Fintech directors need to learn one lesson above the rest: agent authority is earned, not shipped. A board that understands depth, certification and expiry, the append-only record, and who stays accountable can let product teams move fast without letting agents move money on the strength of a configuration change. A few hours of tested literacy covers it.
Why is "earned, not configured" hard for a fintech?
Fintechs ship by changing configuration. A feature flag goes on, a limit goes up, and the product moves. Agents do not work that way. The agent's role sets a ceiling on depth, certification evidence from the firm's own cases sets the actual depth, and the lower of the two wins. A product manager cannot raise an agent from drafting refunds to issuing them by editing a setting; the agent has to pass certification at that depth.
Boards need to understand this so they stop asking why the agent cannot "just do it", and start asking whether the evidence supports the next step. Certificates also lapse after 90 days, and a run that clears no depth drops an agent to depth 1 the same day. A fintech that plans growth on an agent's current depth must plan for that depth to fall.
What should each director understand?
- Depth (per agent), and the depth each action needs: 1 read, 2 draft, 3 routine work within bounds, 4 money or hard-to-undo actions, 5 coordinating other agents.
- The four verdicts: allowed, held for a named person, refused as outside bounds, and withheld at the platform floor for every agent.
- Provenance: a sealed fact from the ledger or settlement rail outranks a customer's declared claim. An external claim, such as an emailed instruction, cannot authorise a payment.
- The record: every verdict is filed append-only, so any payment can be traced to the bound that allowed it and the person who released it.
- Accountability: the board decides which actions require a certified person, and ensures approval rights follow a current credential.
What do partner banks and investors expect to see?
Where a fintech operates on a partner bank's licence or rails, that partner carries regulatory exposure for what the fintech does. Expect it to ask who approves agent payments, how they were trained, and how quickly an agent's authority is removed after a failure. In the EU, DORA's expectations on ICT risk and third-party technology apply to financial entities, and Article 4 of the EU AI Act sets a literacy expectation for deployers; see EU AI Act Article 4 for fintech.
Investor directors will ask a narrower question: can this scale without a control failure that ends the partnership? Certified approvers and a reconstructable record are the answer.
What may agents do in a fintech?
| Capability | Agent | Stays with a person |
|---|---|---|
| Onboarding checks | Reads documents and drafts a risk summary at depth 1 to 2 | Accepting or exiting the customer |
| Card disputes | Drafts the case at depth 2 | Submitting it |
| Account changes within limits | Executes at depth 3 | Changes to payee details from external sources |
| Payouts and refunds | Prepares and holds at depth 4, if certified | Releasing each one |
| Suspicious activity | Flags and summarises | Deciding whether to report |
What should the board ask before raising an agent's depth?
- What certification evidence supports the new depth, and on whose cases?
- Which approvers will release what it holds, and are they certified?
- What does a failed run do to operations the next morning?
- Can we show the partner bank a reconstructed decision from the record?
A board AI literacy briefing template structures that session. A bank board faces similar questions with more supervision; a contact centre board faces them at higher volume. The full model is in AI literacy and certification for people who work with agents.
Where the Academy fits
Pryme Intelligence Academy's Foundations track gives directors the concepts in about four hours, with a free badge. Executives leading regulated, multi-agent deployments take Architect, which ends in a capstone and a board review with two Pryme assessors.
Questions people ask
Should a fintech founder take the same training as approvers?
Only if they release agent actions themselves. Otherwise literacy is enough, plus a clear view of who holds approval rights.
Can a fintech skip depth 2 and start at depth 3?
Only where certification evidence supports depth 3 for the agent. Starting with drafts lets the team build both the evidence and the reviewers' skill.
What is the first agent a fintech board should approve?
One that drafts at depth 2 in a high-volume area such as disputes or support, where a person sends every output and the record builds evidence quickly.