Fiserv's launch of AgentOS, an agentic AI operating system for financial institutions, is significant technology news. But for those of us in compliance, it's also a flashing yellow light. When AI agents start making autonomous decisions in regulated workflows, your supervisory framework needs to account for that.
What AgentOS Actually Does
AgentOS is designed to help banks and financial institutions deploy, manage, and scale AI agents across their operations. These aren't chatbots. These are autonomous systems that can execute tasks, make decisions, and interact with other systems without constant human oversight.
Receive future blog posts by email.
The sales pitch? Less paperwork, faster customer service, and lower costs. That's the promise.
But here's where compliance gets messy.
Why This Matters for Compliance Officers
Autonomous AI agents operating in banking workflows touch nearly every regulatory requirement you're responsible for:
- Supervision. FINRA Rule 3110 requires member firms to establish and maintain a system to supervise activities. When an AI agent makes a decision, who supervised it? The answer can't be "no one."
- Books and records. SEC Rule 17a-4 and FINRA Rule 4511 require retention of communications and business records. If an AI agent interacts with customers or executes transactions, those interactions need to be captured and retained.
- Fair dealing. Reg BI and the IA fiduciary duty don't care whether a recommendation came from a human or an algorithm. If an AI agent is making recommendations or decisions that affect customers, those decisions must meet your regulatory obligations.
- AML and KYC. If agents are involved in customer onboarding or transaction monitoring, your BSA/AML program needs to account for how they function and how they're tested.
The Model Risk Management Question
For larger institutions, OCC Bulletin 2011-12 on Model Risk Management applies. AI agents that make decisions affecting bank safety, soundness, or consumer protection are models. They require validation, ongoing monitoring, and documentation of their limitations.
Even if you're not OCC-supervised, the principles matter. You need to understand what the AI is doing, why it's doing it, and how you'll detect when it goes wrong.
What You Should Be Asking Vendors
Before deploying any agentic AI system, your due diligence should include:
- How are agent decisions logged and made available for supervisory review?
- What controls prevent agents from exceeding their authorized scope?
- How does the system handle edge cases or situations it wasn't trained for?
- What audit trail exists for regulatory examinations?
- How is the system tested and validated before deployment?
The Bottom Line
AgentOS and similar platforms will become common. The efficiency gains are real. But efficiency without proper controls is just a faster path to an enforcement action.
If your firm is considering agentic AI, start the compliance conversation now, before procurement makes the decision for you. Your written supervisory procedures, your vendor management framework, and your risk assessment process all need to account for autonomous AI before you flip the switch.
Subscribe to Regulated Intelligence Brief
Get new compliance intelligence delivered to your inbox.
Key Takeaways
Does FINRA have specific rules about AI agents in supervised activities?
Not yet. But existing supervision requirements under FINRA Rule 3110 don't exempt technology. If an AI agent is performing a supervised activity, your supervisory system must account for it -- including how you review its decisions and detect failures.
Who is responsible when an AI agent makes an error that harms a customer?
The firm is. Regulatory liability doesn't transfer to vendors or technology. Your firm remains responsible for any customer-facing activity, regardless of whether a human or algorithm performed it.
Should we update our WSPs before deploying AI agents?
Absolutely. Your written supervisory procedures should document how AI agents are supervised, what controls are in place, and how exceptions or errors are escalated. Examiners will ask.
The content in this blog is for informational purposes only and does not constitute legal advice, regulatory guidance, or an offer to sell or solicit securities. GiGCXOs is not a law firm. Compliance program requirements vary based on business model, customer base, and regulatory classification.