Start with two groups at once: the senior manager who will be accountable for the agent, and the first-line operations leads whose teams will approve its held actions. In a bank, accountability is personal and approvals happen in operations. Model risk, compliance and internal audit follow closely, and front-line staff come last, once their supervisors are certified.
Why these two groups?
A bank cannot run an agent without someone answering for it and someone checking its work. The accountable executive decides how far the agent may go and must be able to explain that decision to the board and supervisors. The operations leads in payments, onboarding, lending operations or servicing decide, case by case, whether a held action is released. If either is untrained, the other is left exposed.
Everyone else matters, but their training depends on decisions these two groups make: which agents, which depths, which limits.
Who comes in which wave?
- Accountable senior manager and operations heads. The common grounding on depth, the minimum chain, held actions and the record; operations heads also take the reviewer track.
- First-line team leads and senior processors. The reviewer track with a practicum on the bank's own cases, because they will clear held actions every day.
- Model risk management. How an agent's depth is earned per agent, how certification replays real cases, and why the certificate lapses after 90 days. This differs from validating a scoring model once a year.
- Compliance and operational risk. How verdicts are filed, how to sample them, and which bound decided each one.
- Internal audit. How to reconstruct a decision from the append-only record.
- Front-line staff. The common grounding, then the reviewer track for those who will approve.
A training needs analysis helps confirm the order in your own bank; the training needs analysis template for AI agents gives a starting structure, and how to write a training needs analysis for AI agents walks through it.
What may the agent do, and what stays with bank staff?
| Work | The agent | Depth | Stays with a person |
|---|---|---|---|
| Customer due diligence refresh | Gathers documents, drafts the review | 2 | Risk rating and any exit decision |
| Payments operations | Repairs failed payments, prepares releases | 3 to 4, held above limits | Release above the bank's own limits |
| Lending operations | Prepares disbursement files | 4, held | Disbursement |
| Servicing | Drafts replies, books routine changes | 2 to 3 | Hardship and complaints |
| Financial crime | Summarises alerts | 2 | Every suspicious activity decision |
An example: a due diligence refresh
Take a retail bank where an agent drafts periodic due diligence reviews for small business customers. It gathers the company registry entry, the latest accounts and the customer's own declaration of activity. In one practice case, the registry shows a new director the customer did not mention. The agent flags the gap and holds the review.
A trained onboarding lead reads the flag, requests information and updates the risk assessment. An untrained one, measured on clearing the backlog, closes the review as complete. That lead was in wave one for a reason: they set the habit for twenty processors.
Which rules shape the order?
Banks are already used to named accountability and model oversight. In the UK, the Senior Managers and Certification Regime makes individuals accountable, and PRA SS1/23 sets model risk management principles for banks. In the US, SR 11-7 is the interagency model risk guidance. Under the EU AI Act, Article 4 expects deployers to ensure sufficient AI literacy among staff dealing with AI systems, and creditworthiness assessment of natural persons is listed as high-risk. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
All of these point the same way: the people who answer for and oversee the agent must be competent first, and the bank must be able to show it.
How does the bank show the first wave is ready?
With certificates that can be checked, not attendance lists. A written test, a supervised period of real review decisions with no missed red line, and an expiry date. A bank can make approval rights at each depth depend on a current certificate, so a lapsed reviewer cannot release a held payment.
Pryme Intelligence Academy's Architect track is built for people leading regulated, multi-agent deployments and ends with a board review by two Pryme assessors.
The same question for fintechs and contact centres has different answers, because their accountability sits differently. The full approach is in training teams for AI agents.
Questions people ask
Should the board be trained before operations?
The board needs a short briefing early, but it should not delay operations training. Boards set appetite; operations leads make the daily decisions that test it.
Where does model risk fit if the bank already validates models?
Early, because agent certification differs from model validation. It is per capability, on the bank's own cases, and it lapses.
Do branch staff need training?
Only if they will approve agent actions or hand cases to an agent. Otherwise a short briefing on what the agent does is enough.