Skip to paper content

AAO-065 / Regulation and Compliance

Translate Bank Obligations into Provider Delivery Work

A Provider Method for Executable Customer Requirements

Banking service providers should translate each accepted customer obligation into a delivery rule, evidence requirement, escalation route, and change trigger. A policy acknowledgement does not establish that a team or agent can carry out the obligation during live work.

By · Published by Akholi
· 4 pages · 5 min read

Download paper PDFRead online ↓
Title page: Translate Bank Obligations into Provider Delivery Work — A Provider Method for Executable Customer Requirements. Phil Hatch, Akholi, October 23, 2026.

Start with the Obligation the Provider Accepted

The provider’s banking service leader should identify which obligations the contract and approved operating instructions place on the delivery team. Some reflect bank requirements, some applicable law, and others a negotiated service commitment. Preserve those distinctions so that staff know both the required action and who can interpret uncertainty.

FINMA’s AI guidance addresses governance, data quality, documentation, and controls in supervised financial institutions.1 It is Swiss supervisory guidance, not a universal provider rule. The provider should ask its bank customer which applicable requirements the service must support and obtain an authoritative interpretation rather than improvise one.

Begin with a consequential activity such as access approval, record correction, incident escalation, or customer communication. State what the provider must do, what it must not do, and which evidence the bank needs. A long policy library should lead to a usable instruction at the point of action.

Find the Gap Between Acknowledgement and Execution

The study reports governance functions not operating as planned and processes insufficiently adapted to agentic delivery.2 It does not determine the legal obligations of another service. It does show why a completed training acknowledgement cannot alone establish that a delivery team can operate the required control.

For a hypothetical bank instruction requiring approval before changing a data mapping, the provider should identify who requests approval, what evidence accompanies the request, who can decide, and what work is paused while waiting. If no authorized bank responder is available, the provider needs a defined restricted route.

The same instruction should reach human operators, agent permissions, workflow checks, and monitoring. A rule visible only in a policy portal can conflict with tool access that allows immediate execution. Resolve the conflict through the operating design and customer decision, not through informal staff workarounds.

Use an Obligation to Work Record

Figure 1 proposes four links: requirement, execution rule, evidence, and change. Record the bank owner who approves the interpretation and the provider owner who implements it. Include the applicable service, jurisdiction, effective date, exceptions, and conditions requiring escalation.

Test the rule using normal and difficult cases. Ask delivery staff to demonstrate the action, including what they do when the buyer’s instruction is incomplete or contradictory. Confirm that the agent’s tool permissions and automated checks implement the same approved boundary.

Morgan Lewis’s outsourcing overview emphasizes clear governance and responsibility across AI-enabled services.3 The provider’s implementation should make that allocation operational. It needs a reliable path to obtain customer decisions and preserve the evidence that the agreed rule was followed.

The obligation to work record. Requirement; Approved customer interpretation; Which duty and service apply. Execution; Workflow permissions and staff action; Can the team perform the rule. Evidence; Attributable control record; Can the bank verify performance. Change; Version owner and acceptance trigger; Does the rule remain current. Author’s proposed operating framework. Adapt to the service and applicable jurisdiction; not an empirically validated standard.
Figure 1. The obligation to work recordPhil Hatch, proposed framework developed for this paper.

Maintain Local Requirements and Joint Decisions

EU, UK, Swiss, US, and other banking requirements differ by entity and activity. Avoid one generic global compliance script. Maintain a common delivery method while applying the customer-approved local rule where it belongs. Resolve cross-border conflicts through qualified customer and provider specialists.

The provider should disclose when a requirement cannot be met with the current architecture, staffing, access, or response time. Record the limitation and proposed remedy. A commercial commitment should not turn an unavailable control into an instruction for operators to simulate completion.

Changes to bank policy, regulation, model behavior, delivery location, or subcontractors can affect the rule. Agree who identifies the change, supplies the interpretation, updates the workflow, retrains staff, and confirms acceptance. Preserve the old and new versions so that historical work remains explainable.

Demonstrate Compliance Support Through Delivery

A reasonable objection is that the bank must own its obligations. It does. The provider nevertheless owns the actions it agreed to perform and the accuracy of its evidence. Clear boundaries protect both parties by separating bank interpretation from provider execution and identifying where a joint decision is necessary.

Review a priority set of obligations with the customer before expanding agentic authority. Demonstrate each relevant control in the actual service, including a failed prerequisite and an escalation. Obtain agreement on unresolved limitations and restrict the affected work until the necessary decision or capability exists.

The provider should leave the exercise with a delivery team that can explain what the bank requires and demonstrate how the service supports it. That capability is stronger than policy acknowledgement. It connects the customer’s obligation to the actions, evidence, and decisions that sustain the outsourced service.

Evidence and Source Note

The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.4

This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is a provider obligation-to-work record translating bank requirements into executable controls, customer decisions, and maintained evidence. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.

Notes

  1. Swiss Financial Market Supervisory Authority, Governance and Risk Management When Using Artificial Intelligence (Swiss Financial Market Supervisory Authority, December 18, 2024), FINMA Guidance 08/2024, secs. 2.1–2.7, https://www.finma.ch/~/media/finma/dokumente/dokumentencenter/myfinma/4dokumentation/finma-aufsichtsmitteilungen/20241218-finma-aufsichtsmitteilung-08-2024.pdf?hash=60E2745D7AC1D7F4E06CE43474539F68&sc_lang=en. ↩
  2. Phil Hatch, Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report, version 1.8.2 (Akholi, forthcoming manuscript dated November 1, 2026), Part 2, secs. 4.2–4.3, “Human Review Capacity Against Agent Output Volume” and “Routine Approval of Agent Output at Human Review Points”, https://doi.org/10.2139/ssrn.7164559; Hatch, Agentic AI Outsourcing, Part 2, “The Shift From Managing People to Managing Agents”; Part 6, “The Executive Action Plan”. ↩
  3. Barbara Murphy Melby et al., “AI-Enabled Outsourcing: Key Contract, Pricing, and Governance Considerations,” Morgan Lewis, July 2026, public report overview and key takeaways, https://www.morganlewis.com/pubs/2026/07/ai-enabled-outsourcing-key-contract-pricing-and-governance-considerations. ↩
  4. Hatch, Agentic AI Outsourcing, Introduction, “Executive Summary” and “Evidentiary Basis and Its Limits”. ↩

Bibliography

Explore this subject

Category: Regulation and Compliance  

Topics: Domain Judgment   Joint Training   Obligation Mapping  

Audience: Service Providers  

Industry: Banking   Financial Services  

Continue your review

Read the full study, examine its evidence and limitations, or find another paper for your decision.

Browse all papers