Artificial intelligence agents are entering production across the global banking sector, but most major financial institutions are not yet equipped to monitor and control them comprehensively. A new benchmark from Boston Consulting Group (BCG), covering 26 global and domestic systemically important banks, finds that 73% permit agentic AI in production for selected use cases, while just 8% have standardized monitoring and control frameworks explicitly designed for AI agents. The findings highlight a growing challenge for financial institutions: scaling autonomous AI systems while maintaining operational resilience, regulatory accountability, and human oversight.
Artificial intelligence agents are entering production across the global banking sector, but most major financial institutions are not yet equipped to monitor and control them comprehensively. A new benchmark from Boston Consulting Group (BCG), covering 26 global and domestic systemically important banks, finds that 73% permit agentic AI in production for selected use cases, while just 8% have standardized monitoring and control frameworks explicitly designed for AI agents. The findings highlight a growing challenge for financial institutions: scaling autonomous AI systems while maintaining operational resilience, regulatory accountability, and human oversight.
AI Agents Are Reaching Production, but Deployment Remains Limited
Unlike conventional AI tools that primarily generate predictions, recommendations, or content, agentic AI systems can plan multistep tasks, interact with software, and take actions toward defined objectives. Depending on their permissions, these systems may retrieve customer information, coordinate workflows, update records, or initiate processes with limited human intervention.
That ability to act makes agentic AI potentially valuable to banks, where complex processes often involve multiple systems and approval stages. It also introduces risks that are harder to manage than those associated with systems that simply provide recommendations.
BCG’s benchmark shows that 92% of surveyed banks are either piloting or permitting agentic AI. However, none reported allowing broad production use. At 88% of institutions, agents account for 10% or less of the overall AI portfolio.
The results suggest that banks are experimenting with autonomous systems but are keeping deployments narrow. Selected applications may be permitted, while more consequential workflows remain subject to tighter restrictions or human approval.
Monitoring and Control Are the Biggest Governance Gaps
The most striking finding concerns the limited maturity of agent-specific oversight. Only 8% of surveyed banks have a comprehensive, standardized monitoring and control framework that explicitly covers AI agents.
More than half, or 54%, have defined restrictions or prohibitions on agentic AI within their risk-appetite frameworks. Such restrictions can limit exposure while institutions develop more robust controls, but they do not provide a complete operational solution for managing agents at scale.
Effective oversight requires more than reviewing an AI model before deployment. Banks need to understand what an agent can access, which actions it is authorized to perform, how it behaves during execution, and what happens when it encounters unexpected information or instructions.
This can involve permission controls, activity logs, continuous testing, escalation procedures, human approval for sensitive actions, and mechanisms to stop or roll back operations. Institutions also need to track changes to agents and the underlying models, tools, and third-party services they depend on.
The challenge becomes more complex when employees can create or configure agents independently, or when external technology providers update capabilities after an initial approval. Without a reliable inventory, banks may struggle to identify every agent operating across the organization and determine whether its permissions remain appropriate.
AI-Related Incidents Show the Risks Are Already Present
The benchmark also points to broader problems in AI deployment. Forty-six percent of surveyed banks reported an AI-related issue or incident during the previous 12 months. More than a quarter said AI systems were falling short of their expected business case.
These figures indicate that AI governance is not simply preparation for a future wave of autonomous systems. Banks are already dealing with operational and commercial consequences from existing AI deployments.
Potential issues include inaccurate outputs, inappropriate recommendations, data exposure, unreliable automation, and failures in connected workflows. Agentic systems can amplify some of these problems because they may act on information or instructions rather than merely presenting them to a human user.
For example, an agent operating across customer-service or payment-related systems could create downstream consequences if it misinterprets a request, accesses information beyond its authorization, or performs an action without the necessary approval.
The specific incidents in BCG’s benchmark are not broken down by category, so the figures should not be interpreted as evidence that all reported issues involved autonomous agents.
Governance Policies Are More Mature Than Operational Controls
Many banks already have formal structures for managing AI risk. BCG found that 96% manage AI risk through existing risk frameworks, 77% have dedicated AI policies, and 73% have defined their appetite for AI risk, up from 57% in 2025.
However, fewer than half have a centralized, tool-based inventory of AI systems. The benchmark also found that none had a comprehensive human-oversight framework consistently implemented across all AI systems.
This difference between policy and execution is significant. A bank may have documented principles for responsible AI use but still lack the technical infrastructure to enforce those principles consistently across departments, applications, and third-party platforms.
Regulatory expectations are also evolving. In April 2026, U.S. banking regulators issued revised model-risk guidance that explicitly excludes generative and agentic AI models from its scope, describing these technologies as novel and rapidly evolving. The guidance nevertheless emphasizes the importance of broader risk-management and governance practices for systems outside its formal coverage.
For banks, this creates a need to develop controls suited to autonomous systems rather than assume that traditional model-validation procedures will address every agent-related risk.
Better Governance Could Help Banks Scale AI Faster
BCG’s findings challenge the idea that more extensive governance necessarily slows technology adoption. Banks in the top third for risk-management maturity were 2.5 times more likely to be advanced AI adopters than those in the bottom third.
The report also found that banks using standardized, preapproved patterns for lower-risk AI applications were nearly twice as likely to move those applications from idea to production in under six months.
The underlying principle is to standardize repeatable decisions. Banks can establish approved technical patterns, security requirements, and controls for common low-risk applications, while reserving more detailed reviews for new or higher-risk use cases.
BCG identifies several priorities for financial institutions: strengthen continuous testing and monitoring, maintain up-to-date AI inventories, extend oversight to third-party providers, and establish safeguards for employee-built agents. These measures can help institutions identify problems earlier and apply consistent controls as deployment expands.
The Next Banking AI Challenge Is Operational Accountability
The benchmark suggests that the banking industry’s next phase of AI adoption will depend less on proving that agents can perform useful tasks and more on demonstrating that institutions can manage their actions reliably.
For bank executives, risk officers, technology leaders, and compliance teams, the priority is to connect governance policies with operational systems that control access, record activity, detect unexpected behavior, and provide intervention when necessary.
BCG’s research is based on 26 systemically important banks, so its findings should not be treated as a complete representation of every financial institution or regional banking market. Nevertheless, it provides a useful snapshot of how major banks are approaching the transition from conventional AI applications to more autonomous systems.
As agents become more capable and interconnected, banks that build monitoring and control into their deployment processes may be better positioned to expand their use without sacrificing accountability. The competitive advantage may come not from deploying the most agents, but from being able to trust, supervise, and scale them.
Market Landscape
The banking industry is moving from traditional predictive AI and generative assistants toward agentic systems capable of executing multistep workflows. This creates opportunities in customer service, fraud investigation, compliance operations, software development, and internal process automation.
However, financial institutions operate under strict requirements around data protection, transaction authorization, operational resilience, and accountability. Agentic AI introduces additional complexity because its systems can interact with multiple applications and take actions with varying degrees of autonomy.
Top Insights
- BCG’s survey of 26 major banks finds that 73% permit agentic AI in selected production environments, but none allow broad production deployment.
- Only 8% have comprehensive monitoring and control frameworks explicitly designed to manage autonomous AI agents.
- Nearly half of surveyed banks experienced an AI-related issue or incident during the preceding 12 months.
- Banks with more mature risk management are 2.5 times more likely to qualify as advanced AI adopters.
- Standardized governance, continuous monitoring, and controlled agent permissions could help banks scale AI without compromising accountability.
Power Tomorrow’s Intelligence — Build It with TechEdgeAI
