On July 17, the Financial Stability Board published Sound Practice 10, its guidance on supervising AI agents in financial services. Read the architecture, not the summary. The framework's central design—human-in-command layered over AI-in-the-loop—is not a strengthening of oversight. It is a structured concession, written in the grammar of compliance. Item-by-item human review of autonomous financial agents is incompatible with the speed at which those agents operate. The FSB did not announce this incompatibility. It designed around it.
I have built exactly this kind of governance architecture for most of my career—first for lending protocols during DeFi Summer, then for a DAO that nearly fractured during the 2022 crash, and now for autonomous organizations run by AI agents. The pattern repeats. When a system runs faster than its operators can verify, you do not slow the system. You move the human from the loop into the command layer. Sound Practice 10 does precisely this. Whether it holds depends on a failure mode the framework never names.
Establish the structure before the critique. Sound Practice 10 reframes supervision in two tiers. The first tier, human-in-command, is an accountability architecture: humans retain final authority over the boundaries of agent autonomy and the guardrails agents operate within. The second tier, AI-in-the-loop, is an operational mode: AI systems monitor other AI systems to supplement human oversight "as systems scale." The framework shifts institutions from item-by-item decision review to high-level supervision—defining autonomy boundaries, setting guardrails, auditing after the fact. For transaction-class agents it imposes three controls: monetary thresholds requiring human approval or dual authorization, restrictions on payment-system access, and full audit trails.
FSB guidance carries no legal force. This is the detail most readers will skip past. But the transmission mechanism from soft law to hard constraint is well-documented. The Federal Reserve, the OCC, the FDIC, the SEC, and the CFPB convert FSB recommendations into examination requirements. Basel did not become binding because legislatures ratified it. It became binding because examiners began asking questions. That pathway now opens for agentic AI. Skadden's read—that firms should align with the FSB standard immediately—is not legal caution. It is a forecast of the examination cycle.
Note what is absent from the framework. Sound Practice 10 is a governance document, not a technical specification. It does not touch model architecture, training methodology, or data engineering. It specifies control points—thresholds, audit trails, authorization gates—and leaves implementation to institutions. That is either prudent flexibility or an abdication, depending on how the examination cycle reads it. History suggests examiners read flexibility as a to-do list.
Here is where the architecture fails, and it fails in a way I have watched before.
AI-in-the-loop introduces recursive supervision risk: the supervisor and the supervised share the same source. If the monitoring model and the operating model come from the same family or the same vendor, their hallucinations, jailbreaks, and out-of-distribution failures are correlated. The two-layer defense does not provide redundancy. It provides a single point of failure wearing two coats. The framework presents AI-in-the-loop as a supplement to human oversight. It never notes that a correlated monitoring model may be a liability rather than an asset.
I met the governance equivalent of this during the 2022 crash. Our DAO's voting mechanism did not fail because it lacked oversight. It failed because the oversight mechanism inherited the same structural flaw as the thing it was meant to check. Whale dominance in a token-weighted vote is not a bug in the vote. It is the vote. We replaced it with quadratic voting because the correction had to be architectural, not procedural. Adding a human reviewer to a broken mechanism does not fix the mechanism. It adds latency to the failure. The FSB framework has the same blind spot one layer down, at the model. Efficiency without oversight is just faster risk—but oversight that shares the failure mode of the system it guards is not oversight at all.
Then there is threshold arbitrage. Any monetary threshold the FSB sets becomes an immediate optimization target for the agent it constrains. Large transactions can be structured into sub-threshold components. Traditional finance has a name for this: smurfing. The FSB recommendation says nothing about anti-structuring design. It specifies the threshold and leaves the splitting problem to the institutions. In a DAO, I watched proposals get fragmented across governance epochs for exactly this reason—each fragment fell below the quorum that would have triggered a full review. Trust the code, but verify the architecture. A threshold without cumulative or relational detection is a schema waiting to be gamed.
The third gap is semantic, and it is the one most likely to produce real losses. The framework uses human-in-command and human-in-the-loop almost interchangeably. They are not the same. Human-in-command is an accountability structure: a human holds final authority. Human-in-the-loop is an operational mode: a human sits in the execution path. Institutions reading Sound Practice 10 may conclude that a signature somewhere in the workflow discharges their obligation. It does not. A signature without authority over boundaries is theater.
Now the audit trail requirement. Full audit trails assume logs can be understood after the fact. For high-dimensional autonomous decision chains, post-hoc interpretability is expensive, and the framework never quantifies the cost. Financial compliance logs typically carry five-to-seven-year retention windows. The storage and retrieval infrastructure for interpretable agent decision traces at that retention horizon is not a solved problem. It is a line item nobody has budgeted. When I designed the governance framework for an AI-agent-managed DAO, the audit trail was the single most underestimated component—not the voting thresholds, not the ethics review, but the cost of making an autonomous decision legible eighteen months after it executed.
There is a fifth omission worth naming. The framework does not distinguish operational risk from model-intrinsic risk. An agent that executes a bad trade because a human set a bad boundary is a different failure than an agent that executes a bad trade because it was prompt-injected. The FSB framework treats both as institution-borne risk. That conflation will surface the first time an adversarial attack produces a loss and no one can decide whether it was a governance failure or a security breach.
These gaps converge on a technical requirement the framework implies but never states. Sound Practice 10 requires a stack that supports interruptible execution, decision provenance, least privilege, and dual-authorization workflows. Current mainstream agent architectures—ReAct, Plan-and-Execute, multi-agent orchestration—do not treat a human authority reservation point as a first-class citizen. They treat it as a callback. Retrofitting an accountability layer onto a planning-execution loop is not an integration task. It is a rewrite. And the audit requirement will likely force mandatory persistence of reasoning chains, which collides directly with privacy and cost constraints.
The mitigation is not complicated to state and hard to implement: the monitoring layer must be architecturally heterogeneous from the operating layer—different model families, different vendors, different failure modes. The FSB does not require this. It should. A framework that permits self-certified supervision will produce self-certified supervision. And self-certification, in every governance system I have audited, is the fastest route to correlated collapse.
Cross-border enforcement compounds all of this. If thresholds are set nationally, an agent registered in one jurisdiction and transacting in another faces two rulebooks. The framework does not resolve which applies—registration or transaction location. Unresolved, it becomes an arbitrage surface: deploy where the threshold is highest, execute where detection is weakest.
The instinctive reading of Sound Practice 10 is that it constrains AI agents. The structural reading is the opposite: it redistributes liability and accelerates market concentration.
The "tools-not-actors" principle—if broadly adopted—pushes responsibility forward onto developers. An agent that is legally a tool, not an actor, transfers liability to whoever built and deployed it. This benefits firms with legal departments and insurance capacity. It penalizes open-source communities and independent developers, who cannot absorb that risk. The framework does not mention open source. It does not need to. The requirement for reproducible versions and auditable behavior is structurally hostile to uncontrolled distribution. Compliance, in other words, becomes a moat.
The deeper blind spot is that Sound Practice 10 governs internal governance structures. It does not resolve external legal liability. When an agent buys, books, or emails in error, who is responsible—the foundation-model vendor, the agent integrator, the deploying institution, or the end user? The framework leaves this open. The ledger remembers what the community forgets, and this ledger is being written with no name in the liability column. An unresolved liability boundary does not produce caution. It produces a race to disclaim. Consumer-facing agents operating under vendor-authored liability terms will face compliance pressure; enterprise agents sold on controllability will gain relative advantage. The competitive variable is no longer model capability. It is governance posture.
Insurance is the hidden pricing anchor here. If AI liability coverage does not materialize—and it will not quickly, because there is no loss history to underwrite against—institutions internalize the entire risk of autonomous deployment. That constraint is harder than any regulator. It does not need an examination manual to bite.
One more omission. The framework is silent on non-US, non-EU jurisdictions. The FSB's membership includes China. That silence is not neutrality. It is a gap that will be filled by whoever moves first—and regulatory fragmentation is the likeliest outcome.
Sound Practice 10 marks the point where agentic AI in finance shifts from a capability race to a governance race. The FSB did not strengthen supervision. It institutionalized the admission that supervision at machine speed requires machines—and then declined to address what happens when those machines share their maker's flaws. Governance is not a feature; it is the foundation. The framework gets the foundation's shape right and its load-bearing properties wrong. The institutions that win the next cycle will not be the ones with the fastest agents. They will be the ones whose monitoring layer is genuinely independent, whose thresholds are relational rather than static, and whose liability is pre-allocated before the first autonomous transaction settles. In the crash, only structure survives the chaos. The open question is whether the structure the FSB drew can survive its own supervisor.