Agentic AI in financial services: the architectural separation that makes compliance possible
Banks, asset managers, and market infrastructure firms are putting software that acts next to software that advises. The compliance question is not whether the model is impressive. It is whether a mandate, a payment rule, or a pre-trade screen can fail — and if it can, who is accountable the next morning. Separation of reasoning from authority is how that question gets a deterministic answer.
The actions are already in your perimeter
Financial services did not wait for chatbots to automate. Order management, payments, onboarding, corporate actions, and allocation engines already change state under licence. Agentic AI is arriving as a proposer on top of those rails: rebalance this book, pay this invoice, onboard this supplier, confirm this OTC.
Existing governance assumed a human would interpret a recommendation. Suitability letters, four-eye checks, and model-risk frameworks were built for that world. An agent that calls the same APIs the operations team uses skips the interpretation step. The model’s next token is not the risk. The booking is.
That is why “we tested the model on a hold-out set” is the wrong artefact. Testing samples behaviour. Mandates, concentration limits, sanctions lists, and three-way match are not allowed to fail on the unsampled case. MiFID conduct, CASS, payments regulation, and AML rules are written in always, not usually.
Mandate compliance is the clean example
A managed account has a written mandate: instrument universe, concentration, cash, excluded issuers. An agent proposes a rebalance that looks optimal on risk-return. A human “approves” a ticket they cannot recompute in the SLA. That is not a control. It is a signature on a hypothesis.
The control is a validator that treats the agent as untrusted. Every proposed allocation is a state transition. If it would break an invariant, it does not execute — including when the issuer is wrapped in a look-alike future rather than the cash equity the restriction named. We have run that pattern as a wealth-management operator and as an OTC confirmation PoC: the deny is a first-class fact, not a missing fill.
Fair allocation, best execution narratives, and product-governance obligations have the same shape. You do not need the model to be the policy engine. You need the policy engine to be unable to lie about what it enforced.
Payments, trade finance, and the three-way match
Release a payment only if PO, goods receipt, and invoice match; screen the beneficiary; respect dual control. Agents can assemble the packet faster than a shared-service centre. They cannot be the party that decides the packet is good enough.
A deterministic gate on that match — with a hash-chained record, and a ZK proof where supplier pricing must stay out of the agent’s context — is the same architecture as mandate compliance with a different plugin. The procurement reference implementation exists to show the operator is not a wealth-only toy. The rails (SWIFT, correspondent banking, ERP) stay. The authority layer sits in front of the release.
Why HITL and better prompts do not close the gap
Human-in-the-loop in a dealing or payments room is time-boxed. The officer does not re-derive the mandate from first principles. Prompt injection and tool-calling mean the agent’s input is not a trusted staff member: it is documents, other agents, and APIs. A perimeter of “please follow the policy” is not a mandate.
Model risk management still matters for the proposer — drift, data, explainability of the recommendation. It does not substitute for execution control. You can have an excellent challenger model and still book a prohibited wrapper if nothing gates the order. You can have a perfect SR 11-7 file and still fail an examination that asks why a specific payment left.
What “architectural separation” means on a desk
Reasoning (the agent, the optimiser, the copilot) may be probabilistic. Authority (allow/deny on a consequential transition) must be deterministic and specified. Evidence must be produced at the gate, not reconstructed from OMS, EMS, payment hub, and chat. Where two firms must agree that they screened the same terms, the receipt has to be portable — that is the Trust Fabric, not a new venue.
Practically: specify the invariants in a form machines can check. Generate or bind the validator from that specification. Point every agent tool that can move money or legal state at that validator. Keep the AI out of the enforcement path.
Firms that do this will still use models. They will use them as compilers of intent and as proposers of action. The licence, the mandate, and the payment rule stay in a layer that cannot be argued with. That is not slower automation. It is automation you can defend.