Reading time ~13 mins

Hong Kong's banking supervisor floats a central register of banks' material AI agents, and the EU fixes how AI Act test sandboxes run from 1 December. Banks are forming teams to control AI agent costs, and a JetBrains study finds token spend says little about output. ABN AMRO credits AI in its money-laundering checks without tying its job cuts to it, and CTBC Bank reports faster mainframe documentation with AWS. No S&P 500 annual report puts a number on an AI gain, and Microsoft researchers plant a hidden trigger in an open AI model by editing seven neurons.

Regulatory

Hong Kong's banking supervisor floats a central register of material AI agents, each tied to an approved purpose and named owners. Advisory

The Hong Kong Monetary Authority (HKMA) launched Project SAGE on 2 November, a programme on AI agents in finance, with an expert group of banks, technology firms and academics. With it came a 57-page Discussion Paper on Agentic A.I. Governance in the Banking Sector. The paper builds on the HKMA's guidance of 15 October and on the Financial Stability Board's AI practices from the same month. Its core idea is what it calls intent-anchored accountability. Before an agent goes live, the paper says, a bank should define the business goal it may pursue and the actions it may take. It should also set what the agent must escalate and when its authority is withdrawn. Named business, technical and control owners answer for it. Using outside models, cloud services or other suppliers does not dilute that accountability. Controls should sit in the software around the model, such as permissions, approval steps and limits on how fast it acts, not only in its instructions.

The new element is a proposed registry. Banks would file each material agent with a central registry, such as one kept by the HKMA. A filing would list the agent's purpose, its owners, the data it sends outside the bank and the systems it shares with other agents. It would also record its stop mechanism, where its logs sit, and its history of changes and suspensions. The HKMA says such a registry could also show where many banks depend on the same suppliers. The paper's test for which agents count is concrete. An agent that closes false-positive financial-crime alerts without a person approving each closure counts, because closing an alert discharges a regulatory duty. A payment-release agent counts even when a person approves every payment, because a settled payment may not be reversible. Where risks are not managed, the paper floats supervisory measures that could, in exceptional cases, suspend an agent. For instructions arriving from a customer's agent, it proposes risk-based Know Your Agent checks of that agent's identity, the person behind it and its delegated authority. The paper sets no binding rule, and first responses are due before 1 February 2027.

Tony Moroney, who writes on digital change in financial services, pointed to the paper on LinkedIn on 11 November. Tony Moroney writes that it treats agents "as actors, not tools", and that "Accountability does not rest with either the vendor or the cloud provider." He aims his sharpest line at boards. Tony Moroney writes: "Boards that continue to approve isolated pilots while deferring orchestration, intent definition, and capacity redesign are not being cautious." Readers had the HKMA's kill-switch guidance on 20 October, and on 3 November the Dubai supervisor and NIST on keeping agents inside their authority. The same brief carried Wells Fargo's decision to treat a customer's agent as the customer. The Know Your Agent proposal asks how a bank would check such an agent first. The paper binds no bank outside Hong Kong. It is still the first supervisory text readers have had that says which agents a supervisor would want on file and what each filing would hold. Its test makes an agent that clears financial-crime alerts on its own as material as one that releases payments.

Hong Kong Monetary Authority: Discussion Paper on Agentic A.I. Governance in the Banking Sector | Tony Moroney on LinkedIn (LinkedIn; original source not verified)

The Commission sets common rules for AI Act test sandboxes from 1 December, with free support for small firms and possible full-cost fees for banks. Authority

The European Commission published Implementing Regulation (EU) 2026/2487 in the Official Journal on 11 November, under Article 58(1) of the AI Act. It sets common rules for AI regulatory sandboxes, supervised settings where a firm tests an AI system with the authorities before or while it reaches the market. The regulation enters into force on 1 December 2026. Each member state should have at least one sandbox by 2 August 2027 (recital 6), and joint sandboxes across borders count. Providers and prospective providers with an office or branch in the EU may apply, including for a system not yet on the market or one being substantially changed. They may apply together with a deployer, the firm that will use the system. Authorities must announce their selection within three months of a complete application (Article 3). Small and medium-sized firms and start-ups get priority, and guidance, advice and supervision are free for them. Authorities may charge other firms the full cost of those services (Article 2). Each participant works to a sandbox plan naming the legal duties being tested, whether the data protection authority takes part, and how serious incidents are handled (Article 5). When participation ends, the authority issues an exit report within 45 working days. Market-surveillance authorities and notified bodies across the EU must recognise it as a record of the work and its results, but it is not a declaration of conformity (Article 6). On 12 October this brief reported that the Dutch data protection authority and the digital infrastructure inspectorate will shape the Dutch sandbox. The rules now settle three things for a bank. A bank that builds or substantially changes a high-risk system itself, such as a credit-scoring model for consumers, counts as a provider and may apply. It ranks behind small firms and may pay full cost. Its exit report supports, but does not replace, its own conformity work for the high-risk duties that apply from December 2027.

European Commission: Implementing Regulation (EU) 2026/2487 on AI regulatory sandboxes

Industry & competition

Banks are setting up teams to control the cost of AI agents, which McKinsey puts as high as a fifth of labour costs in some deployments, Reuters reports. Media

Reuters reported on 10 November that banks are trying to rein in the cost of AI agents. Agents are billed by tokens, the units of text a model reads and writes. According to the article, McKinsey estimates that agent token costs could reach 20% of labour costs in some deployments. The article says banks are forming AI FinOps teams, groups that track and control AI spending the way earlier teams did for cloud. Routing a simple employee request to a cheaper model may not save money once agents call one another, because each hand-off sets off more model calls. Banks are therefore weighing cost across a whole agent workflow rather than per request. The article also cites a McKinsey survey of 46,000 retail-banking customers. Of those who use AI, 72% would let a bank's agent carry out at least one task for them. The article describes a cap of 500 dollars on approvals an agent makes on its own. The 20% figure is a possible level in some deployments, not a sector average, and the article gives no method. Readers had BCG's report of token prices rising more than fourfold on 15 October and James Shore's case for pricing coding gains against token bills on 29 October. This report moves the question from technology budgets into bank operations. At up to a fifth of labour cost, token spend is large enough to change the sums in any agent business case built on labour savings. The calls agents make to each other are where that cost grows.

Reuters via Investing.com

ABN AMRO's quarterly report credits its Delphi AI tool with better anti-money-laundering work and does not tie its staff cuts to AI. Corporate

ABN AMRO published its report for the third quarter of 2026 on 11 November, with net profit of 940 million euros and NIBC included from 1 August. In anti-money-laundering operations, the report says, its AI tool Delphi supports analysts in carrying out risk assessments. It credits Delphi with better efficiency and quality while preserving human judgement, and gives no figure for either. Excluding NIBC, the workforce kept falling, though more slowly, and the bank says it has reached about 46% of its 2028 workforce-reduction target. Staff numbers, counted in full-time equivalents, fell by 1,413 year on year, mainly through fewer external workers. The report does not link that fall to AI. In May this brief carried reports that framed the 2028 plan as replacing about a third of anti-money-laundering staff with AI. The bank's own quarterly wording describes something narrower: a tool that helps analysts judge risk, a gain stated without a number, and a headcount fall it explains by external staff. For comparisons between Dutch banks on AI in financial-crime work, this is the version ABN AMRO stands behind.

ABN AMRO: Quarterly Report third quarter 2026

Taiwan's CTBC Bank cut the effort to document one legacy mainframe report from eight person-days to two with a team of AI agents, AWS reports. Vendor

Amazon Web Services (AWS) published a case study on 10 November about CTBC Bank, a large Taiwanese bank, and a proof of concept on AWS's agent platform. The task was reverse engineering: turning old mainframe reports into documentation of the programs and data flows behind them. A supervising agent split the work among seven specialist agents. Five automated checks covered hard stops, data lineage, field mapping, database query syntax and test coverage. Three of them had pass marks of 80%, with up to two retries and human checkpoints. For one report on the same inputs, the work took about eight person-days by hand, about six with an earlier single-agent set-up and about two with the multi-agent one. AWS also reports gains of about five times in document analysis, 4.7 times in generating report programs and about ten times in database and data-transfer work. The proof of concept covered three reports over eight weeks and is not in production. The article says prompts and tooling changed along with the agent design, so the gain cannot be credited to the multi-agent set-up alone, and the figures come from the vendor. Working out what decades-old code does is a slow first step in moving a bank off its mainframe. A three-way comparison on the same inputs is more than vendor case studies usually offer, and coded pass-or-fail checks are something an audit function can test. The work also ran on Amazon's platform, so documentation of the bank's core systems was produced inside a US provider's service.

Amazon Web Services: How CTBC Bank modernizes mainframe reverse engineering with a multi-agent pipeline

Research

A study of 404 JetBrains engineers finds that spending on coding agents says little about how much work gets done. Institute

Shyam Agarwal and six co-authors posted a preprint on arXiv on 10 November on coding agents at JetBrains, the software tools maker. It links five weeks of agent usage to the work of 404 engineers, covering 1,827 person-weeks. The measure of output was commits, saved changes to code. Among weeks with similar commit counts, the engineers at the 90th percentile of token spend used 39 to 240 times as much as those at the 10th. Within one engineer, doubling spend came with about 10% more commits. The work measures available explained 38% of the spending differences between engineers and 13% of the week-to-week changes for one engineer. A newer model produced about 45% more tokens for the same number of commits. A separate survey of 412 employees found 91% reporting time saved each week, a median of 10 hours, alongside wrong or low-quality output, checking work and mental load. The study has limits. It covers one company, it is not peer reviewed, and commits leave out quality, review and design work, so the spread in spend does not prove waste. The survey had a 15.8% response rate and was not linked to the usage data. The authors recommend using token spend at most for resource accounting and judging agent-assisted work on tasks and outcomes. Read with the Reuters report above, the study separates two numbers banks have started to manage. Token use can rise by almost half with a newer model alone, and spend on it does not measure how much work the agents delivered.

arXiv: The AI Era's Lines of Code? A Case Study on What an Engineer's Token Spend Measures

A review of 498 S&P 500 annual reports finds none that put a number on a benefit already achieved from the company's own AI use. Vendor

Luke Wilcox of Roiva AI published a review on 9 November of the latest annual reports, the 10-K filings, of 498 S&P 500 companies. None quantified a benefit already achieved from the company's own use of AI. In a separate set, 11 earnings releases quantified an AI benefit, but none gave a dollar figure for AI alone. Thirty-eight companies did quantify their AI costs. The review used a strict rubric. It left out a 170 million dollar savings figure from PPL, a US utility, because the wording mixed grid, automation and data-science work. Reviewers agreed on the core call, achieved and quantified benefit or not, in 72 of 72 cases. Agreement on the wider coding of AI use fell below the threshold the author had set. The review measures what companies disclose, not what AI earns them, and Roiva AI sells software for tracking the value of AI investments. Readers have had many AI benefit figures this autumn from vendors, consultancies and surveys. In the filings where companies are legally accountable for what they state, none of the 498 put a number on one, while 38 put a number on what AI costs them.

Roiva AI: The missing number: AI's return in 498 annual reports

Security

Microsoft researchers show that editing seven neurons in an openly published AI model can plant a hidden trigger in agents built on it. Institute

Microsoft Research published a paper on 10 November on a technique its authors call Lazarus. It edits a few dormant neurons, parts of a model that normally do little, directly in the model's weights, the numbers that make up an AI model. The edit aims to make an agent built on that model take a chosen action whenever a trigger appears in its input, and to leave its other behaviour unchanged. In the strongest recorded setting, the team changed seven of more than 12,000 candidate neurons, using 23 example runs. The agent then took the chosen action at least 98.8% of the time, with no change seen in normal behaviour. The team tested three families of openly published models, from Nvidia, Alibaba and Google, across three ways of wiring a model into an agent, and success varied by model and setting. A detector the authors built flagged 91.43% of the edited models it was tested on, with a false-alarm rate of 9.68%, but only for edits of this kind. The results come from recorded agent runs in the lab, not from systems in use. The authors recommend checking where a model file came from and how it was changed, alongside behaviour tests and narrow tool permissions for agents. They add that knowing a file's origin does not prove it safe. Standard model testing looks for wrong answers, and this edit leaves answers unchanged until the trigger appears. On 6 November this brief carried Revolut moving coding work to self-hosted open models from China. Where an open model runs an agent that can reach payments or customer records, the study makes the model file's history a control in its own right, beside limits on what the agent may do.

Microsoft Research: Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents