Before AI Agents Move Money: A Governance Checklist for Banks
AI agents are about to hold payment authority. Before the first mandate goes live, banks need seven controls in place — a practical checklist drawn from delegated-authority practice and twenty years of security operations.
The 2026 numbers are unambiguous: most financial firms now run AI agents, most of those agents hold some autonomy, and payments are the next capability on every roadmap. The interesting question is no longer whether agents will move money — it is whether the governance exists before the volume arrives. This checklist is the answer I give when banks ask where to start.
First, the mental model. An AI agent is not a product feature; it is a new class of client. And banking has governed non-human authority for decades — corporate mandates, powers of attorney, delegated signatories. Every control on this list is an old idea in new clothing: explicit authority, granted narrowly, attributed clearly, and revocable instantly.
1 — Scoped mandates. Every agent gets an explicit, machine-readable mandate: what it may do, on whose behalf, up to what limit, until when. No agent should inherit implicit authority just because it holds a customer's session or credentials. If the mandate cannot be printed on one page, it is not a mandate — it is an accident report waiting for a date.
2 — Cryptographic attribution. Agent traffic must be distinguishable from human traffic at the protocol level: dedicated tokens or keys per mandate, never shared sessions. The test is simple: in your logs, can you tell within seconds whether a transaction was initiated by the customer or by their agent? If the answer is no, you do not have an incident-response story — you have a liability lottery.
3 — Limits and kill switches as product features. Hard caps, velocity limits, a one-tap revocation for the customer, and a central circuit breaker for the bank. These belong in the product, tested in production drills — not in a policy document. Robinhood's early agentic accounts got this right: ring-fenced accounts, hard spending limits, instant kill switch.
4 — Liability allocated before volume. Who absorbs the loss when an authorized agent does the wrong thing — the customer, the bank, or the agent's provider? Write it into terms while volumes are small and negotiable. Liability retrofitted after an incident is allocated in court, at discovery prices.
5 — Fraud models retrained on agent behaviour. Your fraud stack scores human signals: device fingerprints, typing cadence, session rhythm. A legitimate agent breaks all of them, and a compromised agent will look more human than most humans. Agent-normal needs its own baseline, and 'hijacked mandate' needs to become a first-class fraud scenario.
6 — Human oversight gates where they matter. Not everywhere — approval fatigue is how oversight dies. Place mandatory human confirmation on consequential actions only: new beneficiaries, threshold-crossing amounts, mandate changes. Oversight should be positioned by risk analysis, not sprinkled by anxiety.
7 — An audit trail of agent reasoning. When the regulator asks 'why did your system allow this transfer?', the answer must exist as a record: the instruction received, the mandate checked, the limits evaluated, the decision path taken. Logging the outcome is accounting; logging the reasoning is governance.
Twenty years in banking security operations taught me one thing about incidents: they are won or lost in the preparation, not the response. Banks that issue small, revocable mandates with full attribution today will scale agent payments safely tomorrow. Banks that bolt governance on after launch will learn the same lessons from loss events — and from regulators. Digital trust is built before the first transaction, not after the first incident.