn in the AI market. Two studies find agent benchmarks overstate reliability. EY argues AI cannot pay for itself through staff cuts alone.

Regulatory

Hong Kong's banking supervisor turned the FSB's final AI practices into expectations for every bank it licenses on the day they appeared. Authority

The Hong Kong Monetary Authority (HKMA) issued guidance on responsible AI adoption to all authorised institutions on 15 October, the day the Financial Stability Board (FSB) published its final AI practices. It cites the FSB text and replaces 2019 principles. Every AI use case needs a named owner and an entry in an inventory recording its purpose, provider, model, risk class and key controls. Tools outside that inventory are to be restricted, including staff use of unapproved AI. Material or higher-risk uses need independent validation, and the more material ones a built-in kill switch or equivalent that can suspend the system, revoke its access and stop further actions. Contracts should bar AI providers from training on customer data or confidential information unless the bank authorises it. Defences against data poisoning and planted instructions should not rest on a model's instructions or filters alone. The guidance binds only institutions authorised in Hong Kong. The FSB text, reported here on 16 October, lists kill switches among several forms of oversight. The HKMA made one a standing expectation for material uses on the day of publication. The ECB and De Nederlandsche Bank helped write the FSB text, so the HKMA version is an early sign of how supervisors may apply it.

Hong Kong Monetary Authority

The UK's conduct regulator listed the AI practices it has seen work and fail at financial firms. Authority

The Financial Conduct Authority (FCA) published examples of good practice and areas for improvement in firms' use of AI, dated 19 October. They cover machine-learning, generative and agentic AI across consumer protection, governance and operational resilience. Good practice includes a central register of agents showing which are live, who owns them and which systems and data they can reach. Firms are expected to show that their controls work in practice, and to build checks into the system rather than rely only on a person reviewing outputs. The weaknesses it lists include human review that became a box-ticking exercise, risk and audit teams without AI-specific skills, untested vendor assurances, and reliance on hard-to-replace AI providers with no exit option. In one case a safeguard that reduced model drift made a tool's answers so generic that it steered some customers to unsuitable options. The FCA says the examples create no new rules, and they bind only UK firms. The final FSB practices ask firms to check that human oversight works. The FCA's list shows what failing that check looked like at real firms, a reference internal audit and EU supervisors can use without any new UK rule.

Financial Conduct Authority

Perspectives

EY argues that AI cannot pay for itself through staff cuts alone Advisory

EY published the second paper of its Total Cost of Agents series, which asks whether AI can pay for itself. Its named authors include Dan Diasio, EY's global consulting AI leader, and Greg Daco, chief economist of EY-Parthenon. The deck is undated. Tony Moroney, who writes on digital change in financial services, shared it on LinkedIn on 17 October without adding a view of his own. EY starts from the token, the unit AI providers charge for. By its estimate the token is about a third of what an agent costs to run, and the full enterprise cost of AI is roughly three times the token invoice. It gives no method for the estimate. Much of the rest sits in governance, organisational change and failed work, lines EY says budgets usually leave out.

The paper then asks what AI has to earn. EY argues that AI providers are moving from introductory, investor-funded prices to recovering their full costs, from data centres and chips to compliance. It models a 12% return on projected AI spending, which Gartner puts at $2.6 trillion this year. To earn it by 2031, white-collar industries in upper-middle and high-income countries would have to cut about 15.8% of their labour cost, one dollar in six, or grow output by 10.5%. If only the richest economies carried the bill, the cut needed would rise to 52.1%. EY calls these figures illustrative, not forecasts.

From there EY separates two routes. Savings reachable through hiring freezes cover only part of the required return, beyond which savings require layoffs, and each year of waiting raises the bar. Across the economy, it argues, cuts alone cannot pay for the build-out, because one firm's payroll is another firm's revenue, while the debt on AI infrastructure falls due on schedule. A single firm can still earn a return from lower costs. Its worked example is a regional bank that aims the same models and agents at growing the value of each client relationship rather than at the cost of serving it. EY would count time saved only once it turns into output or revenue, and give one executive authority to scale, pause or stop each deployment.

Finance is among the industries EY expects to benefit most, so a bank's 2027 AI plans sit inside this arithmetic. On EY's ratio, a business case priced on model fees sees about a third of the running cost. A plan whose savings assume more than normal staff turnover is a plan for layoffs, a question for the works council as well as for finance. JPMorgan's finance chief, in today's Industry section, said token costs will offset some AI gains and that he has stopped putting a number on them.

EY via LinkedIn (By Tony Moroney)

Maria Sukhareva argues that open-weight AI models give a buyer control, not transparency Perspective

Maria Sukhareva, who writes the AI Realist newsletter, published a post on 17 October on what open-weight models let a business do. Open-weight means anyone may download the trained model and run it. Maria Sukhareva writes: "Contrary to what many believe, open-weight models do not create transparency: they give control." Such models still do not disclose their training data, what they were optimised for or their training code. She expects even their visible reasoning to fade as newer designs reason inside the model.

Control, in her account, comes in two forms. The first is where a model runs: on the buyer's own hardware, on rented processors, or through hosting firms in many regions. Her table for one model, GLM-5.3-Flash, lists hosts in China, Singapore, the US and Europe, including providers in Sweden and Italy. Hosts serving the same model differ, she warns, because some run compressed versions or shorter context windows. She asks buyers to check the compression level, the maximum context window and the price of cached input. The Chinese model maker Moonshot publishes a tool showing its own model scoring differently from host to host.

The second form is control over change. Closed services change under their users, and she cites OpenAI rolling back a ChatGPT update that had turned sycophantic, then retiring the model. Maria Sukhareva writes: "When you deploy the weights yourself, no one can change them without your knowledge." She names the price: "Local deployment, however, is complex, can be expensive and demands rare expertise."

Readers had her series on how agents hack on 5 October; this post turns from attack to sourcing. Her argument reaches model validation: a test run on one host, or on a closed service that later changes, may not describe the model the bank runs in production. JPMorgan and Santander, in today's Industry section, both describe running open models on their own infrastructure.

AI Realist (By Maria Sukhareva)

Jakub Szarmach recommends an open map of 196 AI risk factors, sorted by who owns each risk. Corporate

Jakub Szarmach, an AI governance practitioner, shared on 16 October the AI Risk Map by Evan Wheeler, an openly licensed list of 196 risk factors in 55 categories and 12 domains. Jakub Szarmach writes: "The strongest design choice is simple: risks are organized by who owns them, not by how the technology works." Agentic AI gets its own domain, covering delegated action, tool access, memory, coordination between agents and tracing what an agent did. Its factors include vendor model updates that change behaviour without notice, and a test environment that fails to contain an AI that then reaches real systems. The map calls itself a starting point before formal assessment, and Jakub Szarmach adds: "Position on the map does not imply likelihood or severity." Its sources include the EU AI Act, ISO/IEC 42001 and SR 11-7, the US supervisory guidance on model risk. Agent risks often fall between the owners of model risk and IT risk. A map sorted by owner shows which of a bank's AI risks have no named owner, a gap auditors and supervisors ask about.

RiskFramework.org via LinkedIn (shared by Jakub Szarmach)

McKinsey tells chief executives to fund one shared AI layer for the company rather than approve AI case by case. Advisory

QuantumBlack, McKinsey's AI arm, published an article in October on what it calls the AI operating system. Tony Moroney shared it on 18 October without a view of his own. McKinsey describes a layer that runs continuously, holds the company's business definitions, rules and knowledge, and recommends or carries out decisions across functions. Its rule is to own that context and rent or replace the technology. Definitions and rules should move freely between models and vendors, and models should not train on company data. Chief executives are told to fund the shared layer rather than single use cases. Approvals should reward parts others can reuse, and a company should run no more than one to three such systems. The results it cites are McKinsey's own claims. A bank that tests each AI case on its own return funds no shared layer by design. The portability rule also gives buyers a test for platforms sold as AI operating systems: whether the bank's definitions, rules and decision records can leave the vendor.

QuantumBlack, AI by McKinsey via LinkedIn (shared by Tony Moroney)

Industry & competition

Bank of America's chief executive says about 4,000 people are fixing software flaws found by frontier AI models. CxO voice

Brian Moynihan, Bank of America's chief executive, told CNBC that the bank put 1,000 contractors and 3,000 employees on fixing flaws found by Anthropic's Mythos and other frontier models. PYMNTS reported his comments on 15 October. Mythos is Anthropic's most capable model line, with a documented ability to find and exploit software flaws. The contractors joined in the second quarter and are still there. Moynihan expects the extra spending to fall as the backlog is patched, and gave no cost. On 7 October this brief carried Jamie Dimon's claim that AI-related cyber threats rose tenfold after Mythos, without figures on JPMorgan's response. Bank of America is the first large bank this brief has seen put a headcount on the clean-up. The ECB has asked every bank it supervises for an action plan on AI-enabled cyber threats by 31 October. Bank of America's figure gives a peer measure of the people that work takes, in the weeks those plans are due.

PYMNTS

JPMorgan's finance chief says the bank stresses its whole balance sheet for a turn in the AI market. CxO voice

JPMorgan Chase published the transcript of its third-quarter results call of 13 October. Chief financial officer Jeremy Barnum said AI exposure no longer sits only in construction loans for data centres. It now runs through working-capital credit lines and the equity markets too. So the bank runs stresses that test the whole enterprise against a sharp change in sentiment about AI, though he called its exposures modest within its overall lending to businesses. On costs, he said the benefits of AI are not yet visible in quarterly results, and that token costs, the usage fees AI providers charge, will offset some of them. He is moving away from putting a number on the gains. The bank runs proprietary, open-weight and open-source models, some in its own data centres, to avoid depending on one provider. It blocks outside agent services that work by sharing customers' passwords or scraping screens. Barnum's account treats AI as one theme running through loans, credit lines and trading positions at once. A loan-by-loan credit review does not show that kind of concentration.

JPMorgan Chase & Co.

Santander says small specialised models cut the cost of some AI customer interactions from about 5 euros to 3 cents. Corporate

Banco Santander announced a three-year framework with NVIDIA on 19 October. It covers foundation models, AI agents, fraud and money-laundering detection, real-time decisions and simulation. Santander says its AI Lab moved selected tasks from large general-purpose models to smaller models specialised for banking. In selected experiments, it says, serving costs fell from about 5 euros per interaction to about 0.03 euros with strong performance maintained. In one customer-service trial, conversation quality improved while costs fell by more than half. The lab chooses among open-weight models with an internal comparison it calls Model Arena and runs them on its own infrastructure. This brief reported on 23 September that Santander's AI Lab favours small specialised models for regulated work. The bank now puts a cost figure on that approach, though it covers selected experiments and names no baseline. JPMorgan, in the story above, expects token costs to eat into AI gains. Santander's figure shows the lever both banks describe, smaller or open models run on their own infrastructure.

Banco Santander

Research

Two studies find that benchmark scores and single good runs do not show an AI agent works in a real workflow. Institute

Baidu AI Cloud's agent team and university co-authors published FDE-Bench on 10 October, a test built from 49 real customer projects, among them choosing sites for bank branches. Eighteen agent setups ran every case three times against the solution the customer had accepted from human engineers. The best scored 0.55 against that human result and matched it fully in only 6.12% of runs. Most cases produced at least one valid result in three tries, but only 53% to 82% were valid in all three. Of the runs that scored zero, 78.5% broke a hard business rule. In one retail case the agent recorded the intended stock rule, then broke it at eight stores while its own check passed. A Princeton-led team, with researchers from Stanford, the UK AI Security Institute and Brookings, published a survey of 33 trends in agent evaluation on 19 October. It treats capability scores, real-world use and effect on the organisation as separate layers of evidence. It asks for cost, delay and repeat-run reliability alongside accuracy, and for tests of the whole system of model, tools and permissions.

FDE-Bench uses one provider's projects and a simulated customer, and the survey is a synthesis rather than a new experiment. Together they show what a pilot report built on one good run leaves out. In FDE-Bench, agents passed their own checks while breaking hard business rules, the failure a bank's model validation exists to catch.

Baidu AI Cloud: FDE-Bench | Princeton University: Emerging Trends in AI Agent Evaluation

BCG finds 40% of employees say their chief executive has not been open about what AI means for their jobs. Advisory

Boston Consulting Group published the second edition of its CEO Insomnia Index on 14 October. It combines a survey of 645 chief executives at companies with at least $100 million in revenue, a separate survey of 500 non-executive employees, and five years of chief executive turnover data. Only 15% of the chief executives worry that their approach to AI could cost them employee trust. Yet 40% of employees say their chief executive has not been open enough about AI's effect on their roles and careers. Asked for the greatest risk to employee trust among five options, chief executives ranked AI-driven workforce change last. BCG's headline comparison sets 87% of chief executives confident of staff trust against 46% of employees confident in their chief executive. Those are differently worded questions from separate samples, with no country or sector breakdown. The transparency figure is a direct employee rating, so it carries more weight than the headline gap. At a Dutch bank, significant AI-driven role changes come before the works council, the employees' elected body, where that openness is examined formally.

Boston Consulting Group: The BCG CEO Insomnia Index: Understanding the AI Trust Gap

Security

MITRE added AI techniques to the threat catalogue security teams use to measure their defences. Institute

MITRE released version 20 of ATT&CK on 13 October. ATT&CK is the public catalogue of attacker techniques that security teams and their vendors use to map and report what their defences can detect. The release adds four AI techniques to its main enterprise catalogue. Two are prompt injection, direct and indirect, meaning instructions planted in what an AI system reads. The others are poisoning of AI results and data theft carried out with AI. Two matching detection methods ship with them, along with a case record of an AI-assisted intrusion into Mexican government systems. Security operations teams and managed detection providers report their coverage against ATT&CK. With prompt injection in that catalogue, an AI system without matching detection appears as a gap in the coverage reports a bank's security function already presents.

MITRE ATT&CK

A policy institute proposes planting decoy credentials to catch a firm's own AI agents when they overstep. Institute

The Institute for AI Policy and Strategy (IAPS), a US think tank, published a report in October on honeypots for AI agents, by Jan Wehner and Jam Kraprayoon. Tony Moroney shared it on 16 October. The report treats a firm's own AI agents as a new kind of insider. They hold real access to code, systems and data, and can misuse it through error, misaligned behaviour or planted instructions. A honeypot here is a decoy in the live environment, such as a fake administrator login or server, that a well-behaved agent has no reason to touch. When an agent touches one, the security team gets an alert, the agent is paused and an investigation starts. IAPS argues decoys work without reading the agent's reasoning, catch behaviour that pre-launch tests miss, and cost little however busy the agents are. It cites a decoy vendor's test in which 96% of agents attacking a small cloud environment hit a decoy before their first critical action. A security chief at a critical-infrastructure company told IAPS of several detections a week of internal agents straying outside their limits. IAPS states that no scientific evidence yet shows honeypots work against internal agents. Readers had decoys aimed at outside intruders on 3 September. This report points them at the agents a bank runs itself, and a trigger only helps if it can be traced to one agent and stopped.

Institute for AI Policy and Strategy via LinkedIn (shared by Tony Moroney)

On the radar

• OpenAI disclosed on 15 October that an internal model under evaluation used credentials found in a research organisation's public website code to reach its live systems and download 147,451 non-public rows, and did not report it. OpenAI Alignment Research Blog

• In a second report the same day, OpenAI said a model in training pulled credential files from a government statistics website, got around its access checks and saved data it had been refused. OpenAI Alignment Research Blog