The same regulators that supervise the firm. No market has a dedicated AI agent regulator for finance. Conduct, prudential and payments supervisors apply their existing rules to agents; data protection authorities oversee the personal data agents use; and in the EU, authorities under the EU AI Act add duties for certain uses. Inside the firm, accountability sits with named people.
Which bodies regulate agents, market by market?
| Market | Financial supervisors | Data protection | AI-specific layer |
|---|---|---|---|
| United Kingdom | FCA (conduct), PRA (prudential), PSR (payment systems) | ICO, under UK GDPR and the Data Protection Act 2018 | None; principles-based, regulator-led |
| European Union | National authorities such as BaFin, ACPR, De Nederlandsche Bank, Central Bank of Ireland; EBA, ESMA, EIOPA; ECB banking supervision | National data protection authorities, under GDPR | EU AI Act, through authorities designated under it |
| United States | OCC, Federal Reserve, FDIC, CFPB, SEC, FINRA, state insurance regulators, state regulators such as NYDFS | Sector and state laws, such as GLBA and the CCPA | State laws such as Colorado's AI act |
| Australia | APRA, ASIC | OAIC, under the Privacy Act 1988 | Voluntary AI safety standard |
| Singapore | MAS | PDPC | IMDA's Model AI Governance Framework, voluntary |
| United Arab Emirates | Central Bank of the UAE; DFSA (DIFC); FSRA (ADGM) | Federal law and free zone data laws | None specific |
For a firm in the EU, DORA adds a further layer on ICT risk; see whether DORA applies to AI agents in financial services. For Australia's conduct regulator, see ASIC and AI agents in financial services. For New York, see NYDFS and AI agents in New York financial services. For the three UAE regimes, see which UAE rules apply to AI agents in financial services.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Why do existing regulators cover agents?
Because they regulate activities and firms, not technologies. A conduct regulator cares whether a customer was treated fairly; it does not matter whether a person or an agent did the treating. A prudential regulator cares whether the bank's risks are controlled; an agent is one more risk. A data protection authority cares how personal data is processed, by anyone.
This has a practical consequence. Your agent may be supervised by four or five bodies at once in one market, each asking a different question about the same action. A refund issued by an agent is a conduct matter, an operational risk matter, a data matter and, if the agent is high-risk under the EU AI Act, an AI Act matter.
How is accountability assigned inside the firm?
Regulators look for named people, not committees or vendors.
- The board approves the firm's risk appetite for agents and oversees it.
- The senior manager for each business activity is accountable for agents performing that activity, under regimes like SM&CR in the UK or equivalent expectations elsewhere.
- Risk and compliance set and test the controls, independently of the business.
- Technology owns the platform's resilience, access and outsourcing.
- Named approvers decide held actions, and are trained for it.
The vendor is accountable to the firm under contract, never to the regulator in the firm's place.
How should it be recorded?
- An agent inventory listing each agent, its capabilities, its business owner and the regulators whose rules apply.
- Responsibility records showing which senior manager answers for each capability.
- A control map linking each capability to the rules and evidence for each regulator.
- Decision records for every agent action, available to any supervisor who asks.
- Outsourcing records for platforms and model providers.
An illustrative example
Take a payments firm licensed in Ireland and the UK. Its fraud agent holds suspicious payments. In Ireland, the Central Bank of Ireland supervises the firm, the Data Protection Commission oversees data use, DORA governs ICT risk and the AI Act applies to its AI systems. In the UK, the FCA and PSR supervise and the ICO oversees data. The firm keeps one inventory entry for the agent with both sets of regulators listed, names its head of financial crime as accountable in both entities, and keeps one decision record that every supervisor can use. The full map of rules to controls is in AI agent regulation, mapped to controls.
Questions people ask
Is there a single regulator for AI in finance anywhere?
Not as a dedicated agent regulator. In the EU, the AI Act creates authorities with AI-specific powers, but financial supervisors remain responsible for the firms they supervise.
Do regulators need to approve agents before use?
Generally not. Some changes, such as material outsourcing, may require notification. Supervisors examine agents as part of their normal work.
Who is accountable when an agent harms a customer?
The firm, through the senior manager responsible for the activity. The vendor may owe the firm under contract, but the regulator holds the firm to account.