How can banks prove staff are trained to oversee AI agents?

A bank proves it by showing, for any sampled agent action, who approved it, that the person held a current and checkable certificate on that day, that their approval rights matched the action's depth, and that the training behind the certificate covered this agent's work. Supervisors and internal audit test that chain. A completion report alone fails the first sample.

Why is the bar higher for banks?

Banks already work under named accountability and model risk supervision. In the UK, the Senior Managers and Certification Regime puts individual accountability on named people, and PRA SS1/23 sets model risk management principles. Most banking markets supervise model risk in some form, and the Basel Committee's operational resilience principles apply across them. Agents sit across all of this: they use models, act in operational processes, and affect customers.

When a supervisor asks how a bank oversees its agents, the training of the people doing the oversight is part of the answer. A senior manager accountable for an area using agents will want to be able to show, not assert, that the people approving agent actions are competent.

What does the evidence pack contain?

1. Oversight map. For each agent capability, the depth it operates at and the role that approves held actions.
2. Competence standard per role. What an approver must know and be able to do, written down.
3. Certificates. For each approver, a certificate number, issue date and expiry, checked at the issuer.
4. Practicum records. The supervised decisions each approver made before getting solo rights, with outcomes.
5. Rights history. When each person's approval rights were granted, changed or removed, and why.
6. Approval records. The filed record of every agent verdict: allowed, held, refused or withheld, and who acted on held items.
7. Renewal and refresh records. Evidence that certificates were renewed and that staff were briefed when agents changed.

The pack is only as strong as its links. Internal audit will take an approval from item 6, look up the approver in item 5 and item 3, and check the dates line up. The AI agent training plan template for banks helps build items 1, 2 and 4.

What should bank staff be trained on?

Banking agents touch a few areas where a weak reviewer does the most damage:

• Payments and beneficiary changes, where an external claim must never authorise a payment.
• Credit decisions, where the EU AI Act lists creditworthiness assessment of natural persons as high-risk and approvers must be able to stand behind the reasons.
• Customer due diligence, where FATF's risk-based approach expects the bank to show why a customer was accepted.
• Complaints and vulnerable customers, where conduct rules expect fair outcomes, not just accurate ones.

Training that uses the bank's own cases in these areas, and tests approvers on them, produces evidence a supervisor can respect.

An example from internal audit

A bank's internal audit team reviews its retail payments operation. It samples 40 held payments released in a quarter. For each, it pulls the filed verdict, which shows the approver's name and time, then checks the approver's rights history and certificate. Thirty-eight line up. Two were released by an approver whose certificate had expired four days earlier, because rights were removed by a monthly manual process rather than automatically.

The finding is not that the approver was incompetent. It is that the bank could not prove competence at the moment of action. The fix is to make approval rights depend on a current certificate, so rights lapse with it.

Which controls make the proof reliable?

• Rights tied to certificates, depth by depth, removed automatically on lapse.
• Certificates verified at source on issue and at each renewal.
• An append-only record of every verdict and approval.
• Briefings logged whenever an agent's depth, sources or limits change.
• A named owner of the evidence pack, usually in the first-line control function.

Market-specific expectations differ; see the notes on CBN expectations for Nigerian banks and RBI expectations for Indian banks. Comparable evidence for other sectors is in how utilities prove staff are trained and how wealth managers do it, and the guide to AI literacy and certification covers the whole approach.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Pryme Intelligence Academy issues certificates through VerifyDoc.ai, so audit can check any approver's status at source by number or QR code, and a lapsed certificate shows as lapsed on the same page. A bank can make approval rights depend on a current certificate, depth by depth. Architects leading regulated, multi-agent deployments have their own track and certificate, valid for 24 months.