A Credit Policy Change Must Reach the Provider Agent

Define the Policy Event That Must Take Effect

The credit manager should identify the approved source, policy owner, affected products and entities, effective time, and required treatment of pending cases. A provider should not infer those facts from a document filename or the latest material its retrieval system happens to find.

The FCA’s practice examples emphasize clear responsibilities and governance of AI-supported services.¹ They create no new requirements. The manager’s operational task is to connect the bank’s policy decision to the actual behavior of the service for which it remains responsible.

For a hypothetical lending-policy revision, new applications may need a different eligibility threshold while existing cases follow a specified transition rule. The provider’s agent and human team need the same approved interpretation. Applying the newest wording to every case may itself be incorrect.

Trace Every Place the Rule Is Used

Policy can appear in retrieval sources, prompts, hard-coded checks, tool settings, examples, training materials, and operator habits. Identify those locations and their owners. Updating a central document may leave an older rule embedded in a separate component that still determines the action.

The study reports process and co-management difficulties that can delay changes across the two firms.² These accounts do not establish a credit-policy breach. They identify why notification and operational implementation should be treated as separate stages.

Require the provider to identify affected configurations and downstream services. If it cannot show where the rule is used, record that uncertainty and restrict consequential action as appropriate. A general assurance that the knowledge base is current should not close an untested propagation question.

Use a Policy to Execution Change Record

Figure 1 proposes four links: approved source, implementation, effective-date test, and joint acceptance. Preserve the old and new rules, interpretation, affected population, configuration references, evidence, and approval. The record should explain which policy governed a historical case.

Test cases immediately before and after the effective time, plus pending cases, exceptions, ambiguous inputs, and conflicting source material. Verify the action in the receiving system. An agent correctly quoting the new policy does not establish that its tools and final decision apply it.

BCG’s regulated-agent discussion identifies shared standards and controlled memory and knowledge as architectural needs.³ The proposed change record turns that concern into a management acceptance test. Platform features support implementation, while the bank policy owner decides the governing meaning.

Protect Local Authority and Customer Treatment

EU, UK, Swiss, US, and other lending or suitability requirements differ. Qualified policy, legal, risk, and conduct owners should establish local application, notices, exceptions, and transition treatment. A global model instruction should not determine a jurisdiction-specific credit obligation by inference.

The provider should escalate contradictory or incomplete instructions rather than select the interpretation that produces the fastest completion. Define who can resolve uncertainty and what activity pauses while waiting. Preserve the decision so that the same question is not repeatedly improvised by different operators.

After release, inspect representative cases for use of stale rules and monitor the affected outcomes. Include human corrections and work returned to the bank. Where a policy defect has already affected cases, identify the population and required review rather than assume the software update repairs past decisions.

Close the Change Through Demonstrated Application

A reasonable objection is that this duplicates document control. Document control establishes the approved source; propagation establishes that the live service applies it. Reuse existing controls but test the additional links introduced by retrieval, tool execution, and the provider boundary.

Require joint sign-off from the bank policy owner and provider delivery owner after the affected workflow passes its tests. State any limitations and enforce restrictions. Retain a rollback or suspension route that respects the policy’s effective requirements rather than simply restoring an obsolete rule.

The manager should close the policy change when the bank can explain which rule governed each affected case and demonstrate that the live service applies it. Distribution is a necessary step. Operational acceptance requires evidence that the decision reached execution.

Evidence and Source Note

The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.⁴

This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is a policy-to-execution change chain preserving effective dates, pending-case treatment, technical implementation, and joint acceptance. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.

Notes

1. Financial Conduct Authority, “AI in Financial Services: Good Practice and Areas for Improvement,” Financial Conduct Authority, October 19, 2026; updated October 20, 2026, secs. 1.2, 2, 3.4 and 4.2; illustrative practices, not new requirements, https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services. ↩
2. Phil Hatch, Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report, version 1.8.2 (Akholi, forthcoming manuscript dated November 1, 2026), Part 2, “The Shift From Managing People to Managing Agents”; Part 6, “The Executive Action Plan”, https://doi.org/10.2139/ssrn.7164559; Hatch, Agentic AI Outsourcing, Part 2, sec. 5.2, “Joint Decision Speed Mismatched to Agent Speed”. ↩
3. Daniel Martines et al., “Building Enterprise AI Agents in Regulated Industries,” Boston Consulting Group, July 20, 2026, enterprise platform and identity control sections, https://www.bcg.com/publications/2026/building-enterprise-ai-agents-in-regulated-industries. ↩
4. Hatch, Agentic AI Outsourcing, Introduction, “Executive Summary” and “Evidentiary Basis and Its Limits”. ↩

Bibliography

• Financial Conduct Authority. “AI in Financial Services: Good Practice and Areas for Improvement.” Financial Conduct Authority. October 19, 2026; updated October 20, 2026. https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services.
• Hatch, Phil. Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report. Version 1.8.2. Akholi. Forthcoming manuscript dated November 1, 2026. Author-supplied manuscript consulted October 23, 2026. https://doi.org/10.2139/ssrn.7164559.
• Martines, Daniel, Cullen Breithaupt, Drew Ingalls, Sawan Ruparel, and Prithvi Vadlamudi. “Building Enterprise AI Agents in Regulated Industries.” Boston Consulting Group. July 20, 2026. https://www.bcg.com/publications/2026/building-enterprise-ai-agents-in-regulated-industries.