Bank of England Reviews Regulatory Frameworks for Agentic AI in Finance
The Bank of England is currently assessing whether its existing regulatory frameworks adequately address the incorporation of agentic AI within the financial sector. This review spans crucial areas such as payments, trading, cybersecurity, and operational functions. Deputy Governor Sarah Breeden emphasized this need at the European Central Bank Forum in Portugal, stating that the current rules were not designed with autonomous AI systems in mind.
Breeden remarked that these existing frameworks do not effectively consider AI agents capable of operating independently from direct human oversight. It is increasingly impractical to rely on human intervention for every action executed by these advanced systems.
Agentic AI refers to technology that can independently make decisions and perform tasks. In the financial realm, such systems are already being integrated for product recommendations, operational workflows, and trading processes. Unlike traditional automated trading systems, agentic AI can pursue specific goals with minimal human input, potentially making decisions autonomously based on training data and objectives.
Recent advancements in AI have allowed models to better identify cyber vulnerabilities, showcasing a transformative leap in capability. Breeden noted that agentic AI can orchestrate complex sequences of actions rapidly and effectively across financial workflows.
A report from the Cambridge Centre for Alternative Finance, projected for release in 2026, indicates that 81% of financial services firms are now implementing AI technology to some degree, with 52% actively engaging with agentic AI. This report highlighted that most current implementations focus primarily on internal processes, including automation, data visualization, and knowledge management, while applications in trading remain largely limited to lower-risk functions.
Among the significant concerns arising from agentic AI is cyber resilience. Breeden identified this as one of the primary financial stability issues that the Bank of England is monitoring. She pointed out that advancing technology has led to a dramatic enhancement in cyber capabilities, and regulation must encompass risk assessment across the entire financial system, rather than focusing solely on individual entities.
The technology's dual potential was also noted, as AI tools can both bolster cyber defenses when utilized by security personnel and increase vulnerability if employed by malicious actors. Breeden stated that open-source models lag behind advanced proprietary systems by approximately four to eight months, which limits comfort levels in regulatory oversight.
The International Monetary Fund has echoed concerns regarding AI-enabled cyber risks, labeling them a threat to financial stability. Attacks can proliferate swiftly and impact interconnected sectors reliant on shared digital frameworks, heightening the risk of broader disruption.
Breeden stressed the necessity for authorities to prepare for simultaneous disruptions across several firms, advocating for stress tests aimed at assessing potential impacts in advance. She highlighted the possibility of establishing stronger recovery protocols for core systems, such as enabling one bank to assume another's essential functions during outages.
The Bank of England is exploring various contingency plans to ensure critical services remain operational during system failures, including the potential need for essential firms to maintain separate failover systems or the capability to swiftly restore compromised systems.
Concerns shared by Tobias Adrian, a senior official at the International Monetary Fund, affirmed that AI significantly heightens cybersecurity risks. The IMF warns that reliance on shared technologies can lead to correlated failures in widely utilized systems.
In addition to these discussions, Breeden confirmed that regulators are contemplating the implementation of risk mitigation measures like circuit breakers and kill switches. These mechanisms aim to curtail or halt trading across markets if errant AI models create significant disruptions. She pointed out that autonomous systems could exacerbate market volatility if they react similarly to shared market signals.
Despite previous assertions that existing regulations adequately managed AI-related risks, the recent developments have revealed shortcomings within the current framework.
Global regulatory bodies, including the Financial Stability Board, have raised the alarm about the challenges that agentic AI presents for human oversight. In a consultation released in June, the FSB outlined 12 proposed best practices for responsible AI adoption in financial institutions, addressing governance, risk management, and cyber-related concerns.
Breeden finalized her comments by reiterating the Bank of England's commitment to ensuring robust resilience within financial firms as the role of autonomous systems expands throughout the sector. The review is set to include both firm-level controls and broader market safeguards.
