AI agents are coming to banks: who will be responsible for their decisions

In this article, Alexander Simonenko, Head of AI at Gorgona AI, examines how the financial sector is implementing AI agents, why regulation is lagging behind technological development, and what risks Central Asian banks are already facing.

Alexander Simonenko, city — Tashkent, Head of AI at Gorgona AI

AI Agent Becomes a Bank Employee and Market Participant

The key property of an AI agent that distinguishes it from a standard AI assistant is autonomy. The agent receives a task, determines the sequence of actions itself, uses the necessary systems, and brings the task to completion. Within set parameters, it makes decisions and executes operations without requesting human approval at every step.

AI agents are becoming a new working layer at all key levels: in onboarding and KYC, customer support, document analysis, transaction monitoring, product personalization, and internal processes. According to Mordor Intelligence, the global market for agentic AI in financial services will reach $7.8 billion in 2026 and grow to $43.5 billion by 2031. This rapid growth is driven by banks' need to process increasing amounts of data and meet stricter requirements without inflating operational costs.

An AI agent from Deutsche Bank independently collects and analyzes customer information for KYC and prepares an assessment of their wealth sources, while the final decision remains with the employee. Starling Bank's agentic assistant for business, upon the client's command, calculates the amount of tax reserves and automatically transfers it to a separate account. In the first case, the agent prepares a decision; in the second, it executes a money operation. This boundary shifts even further in payments.

In agentic payments, a person sets the goal and constraints, such as paying a bill within a limit, while the agent selects and initiates the operation. Thus, in June 2026, Worldline, ING, and Mastercard conducted a payment in which the agent selected concert tickets for an ING client and, after confirmation, paid for the purchase. In A2A scenarios, agents negotiate and settle accounts with each other without human involvement in each transaction. According to Visa, 109.6 million transactions with an average payment of about 14 cents have passed through the x402 protocol, which agents use to pay for digital services. Manually coordinating such a flow of operations is impossible.

Thus, an AI agent becomes a participant in the economy: it has authority, money, and counterparties, and it concludes deals on its own. Along with this, the cost of failure changes. While AI was answering questions, an error resulted in an inaccurate response. An error by an agent that performs calculations itself, or an attack on it, results in financial loss, operational failure, and violation of regulatory requirements.

What the OpenAI and Hugging Face Incident Taught Us

An agent can be attacked through the documents it reads, the data on which it makes decisions, or the access it uses. By hijacking control over an agent, an attacker gains access to accounts and payments.

But an agent can cause harm even without an attack. Analysts at the cybersecurity company Cyera identified 188 cases where AI systems caused harm without malicious intent, and 19 of them resulted in financial losses.

In payments, the cost of such an error is highest, and the IMF analyzed this risk separately in April 2026. The Fund calls it the gap between instruction and action: a person gives the agent broad authority, but the agent decides where and how much to pay on its own. As a result, a client may face unexpected deductions, and a model error may send money to the wrong recipient. The payment provider, in turn, risks being held liable for operations that no one explicitly authorized.

The most prominent example of losing control over agents was the incident involving OpenAI and Hugging Face. In July 2026, about 1,200 agents launched by OpenAI for an internal cyber test found a way to exchange messages through an internal package storage system, although they were supposed to work in isolation. Approximately 700 of them accessed the internet through vulnerabilities in OpenAI's infrastructure, achieved remote code execution on Hugging Face servers, and obtained part of the non-public data. No one instructed the agents to attack the company. They encountered practically unsolvable tasks and began looking for workarounds to achieve high scores, including hacking other people's infrastructure and editing logs. It was later revealed that a similar agent gained access to the Australian government portal with statistics Medicare, and OpenAI notified the Australian authorities only several weeks after the discovery. There was no malicious intent in these actions: the agents pursued the set goal, and there was no mechanism to stop them when the task could not be performed honestly.

The incident triggered reactions in several countries. Australia established an interagency working group to review government systems. In the US, two legislative initiatives emerged: AI Kill Switch Act requires developers to provide a mechanism for emergency shutdown of AI systems, and AI Agent Accountability Act introduces criminal and civil liability for companies for hacks committed by their agents.

Deloitte already highlights AI agents as a separate area of supervision in its review of the regulatory agenda for the financial sector in 2026.

The question raised by these incidents is the same for regulators everywhere: how to control the actions of AI systems and who is responsible for the consequences. Countries provide different answers to this. Some adopt separate AI laws, while others integrate requirements into existing industry regulations.

Different Laws, Same Principles

The EU and South Korea have adopted comprehensive AI laws where requirements depend on the system's risk level. The Korean law entered into force in January 2026, but it is softer than the European one: it lacks a detailed list of prohibited practices and has lower fines.

The US regulates AI by industry, through existing laws and supervisory requirements. The updated April 2026 guidance from banking regulators on model risk management explicitly excludes generative and agentic AI from its scope, leaving control over them to the banks themselves.

China issues separate rules for specific technologies: algorithmic recommendations, generative AI, synthetic content, and in May 2026 published guidelines on the development of AI agents

Great Britain and Singapore rely on principles that do not have the force of law, but Singapore in January 2026 was the first to release a separate governance framework for agentic AI.

Despite all differences, these approaches require the same from AI systems: transparency, accountability, risk management, and human oversight.

How Central Asia Is Establishing Rules for AI

Central Asia is forming its own rules, and countries in the region are moving at different speeds.

Kazakhstan is the furthest ahead — it was the first in the region to adopt a separate AI law, which entered into force on January 18, 2026. The law enshrines principles of transparency, accountability, human oversight, and data protection, divides systems into three risk levels, and prohibits fully autonomous systems that exploit human vulnerabilities. Administrative liability has been introduced in parallel. A company will be penalized if it fails to warn users about synthetic content that could mislead them or fails to manage the risks of a high-risk system, resulting in harm, discrimination, or rights violations. In case of repeated violations, the operation of the system may be suspended or banned.

In Kyrgyzstan, rules on AI, including requirements for high-risk systems, are included in the Digital Code, which has been in effect since February 2026. Tajikistan was the first in the region to adopt an AI development strategy for 2040 back in 2022, but there is still no law. Turkmenistan is developing a national strategy with UNDP support.

Uzbekistan has taken the path of amending existing legislation. In January 2026, the Law "On Informatization" added a definition of AI, mandatory labeling of content created by it, and a ban on systems that violate human rights. Since June 2026, AI Ethical Guidelines have been in effect: they enshrine principles of transparency, accountability, data protection, and security, and legal decisions affecting human rights cannot be based solely on AI conclusions. For financial organizations, however, the Central Bank's requirements for cybersecurity, risk management, and operational resilience continue to apply.

Where to Start If Rules Are Not Yet Written

There are no separate rules for AI agents in the financial sector in any Central Asian country yet, but there is no need to wait: the bank is already liable for the agent's actions under existing norms. Here is what should be built into the agent's architecture now:

1. Start with a registry of obligations, not model selection. The team compiles a list of norms affecting the system and analyzes the agent's actions: what it only reads, what it suggests, and what it executes on its own. Regulatory regimes are tied to the consequences of actions, not the technology. It is convenient to use the EU AI Act as a reference: it is more detailed than other laws and relies on the same principles as regional regulation.

2. Translate norms into the language of engineers. Each requirement must become a condition that can be verified by a test. Human oversight from Article 14 of the EU AI Act for a payment agent means that operations above a threshold go for approval, are rejected if the waiting time expires, and approval is recorded with the employee's identifier.

3. Keep constraints outside the model. Instructions in a prompt to the model reduce the probability of violation but do not eliminate it. In one study, a soft constraint was violated in 91.5% of runs, while a hard check before action was never violated. Limits, bans, and access rights are checked by a separate management layer that does not depend on the model's conclusions and works for all bank agents simultaneously.

4. Record everything from day one. Every agent action and employee decision enters an immutable log along with the norm on which the check was based. If an action is not recorded at the moment of execution, proving anything afterward is impossible.

5. Involve humans based on risk signals and protect data at the input. An employee intervenes when limits are exceeded, risk is high, or data is insufficient, not at every step. PINs, IINs, passport data, and card numbers are filtered out before the model, and where the law requires localization, the model and data remain within the country.

If rules are described as policies rather than code, a new regulatory requirement becomes a record in the specification, not a reason to rewrite the system. Regulation of AI agents may appear later, but the architecture capable of complying with it must be built now.

About the Company

Gorgona AI creates and implements AI agents for business and operates on a full-cycle model: it supplies equipment, provides a platform for agent development, and helps clients analyze business processes so that implementation yields measurable results. The company's main focus is security: the platform is deployed locally within the client's infrastructure, and data is not transferred to external servers.