Industry Analysis

The Rise of Agentic AI in Financial Services

· Gerard Louis · 6 min read

Agentic AIFS AI RMFNIST AI RMFPrompt InjectionFinancial ServicesSECOSFIAutonomous AI

Executive Summary

High-stakes events this week, including the FinCyber Today Canada summit and new SEC guidance, confirm a pivot from static GenAI to Agentic AI. This “Active AI” introduces non-deterministic risks — where systems act autonomously — requiring immediate integration into FS AI RMF 230 control frameworks to mitigate automated fraud and cascading logic failures.

1. The Move to Agentic AI: From Passive to Active

Between April 12 and April 18, 2026, the dialogue in major financial hubs (Toronto, NYC, DC) shifted from content generation to autonomous execution. Agentic AI refers to systems that use reasoning chains to call APIs, move funds, and manage identities without human intervention.

The Core Risk

Banks are moving from “Human-in-the-Loop” (constant oversight) to “Human-on-the-Loop” (periodic monitoring). This is a fundamental shift in how AI decisions are governed — the human is no longer approving every action, but rather monitoring outcomes after the fact.

Industry Impact

Regulatory bodies (OSFI in Canada, SEC in the U.S.) have signaled that autonomous decisions are now subject to the same materiality and disclosure standards as human ones. The “Black Box” excuse is no longer a viable defense.

What Makes Agentic AI Different

  • Traditional AI: Receives a prompt, generates a response, waits for the next prompt
  • Agentic AI: Receives a goal, breaks it into sub-tasks, calls external tools and APIs, makes decisions, and executes actions — all autonomously

Examples in financial services:

  • An AI agent that monitors market conditions, identifies arbitrage opportunities, and executes trades without human approval
  • A claims processing agent that reviews documentation, validates coverage, calculates payouts, and initiates payments
  • A compliance agent that scans transactions, flags anomalies, files SARs, and adjusts risk scores across customer portfolios

2. The New Attack Surface: Prompt Injection 2.0

Traditional cybersecurity assumes software code follows a fixed path. Agentic AI is non-deterministic. Attackers are now using “Prompt Injection 2.0” to hijack the agent’s goals rather than just its output.

Confused Deputy Attacks

Malicious data ingested by an agent (e.g., a hidden instruction in a PDF invoice) can trick it into using its legitimate administrative privileges to execute fraudulent wire transfers. The agent believes it is following a valid instruction — but the instruction was planted by an attacker.

Memory Poisoning

Attackers corrupt an agent’s long-term memory to ensure biased or insecure outcomes persist across sessions. Unlike a single prompt injection that affects one interaction, memory poisoning affects every future decision the agent makes — including long-term risk scoring, credit assessments, and AML monitoring.

Non-Human Identity Theft

Agentic AI systems operate with their own credentials, API keys, and service accounts. If an attacker compromises an agent’s identity, they inherit all of the agent’s permissions — potentially including access to core banking systems, payment rails, and customer data.

3. Mitigation Controls: FS AI RMF and NIST Mapping

To secure these autonomous systems, the following mitigations are mapped to the FS AI RMF 230 control objectives favored by U.S. and Canadian regulators.

Autonomous Fraud

  • Threat: An AI agent autonomously initiates fraudulent transactions based on manipulated inputs
  • Mitigation: Deploy “Air-Gapped” reasoning proxies for high-value API calls. Any transaction above a defined threshold must route through an isolated validation layer before execution
  • NIST AI RMF: GOVERN 1.2 — Accountability structures are in place
  • FS AI RMF: C.110 — Logic Enforcement

Prompt Injection 2.0

  • Threat: Attackers embed malicious instructions in data the agent processes (invoices, emails, documents)
  • Mitigation: Adversarial training and runtime input scrubbing for “goal-oriented” prompts. Implement input validation layers that separate data from instructions
  • NIST AI RMF: MANAGE 2.3 — Risks are responded to based on impact
  • FS AI RMF: C.145 — Adversarial Robustness

Memory Poisoning

  • Threat: Attackers corrupt the agent’s persistent memory to influence future decisions
  • Mitigation: Implement stateless execution cycles and “Memory Sanitization” protocols. Agent memory must be validated against known-good baselines at defined intervals
  • NIST AI RMF: MAP 1.5 — Risks and benefits are mapped for all components
  • FS AI RMF: C.088 — Data Integrity

Non-Human Identity Theft

  • Threat: Attackers compromise an AI agent’s credentials to inherit its system privileges
  • Mitigation: Identity-as-a-Service (IDaaS) for agents with token-based session limits. Agent credentials must be rotated frequently, scoped to minimum necessary permissions, and monitored for anomalous usage
  • NIST AI RMF: GOVERN 3.1 — Workforce diversity, equity, inclusion, and accessibility
  • FS AI RMF: C.042 — Identity and Access Governance

4. Governance and Board Accountability

A critical development this week was the focus on SEC Materiality. Under the 4-day disclosure rule, if an AI agent initiates a breach, the “discovery” clock begins when the agent’s logic fails — not when a human eventually finds it.

This has profound implications:

  • Boards are now legally required to demonstrate Auditability and Explainability (FS AI RMF C.202) for all agent-led financial decisions
  • Incident response plans must account for autonomous AI failures as triggering events for regulatory notification
  • Audit trails must capture the agent’s full reasoning chain — every tool call, every decision point, every data source consulted

OSFI Guidance (Canada)

The Office of the Superintendent of Financial Institutions (OSFI) updated Draft Guideline E-23 on Model Risk Management in April 2026, explicitly extending model risk requirements to agentic AI systems. Canadian financial institutions must now:

  • Classify agentic AI systems under the same model risk tiers as traditional quantitative models
  • Demonstrate independent validation of agent reasoning chains
  • Maintain kill switches and human override capabilities for all autonomous agents in production

5. Conclusion

The shift from GenAI to Agentic AI is not incremental — it is a fundamental change in how financial institutions interact with AI. These systems don’t just generate content; they make decisions and take actions with real financial consequences.

For boards and senior leadership, the message is clear: the governance frameworks built for chatbots and content generators are insufficient for autonomous agents. The FS AI RMF 230 controls — particularly C.110 (Logic Enforcement), C.145 (Adversarial Robustness), C.088 (Data Integrity), and C.042 (Identity and Access Governance) — provide the foundation for securing this new class of AI.

The question is no longer “Should we deploy AI agents?” — it’s “Can we govern them before they govern themselves?”

References

Ask the Vault
Ask me anything about the published blog posts.