Will the FSB’s 12 AI practices make finance safer?
The Financial Stability Board has finalised a practical governance framework for banks, insurers and other financial institutions. It is voluntary and untested, so safer outcomes will depend on adoption, supervision and evidence that the controls work.
The short version
3 key points
- 1.The FSB sets out 12 voluntary practices spanning strategy, accountability, risk assessment, data, explainability, monitoring, human oversight, cyber resilience and third-party dependencies.
- 2.The final text strengthens board responsibility, documentation and controls for agentic systems after roughly 160 consultation responses.
- 3.The report is not an international standard, contains no evaluated compliance dataset and does not demonstrate that adopting the practices reduces failures or consumer harm.
The answer: a useful control map, not a safety guarantee
The Financial Stability Board has produced one of the clearest international checklists yet for governing artificial intelligence in finance. Its 12 sound practices tell institutions to connect AI strategy to risk appetite, assign accountable leaders, document systems, assess materiality, govern data, test performance, preserve meaningful human oversight and control technology suppliers. The final report also treats agentic AI as a distinct operational risk rather than assuming every model merely generates advice.
But the practices do not make finance safer by publication alone. The FSB explicitly says the document is non-binding, non-prescriptive and not an international standard. It offers common language and examples, not a certification regime. There is no audited dataset showing how many institutions already comply, no comparison group and no measured reduction in fraud, discrimination, outages or financial losses.
The practical value is therefore conditional. Boards, supervisors and operational teams can use the framework to expose gaps that might otherwise remain hidden between data science, compliance, cyber security and procurement. Evidence of safer outcomes will require institutions to implement the controls, regulators to test how they work and incident data to reveal whether the framework changes behaviour under pressure.[1]
What changed between consultation and the final report
The FSB says it received roughly 160 consultation responses from financial institutions, technology providers, trade groups and other stakeholders. The final report clarifies that boards and senior management retain responsibility even when AI is bought from a vendor or delegated to an automated agent. It places more emphasis on recording key decisions, model versions, limitations, testing results and ownership throughout the system life cycle.
The final text also scales transparency to materiality. A customer-facing or high-impact system may require richer explanations, documentation and challenge than a low-risk internal tool. That risk-based approach can prevent compliance work from becoming a box-ticking inventory, but institutions still need a defensible way to decide which use cases are material and who can overturn that classification.
Another addition is recognition of workforce effects. Automation can erode expertise if staff stop practising the judgement needed to challenge a model. The report therefore links training, staffing and escalation procedures to operational resilience. That matters in finance because a nominal human reviewer cannot provide a safeguard if workloads, incentives or lost skills make disagreement unrealistic.[1]
Agentic systems need identities, permissions and an off switch
For agentic and multi-agent systems, the report moves beyond ordinary model validation. It recommends unique identities for agents, traceable records of actions and tool use, tightly scoped permissions, staged access to operational systems and human-approval triggers for consequential steps. Institutions should monitor anomalous behaviour and scope creep, red-team likely failure modes and maintain kill switches and fallback procedures.
These controls translate familiar financial principles — segregation of duties, least privilege, auditability and business continuity — into a setting where software can plan and act. A bank should be able to reconstruct which agent initiated a transaction, which data it consulted, which tool it called and which person owned the outcome. Without that chain, assigning an accountable executive on paper would do little for incident response or customer redress.
Deterministic controls remain important even when the AI itself is probabilistic. Transaction limits, prohibited actions, validation rules and approval gates can prevent a fluent model from turning uncertainty into an irreversible act. The report does not specify universal thresholds, appropriately leaving them to the institution’s use case and risk appetite, but supervisors will need evidence that thresholds were set before an incident rather than invented afterwards.[1]
Performance means more than an accuracy score
The framework asks institutions to evaluate accuracy alongside uncertainty, robustness, stability, generalisation and bias. It calls for sensitivity and stress testing, predefined performance thresholds where possible, and monitoring after deployment. Those requirements are especially important when a model faces economic conditions, customer groups or fraud patterns that differ from its development data.
Explainability is framed as a practical capability rather than a single technical method. Staff and customers need information proportionate to the decision and its impact. A detailed feature attribution may help a model-risk team while a customer needs a clear reason, route to contest the decision and a person with authority to reconsider it. Producing an explanation does not establish that the underlying decision is fair or correct.
The FSB also distinguishes several forms of human involvement: humans in, on or commanding the loop, AI used within a human process and emergency interventions such as kill switches. Meaningful oversight depends on time, competence, authority and usable information. Requiring a click from an overloaded employee after an automated recommendation is not the same as independent review.[1]
Suppliers do not remove the institution’s responsibility
Many financial institutions will obtain models, cloud capacity and data services from third parties. The FSB says vendor review must cover performance, transparency, data quality, cyber and operational resilience, subcontracting and concentration risk. Contracts should support monitoring, incident management and exit arrangements rather than leave the institution dependent on assurances it cannot test.
Concentration is a system-wide concern. If many firms rely on the same foundation model, cloud service or specialist provider, one outage or model change can affect several institutions at once. An individual firm may judge a supplier efficient while the market accumulates a common point of failure. Authorities therefore need information that is difficult to obtain from firm-by-firm procurement reviews alone.
For workers, these practices make documentation and escalation part of the job rather than an afterthought. Model developers need reproducible tests; operations teams need clear fallback procedures; compliance staff need access to relevant logs; procurement teams need enforceable information rights. Customers need a route to challenge consequential outcomes even when a vendor’s system sits behind the decision.[1]
Evidence limits and what would change the assessment
The 75-page report is a final policy document from the FSB, whose membership brings together authorities from 24 jurisdictions and whose outreach extends to many more. Its breadth, consultation process and concrete examples make it a credible governance reference. The case studies, however, are illustrative and often reflect institutions’ own descriptions of benefits. They are not controlled evaluations or expected performance benchmarks.
The framework also cannot settle where regulation should be mandatory. Voluntary practices may spread useful routines quickly, but firms can adopt labels without changing incentives, staffing or authority. Cross-border consistency will remain difficult where privacy, consumer protection, outsourcing and model-risk rules differ. Smaller institutions may also lack the specialist staff needed to implement every practice at the same depth as a global bank.
The assessment would strengthen if supervisors publish comparable adoption evidence, test controls through examinations and exercises, and disclose aggregated incidents and near misses. Independent studies should examine whether documented practices reduce failures or merely improve paperwork. Until then, the report should be treated as a serious implementation guide whose real-world effect remains to be demonstrated.[1]
What this means for people
- Customers should gain clearer explanations and routes to contest consequential AI-assisted decisions, but the report does not itself create an enforceable right.
- Financial workers need time, authority and continuing expertise to challenge automated outputs; a nominal approval step is not meaningful oversight.
- Boards and senior managers remain accountable for systems obtained from vendors or delegated to autonomous agents.
Global context
The FSB coordinates authorities across major financial centres, so its practices can influence supervision well beyond a single jurisdiction. They remain voluntary and must interact with national consumer, privacy, cyber, outsourcing and model-risk rules. Adoption capacity will differ between global firms and smaller institutions.
What the evidence does not yet show
- The practices are voluntary, non-binding and are not an international standard.
- The report provides no audited baseline of adoption and no outcome evaluation.
- Illustrative case studies frequently rely on institutions’ own descriptions of benefits.
- Materiality and proportionality leave substantial judgement to firms and supervisors.
- The framework does not resolve cross-border legal differences or technology-supplier concentration by itself.
What to watch next
- National regulators translating the practices into supervision, examinations or enforceable rules
- Public evidence on adoption, incidents, near misses and customer redress
- Stress tests of agentic systems, kill switches and supplier failure scenarios
- Independent evaluation of whether the controls change outcomes rather than documentation alone
Living evidence record
Impact record IAI-0O3CKUG
Evidence stage
Observed
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
15 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what Financial Stability Board published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 15 October 2026
Research question, topics and regions
The Financial Stability Board’s final voluntary practices for responsible adoption of AI by financial institutions
Topics: Financial stability · AI governance · Agentic AI · Human oversight · Third-party risk · Model risk
Regions: International · Global financial system
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Watch the background, then check the evidence
UNESCO
AI-generated illustration · not a video frame
YouTube loads only when you choose. Press play in the player to start. If playback is unavailable, use “Watch on YouTube” below.
AI, jobs & human choice · Background explainer
Published 2024-10-14 · 11 min 27 sec
UNESCO Talks: Interview with 2024 Nobel laureate Professor Daron Acemoglu
Economist Daron Acemoglu discusses how choices about AI affect workers, inequality and society. Pair the interview with our comparison of task exposure, hiring and skills evidence.
Evidence check: An expert interview from 2024, offering a perspective on policy and work rather than a measured forecast of job losses.
Source checked 14 October 2026. Check available captions on the publisher’s video page.
The Impact Brief · Free
Keep following the stories that matter to you.
Get our weekday briefing on what changed and why it matters. Choose your topics below.
Continue the story
There’s more to this story
Finance & Business
What will Singapore require banks to do before using AI?
Singapore's financial regulator has set staged, risk-proportionate expectations for every financial institution: know where AI is used, assess materiality, assign accountable leaders and control the full lifecycle. The rules begin in 2027, and publication is not evidence that firms already comply.
9 min · 2 sources
Finance & Business
What does frontier AI change for banks?
Canada's federal prudential regulator says frontier AI is compressing cyber-defence time and increasing dependence on a small number of model and cloud providers. The 8 October update is a supervisory risk assessment, not evidence of a new bank failure, breach or enforcement action.
9 min · 2 sources
Finance & Business
Are CFOs ready to govern AI investment? IBM finds a wide execution gap
A survey of 1,500 finance leaders across 33 geographies finds broader authority over AI strategy, but only 6% describe finance as transformation-ready. The results map perceptions and associations—not audited returns or proof that AI caused better performance.
5 min · 2 sources
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.