Agentic AI is surging within the commerce and payments spaces, but the Financial Stability Board’s final report on agentic AI governance lists 12 practices financial institutions should implement to ensure safety and governance.
The Financial Stability Board (FSB) is calling for greater oversight over agentic AI as the technology’s capabilities around commerce and payments continues to grow.
Publishing its final guidance for banks and financial institutions on 15 October, the FSB acknowledged the growing usage of agentic commerce and payments amongst financial institutions, but there are “worrying risks” relating to the AI models that power them.
Agentic commerce is the process of handing the shopping experience to AI agents, offering goods and services suggestions to consumers through large language models (LLMs).
Agentic payments takes the process one step further, handling how the consumer pays for the goods and services, suggesting the consumers’ preferred payment method and initiating the payment process.
While the likes of Google, Stripe and Worldpay have adopted their own standards for agentic commerce and payments, the FSB’s final guidance is calling for more human oversight over both processes using high-risk applications.
The final report is the final step in FSB’s Sound Practices for Responsible Adoption of Artificial Intelligence (AI) project.
This saw consultations to financial services regarding their use of agentic AI, virtual workshops to test best practices for responsible AI, public responses, and a detailed report on the overview of the responses.
The 12 practices for responsible agentic AI
In the final report, the FSB listed 12 best practices for the adoption and deployment of agentic AI:
Strategic direction and oversight: Board and senior management must align AI adoption and governance within the financial institution’s business model, strategy and risk appetite.
Governance and accountability: Financial institutions must define clear roles and responsibilities amongst team members on how to maintain proper governance.
Incorporation of AI risks: Institutions must adopt risk management frameworks to address potential AI risks alongside documentation, materiality and risk assessment.
Organisational adaptability: Institutions must learn to adapt and adjust oversight, governance and risk management practices as AI continues to become more sophisticated.
Materiality and risk assessment: Institutions must implement an effective and systematic approach to assess the materiality and risk it can cause at the inception stage, and after.
Selection process: Institutions must consider business objectives and operational needs when selecting an AI model.
Data governance: Institutions must establish appropriate data governance to maintain data that is fit for purpose for training and testing.
Explainability and transparency: Institutions must understand the differences between AI models, adopt more explainable AI models when necessary, and provide appropriate transparency for stakeholders.
Performance management: institutions must evaluate the performance of AI use cases proportionately to their materiality and risk, including through performance assessments, testing, and ongoing monitoring.
Human oversight: Institutions implement appropriate and effective human oversight relevant to the materiality, risk, autonomy, complexity, and explainability of different AI use cases.
Cyber and ICT risk management: Institutions manage AI-related cyber and ICT risks, including, where appropriate, by incorporating AI cyber and ICT risk scenarios into tests and exercises, sharing relevant information, and using AI tools in cyber and ICT risk management.
Third-party AI risk management: Institutions appropriately manage risks from third-party AI dependencies with a focus on performance, transparency, data quality, supply chain and concentration risks, and business continuity.
