The Financial Stability Board (FSB) published the final version of its report Sound Practices for Responsible Adoption of Artificial Intelligence on 15 October 2026, setting out 12 practices for financial institutions worldwide and strongly encouraging boards and senior management to measure their own AI governance, risk management and control frameworks against the list. The final report follows a consultative version released in June 2026, and the FSB published an overview of the consultation responses on the same day.
Not a new law, but a yardstick national supervisors can pick up
The FSB coordinates financial authorities from 24 countries and jurisdictions and does not enforce rules itself; the 12 practices do not constitute a binding international standard. Officially, they are a practical toolkit that institutions can tailor to their size and risk profile and integrate into existing frameworks, including those for cyber and third-party risk. Their weight comes from who sits at the table: a home supervisor conducting inspections or questioning a board can go through the list item by item. Ignoring the practices brings no FSB fine today, but it can leave an institution unable to answer its own regulator. This is also different from the AI risk management guidelines finalised by Singapore's MAS on 7 October 2026: those are one jurisdiction's supervisory guidelines for its own financial institutions, while the FSB text is global, covers banks, insurers and other financial institutions, and sets no single compliance deadline.
Four practices question the board, eight govern the whole lifecycle
The first group of four covers organisation-wide governance: boards and senior management must align AI adoption with the business model, risk appetite and strategy; governance roles and responsibilities must be clearly defined; AI risks must be incorporated into the existing risk management framework, with effective documentation of where AI is used; and the organisation must keep learning and adapting as the technology changes. The second group of eight follows each use case from inception to retirement: assess materiality and risk at inception and thereafter; select technologies suited to the task; govern data so that training, testing and production data stay accurate, complete, reliable and secure; where explainability is limited, consider more explainable approaches or compensating controls; evaluate performance, test and monitor in proportion to risk; keep human oversight appropriate and effective; manage AI-related cyber and ICT risks; and manage third-party AI dependencies, including performance, transparency, data quality, supply-chain concentration and business continuity risks.
The biggest change in the final text puts an approval gate on agents
According to Reuters' reporting on the final guidance, the FSB strengthened the section on agentic AI after the June consultation: the higher the risk of a use case, the more intensive human oversight should be, and institutions should set clear, risk-based triggers defining which actions an agent may only take after obtaining human approval. The final text also drops the idea of treating AI as "synthetic employees", reminding institutions instead that AI agents do not reason like humans and may interpret pre-defined goals in unexpected ways. The logic is direct: for systems that can act on their own, permission boundaries cannot live in principles alone; they have to be written as concrete approval triggers.
Four things financial institutions should fix now
First, take inventory: register every AI use case, its data sources and third-party dependencies, and close the documentation gaps the practices point to. Second, tier the agents: decide by materiality and risk which actions may run automatically and which require a human sign-off, and write the triggers into system configuration rather than leaving them in meeting minutes. Third, pay down the explainability debt: for high-risk models whose workings cannot be explained, either move to a more explainable approach or add compensating controls such as human review and exposure limits, with transparency tailored to each audience. Fourth, treat third-party risk as your own: review vendor performance, data quality and concentration regularly, and keep audit and exit arrangements in contracts. Suppliers selling AI products to banks and insurers should also prepare: customer due-diligence questionnaires will likely grow along the lines of these 12 practices, and deals will stall at the compliance stage if questions on data governance and human oversight cannot be answered.
