Your next examination will ask about your agents.

Agents are starting to repair payments, triage alerts and change credit limits. TraceMem checks each of their actions against your limits before it runs, and keeps the record a supervisor asks for: who it was for, which limit applied, and who approved it.

Or call us on +1 650 550 1418

The examiner’s binder

Exhibit · PAY-2609-11873218 Sep 2026

Who was the agent acting for?

Release of a held payment, €240,000.00, by payment-repair-agent

Acting for
Aoife Byrne, Payments Operations
Verified by
Microsoft Entra ID, your tenant
Agent
payment-repair-agent
Allowed to use it
Payments operations, EMEA

Illustrative record. Names and figures are made up.


Four desks. Four questions you will be asked.

Wherever an agent works in the bank, the supervisor’s question is specific to that desk. The answer comes from the same place every time: the record.

  1. Payments operations

    Repairing rejected payments, investigating exceptions, releasing held payments, handling recalls.

    “Who released this payment, and was it within their limit?”

    The colleague the agent worked for, the limit version that applied, and the treasury approver above it. A retry after a timeout pays once.

    Policy and Exceptions
  2. Financial crime

    Triaging monitoring alerts, assembling case files, drafting investigation narratives.

    “Could anyone customer-facing have seen this case?”

    Case data is granted only to agents whose declared purpose is investigation. A servicing agent has no route to it.

    Governed Data Access
  3. Credit and collections

    Reviewing limit increases, hardship cases and repayment arrangements.

    “Was this decision made solely by a machine?”

    Where a person was asked, the record names them and what they answered. Where nobody was, it says that too.

    Decision Trace
  4. Servicing and disputes

    Handling card disputes, complaints and account changes, in chat and in the back office.

    “What did the model see about this customer?”

    Account numbers, IBANs and card details were tokenized before the prompt left, and restored only for the roles that need them.

    PII Protection

The rules for agents are being written now.

Some of these already apply and some are still coming. None of them can be answered from a record that starts afterwards. An action your agents take today is on file only if something writes it down today.

  1. 17 Jan 2025 · EU

    DORA applies

    ICT risk, incident reporting and third-party oversight become law for EU financial entities. A model provider your agents call is one more dependency to account for.

    Source (opens in a new tab)
  2. 31 Mar 2025 · UK

    Operational resilience deadline

    Firms must be able to stay within impact tolerances for every important business service, including the ones agents now work in.

    Source (opens in a new tab)
  3. 18 Nov 2025 · EU

    Critical ICT providers designated

    The European supervisors put the first critical providers, AWS, Google Cloud and Microsoft among them, under direct oversight.

    Source (opens in a new tab)
  4. 17 Apr 2026 · US

    SR 11-7 replaced

    New model risk guidance from the Fed, OCC and FDIC leaves generative and agentic AI expressly out of scope, with a request for information on AI promised.

    Source (opens in a new tab)
  5. 30 Jun 2026 · UK

    “Relying on a human in the loop for all agent actions is unlikely to be realistic.”

    Sarah Breeden, Deputy Governor. Bank of England, “Agents of change”.
    Source (opens in a new tab)
  6. 6 Jul 2026 · UK

    FCA Mills Review published

    It focuses on agentic AI, and asks how senior managers stay accountable for what AI systems do.

    Source (opens in a new tab)
  7. 13 Jul 2026 · UK

    Critical third parties designated

    AWS, Google Cloud, Microsoft and Oracle come under the UK regulators' direct oversight.

    Source (opens in a new tab)
  8. 27 Jul 2026 · EU

    AI Act dates reset

    The Digital Omnibus enters into force and moves the high-risk obligations for credit scoring to December 2027.

    Source (opens in a new tab)
  9. Oct 2026, expected · Global

    FSB sound practices for AI

    The Financial Stability Board's final report on adopting AI responsibly, agentic AI included, is expected.

    Source (opens in a new tab)
  10. 1 Jan 2027 · US

    Colorado automated decisions law

    Consumer notices and rights around automated decisions in lending and insurance, under SB 26-189.

    Source (opens in a new tab)
  11. 2 Dec 2027 · EU

    Credit scoring becomes high-risk AI

    Creditworthiness assessment and credit scoring of individuals: human oversight and logging expected of the bank that deploys it.

    Source (opens in a new tab)

Dates checked against each regulator’s own publication, September 2026. Not legal advice.


Automation already has a file with your regulators.

None of these involved an AI agent. Each was an automated system acting inside a financial firm, and each finding came down to a control that was not there before the action, or a record that was not kept after it.

Knight Capital

2012 · SEC order, 2013

$12 million

SEC order (opens in a new tab)

In the first 45 minutes of trading, its router sent more than 4 million orders into the market while trying to fill 212 customer orders.

What it came down to

It did not have adequate safeguards to limit the risks of its access to the market.

For an agent, with TraceMem

Every agent action is checked against your policy before it runs.

Policy and Exceptions

Citigroup Global Markets

2022 · FCA and PRA, 2024

£61.6 million

FCA fine (opens in a new tab)PRA fine (opens in a new tab)

One input error built a $444 billion basket. $1.4 billion of it was sold across European exchanges by an algorithm.

What it came down to

Hard limits that were missing, and alerts that could be overridden.

For an agent, with TraceMem

Above the limit, an agent cannot proceed. A named person decides.

Policy and Exceptions

Commonwealth Bank of Australia

2012 to 2015 · AUSTRAC, court-approved 2018

A$700 million

AUSTRAC (opens in a new tab)

Intelligent deposit machines failed to lodge 53,506 threshold transaction reports on time.

What it came down to

An automated channel rolled out without its risk assessed, and reports that were never made.

For an agent, with TraceMem

Every governed action leaves a record, and a control that is switched on but seeing nothing is flagged.

Decision Trace

Every month you wait is a month the binder stays empty.

Put in your own numbers. The actions your agents take before a governed path is in place can never be recorded afterwards.

100
6 months

21 working days a month. Your numbers stay in your browser.

In 6 months of waiting

100,800

Agent actions with no record of who they were for, which limit applied or who approved them.

Next 18 monthsNo recordOn file

Put the first page in the binder this month.

Pick whichever is quickest for you. However you get in touch, a person replies. With our forward-deployed engineers, TraceMem can be running inside your network in days.

What would you like?
Where are your agents working?

Pick any that apply.

When do your agents act on production systems?

Optional. A sentence is enough.

45days, free

Free for 45 days on our Docker-based trial image, inside your own network. When you are ready, it upgrades to the full enterprise product.

Forward-deployed engineers, ours or our partners', can set it up in days and help you define policies and integrations. This may be charged separately.