Research into two-party agentic delivery
Deposit-taking institutions, lending, payments, financial crime, financial control, and bank outsourcing.
AAO-008 / Regulation and Compliance
Direct oversight of critical technology suppliers does not establish that a bank’s own agentic service is governed or recoverable. Directors should require a dependency review connecting the primary provider to the bank’s actual business service.
AAO-001 / Regulation and Compliance
US bank leaders should require a complete control coverage decision for every outsourced agentic service. Exclusion from model risk guidance leaves the bank with a governance task that a provider model review cannot settle.
AAO-004 / Governance and Accountability
Bank payment and vendor-access managers should preserve independently enforced preparation, approval, and execution when provider agents act. Different agent names do not establish separation if one credential or administrator can control the entire transaction.
AAO-121 / Governance and Accountability
Every one of the study’s 150 engagements contained a reported departure from intended governance, oversight, or control functions. Bank boards should commission an independent audit of delivery, contain material exposure, and require evidence that corrections operate.
AAO-122 / Assurance and Audit
100% of sampled engagements had reported manual alteration: 150 of 150. Under 1.3% of pooled disclosure answers reported discussion with the bank: 13 of 1,004 answers. Boards should independently reconstruct the service, its human contribution, and the account the bank received.
AAO-126 / Assurance and Audit
Reported control departures and manual alteration each reached 150 of 150 sampled engagements. The manual-alteration contrast is 100% of engagements versus under 1.3% of pooled disclosure answers. Bank boards should commission an independent portfolio audit covering provider delivery and the bank’s own readiness.