AI Agents in Finance: What They Do and Where They Fail

What Ai Agents In Finance Means In Practice

AI agents in finance are systems that pull in live data (a transaction, a KYC document, a sanctions list update), reason about what it means, and take an action inside a boundary someone set in advance. That's different from a rules engine, which fires the same output every time it sees the same input, and different from a chatbot, which answers a question but doesn't act on your ledger.

Inside a bank, the distinction matters because it determines who signs off. A rules engine change goes through a change control ticket. An agent that can freeze an account, escalate a case, or auto-file a report needs a risk owner, a documented autonomy limit, and an audit trail that survives an exam. Most banks don't have that structure yet, which is why so many "AI agent" pilots stall at proof-of-concept.

The clearest way to see the difference is side by side with the technology it's often confused with.

Ownership is the part banks get wrong first. Defining agentic AI clearly for fraud and compliance teams matters because a fraud team and a compliance team will draw the autonomy line in different places, and if nobody reconciles that before deployment, you end up with an agent that fraud trusts and compliance won't sign off on.

It also helps to be precise about what "agentic" replaces. It's not a rebrand of generative AI with better marketing. The distinction between agentic and generative AI in banking comes down to whether the system produces a draft for a human or a decision that changes an account state. A copilot that writes a SAR narrative is generative. An agent that decides which alerts get a SAR filed in the first place is agentic, and it needs a different governance model entirely.

Regulatory compliance automation, whether AI-driven or not, follows the same logic: automating compliance workflows only holds up under audit if the automation can show its work, whether that automation is a script or an agent.

Why It Matters Now

Three things converged in the last two years to push this from "interesting" to "urgent."

First, the volume problem got worse, not better. Real-time payment rails (FedNow in the US, instant payment schemes in the EU and UK) removed the settlement delay that used to give fraud teams a buffer. A transaction that would have taken a day to clear now clears in seconds, and a human reviewer can't keep pace with seconds.

Second, the enforcement environment got sharper. TD Bank's October 2024 settlement, $1.8 billion in criminal penalties to the DOJ and $1.3 billion combined to FinCEN and the OCC, wasn't a story about missing technology. It was a story about a bank that had monitoring tools but didn't act on what they surfaced, and examiners increasingly ask not "do you have a tool" but "can you show me the decision path." An agent that can't produce that path is a liability with a nicer interface.

Third, regulators started writing AI-specific expectations instead of leaving it to general model risk guidance. The EU's AI Act classifies credit scoring and insurance risk assessment as high-risk AI use cases, which brings mandatory human oversight, logging, and conformity assessment requirements that most banks' existing model governance wasn't built for. The Monetary Authority of Singapore went further with its FEAT principles (Fairness, Ethics, Accountability, Transparency), which explicitly anticipate autonomous decision systems in addition to static models.

None of this is theoretical for fraud teams specifically. Ten concrete use cases for agentic AI in financial services, from real-time payment screening to case triage in financial crime units, show where the pressure is actually landing: teams that are drowning in alert volume and need something faster than a human queue, but can't afford a black box.

The pattern across all three drivers is the same. Speed went up, enforcement got specific, and regulators stopped treating "the model did it" as an acceptable answer. An agent has to be fast and explainable at the same time, and building only for the first one is how you end up in the second TD Bank story instead of avoiding it.

How Ai Agents In Finance Actually Work

Mechanically, an agent in a regulated environment runs a loop: perceive, decide, act, record. Each stage has a job that a bank's second line of defense will eventually ask to inspect.

Perceive. The agent ingests a signal, a wire instruction, a login event, a document upload, and pulls in the context needed to evaluate it: account history, watchlist status, device fingerprint, prior case notes. Bad perception is the most common root cause of a bad decision, and it's rarely the model's fault. It's a stale sanctions list or a KYC record that hasn't been refreshed in eighteen months.

Decide. The agent evaluates the signal against its training and its configured policy, then produces a recommendation with a confidence level. This is where the difference between an agentic AI and a simpler AI agent actually shows up in production: a single-purpose agent might just score a transaction, while a more autonomous one chains multiple decisions together, like scoring a transaction, then deciding whether to hold it, then drafting the escalation note, without a human between each step.

Act. Depending on the confidence level and the autonomy tier the bank has configured, the agent either executes directly (auto-clear a low-risk transaction), routes to a human (medium confidence or above a dollar threshold), or blocks and escalates (high risk or policy violation). This tiering is the single most important design decision in the whole system, and it's the one banks skip when they're rushing a pilot to a demo.

Record. Every decision, the data used, the confidence score, the action taken, and who or what approved it, gets written to an immutable log. This isn't optional logging for debugging. It's the evidence an examiner will ask for, and if it doesn't exist at the moment of the decision, it can't be reconstructed convincingly after the fact.

Security sits underneath all four stages, not beside them. An agent with write access to account status or payment rails is a new class of insider, and it needs the same access controls, segmentation, and behavioral monitoring you'd apply to a human employee with the same permissions. Zero trust architecture for agentic AI treats every agent action as unverified until it's checked against policy, identity, and context, which is a harder standard than most banks apply to their human staff, let alone their software.

Payment-specific implementations add another layer: an agent authorizing a wire needs the same controls a human authorizer would need, tied to payment gateway security and to identity verification standards under KYC and AML automation. Skip either one and the agent becomes the weakest link in a chain that used to have a human in it.

Where Programs Fail

Four failure modes account for most of the agentic AI programs that stall, get pulled back, or trigger a regulatory finding.

No evidence trail. The agent works. Fraud drops. Then an examiner asks why a specific $40,000 wire cleared without review eight months ago, and nobody can reconstruct the reasoning. This is the single most common finding in AI-related exams right now, and it has nothing to do with model accuracy.

Autonomy without a ceiling. A team configures an agent to auto-clear transactions under $500, then quietly raises the threshold to $5,000 because the queue backed up, without updating the risk assessment or getting sign-off. Six weeks later the ceiling has crept to $50,000 and nobody remembers deciding that. Autonomy limits need an owner and a change log, the same as a lending limit would.

Fraud and compliance building separately. Fraud stands up an agent to catch account takeover in real time. Compliance stands up a separate agent to flag structuring patterns for SAR review. Neither system talks to the other, so a customer can trip the fraud model, get cleared, and trip the AML model an hour later with nobody connecting the two events to the same actor.

Treating the agent as a model risk problem only. SR 11-7 covers model validation, back-testing, and performance monitoring, and every bank's model risk team already knows how to apply it. What it doesn't cover well is an agent's decision to act, as opposed to a model's output. A validated model that scores a transaction correctly can still be sitting inside an agent that takes the wrong action on that score, and that's an operational risk gap, not a model risk gap.

Danske Bank's Estonian branch scandal, roughly €200 billion in suspicious flows moving through the bank between 2007 and 2015, is the pre-AI version of this same failure: the monitoring existed, the escalation didn't happen at the speed or with the accountability the volume demanded. An agent doesn't fix a broken escalation culture. It just moves the same failure faster, which is worse if the underlying accountability gap hasn't been closed first.

What Good Looks Like

A program that survives an exam has four things in place before it goes live, not after.

A documented autonomy tier for every agent. Low-risk, high-confidence actions execute directly. Medium-risk actions route to a human within a set SLA. High-risk or novel-pattern actions always escalate, no exceptions baked into the code. Setting the right autonomy limits is a governance decision made by risk and business leadership together, not a default left over from the vendor's demo configuration.

A kill switch that actually works. Not a ticket to file with IT. A control that a compliance officer or risk owner can pull without waiting for an engineering sprint, and one that gets tested on a schedule, the same way a disaster recovery plan gets tested.

Evidence generated at decision time, not reconstructed later. Every action needs its inputs, its confidence score, its policy basis, and its outcome logged the moment it happens. If your evidence generation depends on someone remembering to export logs before they roll off a retention window, it will fail exactly when you need it.

Metrics that measure defensibility as well as efficiency. Alert-to-case conversion rate and time-to-resolution matter, but so does percentage of agent decisions with a complete audit trail, mean time to reconstruct a decision on request, and number of autonomy threshold changes made without a documented risk review. A program that only reports speed and cost savings hasn't measured the thing an examiner will actually ask about.

The programs that get this right treat the return on the investment the same way they'd treat any other control spend: measuring agentic AI ROI has to include the cost of exam findings avoided and false-positive reduction, also headcount saved, since a program that's cheap and fast yet indefensible under audit isn't actually delivering a return. It's deferring a cost to the next exam cycle.

6. How AI and Automation Change AI Agents in Finance

Automation in this space isn't binary. Some tasks are fully automatable today. Others need a human in the loop by law, not by choice.

What can be automated end to end: data collection and enrichment (pulling sanctions lists, adverse media, transaction history into one view), first-pass alert triage, drafting narratives for suspicious activity reports, monitoring for policy or regulatory changes, and running consistent checks across thousands of accounts overnight. A bank running agentic AI for transaction monitoring can cut false positives by having agents apply the same enrichment logic to every alert instead of relying on analyst judgment that varies by shift and caseload.

What can't be automated, full stop: the actual filing decision on a SAR/STR. Under the Bank Secrecy Act, a human must review and approve the filing; FinCEN's guidance treats the SAR as an institutional judgment call, not a system output. Same logic applies to freezing an account, terminating a customer relationship, or overriding a sanctions match. These are decisions with legal consequences for the institution and the customer, and regulators expect a named person accountable for them.

Where the line actually falls, in practice:

The mistake we see most is treating "human in the loop" as a checkbox rather than a control. If a human is rubber-stamping 400 AI-generated SAR narratives a day without reading them, you don't have oversight, you have liability with extra steps. A 2024 FinCEN enforcement action against TD Bank turned partly on this exact failure: alerts were generated but not meaningfully reviewed. The fix isn't less automation, it's making sure the human step is real: time-boxed review, sampling audits, and an escalation path when an analyst disagrees with the agent's recommendation.

Latency is the other tradeoff nobody likes talking about. Full automation is fast. A mandatory human checkpoint adds minutes to hours per case. That's a cost. But for the decisions above, it's a cost regulators require and one that protects you from a much bigger cost: an eight or nine-figure enforcement action.

7. How to Evaluate a Solution

Most vendor pitches sound identical. Every platform claims to reduce false positives, speed up investigations, and keep you compliant. The differences show up in the details, and those details are what examiners will ask about later.

Start with these questions before any demo:

1. Can every agent decision be explained in plain language rather than reduced to a confidence score?
2. Is there a persistent, tamper-proof audit log covering every action an agent takes, rather than only the final output?
3. Can you configure autonomy levels per task (fully automated vs. recommend-only vs. require approval)?
4. Is there a kill switch that stops all agent activity immediately, and does it actually work under load?
5. Does the vendor support your existing case management and core banking systems, or do you need custom integration work?
6. Who is liable if an agent makes an error that leads to a missed SAR or a wrongful account closure?
7. How does the system handle model drift, e.g. when transaction patterns shift and detection thresholds stop working?

Here's a comparison framework we've seen compliance teams use internally when scoring vendors:

Ask for references from institutions of your size and charter type. A solution that works for a $2 billion community bank often doesn't scale to a $50 billion regional, and vice versa; the alert volumes and staffing models are too different. Also ask what happens during a regulatory exam: does the vendor provide documentation support, or are you on your own explaining a system you didn't build?

One more thing worth checking: how the vendor prices configurable autonomy. Some charge more for stricter human-in-the-loop controls, which creates a perverse incentive to under-supervise. You want a vendor whose pricing doesn't penalize you for being cautious.

8. Regulatory and Standards References

The rules governing AI agents in finance mostly predate AI agents. Regulators have been explicit that existing frameworks apply regardless of whether a human or a machine is doing the analysis.

United States:

• The Bank Secrecy Act and its implementing regulations require SAR filing decisions to reflect institutional judgment, not automated pass-through.
• FFIEC BSA/AML Examination Manual sets examiner expectations for model risk management, including for AI-driven monitoring systems.
• OCC Bulletin 2011-12 on model risk management, still the baseline examiners use even for AI models built years later.
• The Federal Reserve's SR 11-7 guidance covers similar ground for Fed-supervised institutions.

International:

• FATF Recommendation 10 on customer due diligence applies whether the due diligence is agent-assisted or manual.
• The Basel Committee's principles for operational resilience increasingly get cited by examiners when assessing AI system failure modes.
• The EU AI Act classifies AI systems used in creditworthiness assessment as high-risk, which pulls in explainability and human-oversight requirements for European operations.

Standards bodies:

• NIST AI Risk Management Framework is becoming the de facto reference U.S. examiners point to when asking "how do you manage AI risk," even though it's voluntary.
• ISO/IEC 42001 is the first international standard specifically for AI management systems, and some institutions are starting to use it as an audit framework.

None of these were written with agentic AI in mind, which is exactly why explainability and human accountability matter so much right now. Examiners are applying decades-old principles to a new technology, and the institutions that map their AI controls back to these existing frameworks are the ones that pass exams without drama.

9. Next Steps

If you're comparing agentic platforms against your current rules-based system, the ROI and implementation timeline differences are worth understanding before you build a business case: see Agentic AI vs Legacy Platforms: Faster ROI, Faster Go-Live.

From there, the practical path is usually: pick one use case (alert triage is the common starting point), pilot it with a strict human-approval gate, measure the false-positive reduction and time saved, then decide how far to extend autonomy. Don't try to automate the whole compliance function on day one. Start narrow, prove the audit trail holds up, and expand from evidence, not enthusiasm.