The Financial Stability Board and American Express moved within the same week to fill a governance vacuum around autonomous AI in finance, one from the regulatory side and one from the payments infrastructure side, each responding to the same underlying problem: AI agents are already transacting, and no binding rulebook governs how.
Why it matters
U.S. banking regulators explicitly excluded agentic AI from their primary model risk management framework earlier this year. OCC Bulletin 2026-13, issued jointly by the OCC, the Federal Reserve Board, and the FDIC on April 17, states: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance"2. That exclusion left banks deploying autonomous AI in fraud detection, trading, customer service, and loan decisioning without a governing framework defining how those systems must be validated, monitored, or controlled. ANALYSIS The FSB's recommended practices and AmEx's Intent Intelligence specification, arriving within days of each other, represent two very different attempts to close that gap: one through voluntary global principles, the other through open technical plumbing.
The big picture
The FSB published its "Sound Practices for Responsible Adoption of Artificial Intelligence" on October 15, making it the only internationally recognized governance document written to address agentic AI in banking directly. The 12 non-binding recommended practices, coordinated across G20 economies, carry no enforcement power; compliance is voluntary. Four of the recommended practices stress the importance of company-wide AI governance for financial institutions adopting the technology4. The FSB's report warned that "highly autonomous agentic AI systems may act unpredictably or outside intended boundaries, potentially resulting in unauthorized or erroneous actions, data security incidents and disruption to connected systems".
Two days earlier, on October 13, American Express published the Intent Intelligence Framework, an open technical specification that cryptographically binds a consumer's purchase authorization to the specific constraints of that purchase, including the merchant, budget ceiling, and product specifications3. The framework is available through AmEx's Agentic Commerce Experiences (ACE) Developer Toolkit. Hannah Bozian, AmEx's Vice President of Agentic Partnerships and Strategy, presented the framework at TechCrunch Disrupt 2026 in San Francisco. AmEx confirmed to Digital Commerce 360 that Intent Intelligence has no live integrations yet1.
ANALYSIS The timing is notable: a global regulatory body and one of the largest card networks both moved in the same week to address the same structural problem, but from opposite ends. The FSB wrote principles for how banks should govern AI internally; AmEx wrote plumbing for how a specific class of AI transaction should be authenticated externally.
Between the lines
AmEx's decision to publish the specification openly, rather than rolling it out as a proprietary feature for its own cardmembers, signals an intent to shape how the entire payments industry implements intent-based credentialing. Luke Gebb, head of global innovation at American Express, framed the rationale in terms of ecosystem risk: "Providing authorized purchase intent before an agent transacts can give issuers greater confidence that an agent is acting as a customer intended, while also helping issuers proactively manage risk and reduce the chance of costly disputes across the payments ecosystem".
ANALYSIS That language maps directly onto the FSB's concern about autonomous systems acting "outside intended boundaries." Both the regulator and the payments company are converging on the same core anxiety: when an AI agent sits between a consumer and a merchant, the traditional two-party trust model breaks down, and neither fraud detection nor dispute resolution works the way it used to.
The FSB's framework, however, remains advisory. It fills a governance void but does not create enforceable obligations. ◆ The U.S. interagency exclusion of agentic AI from OCC Bulletin 2026-13 means American banks currently face a landscape where the only agentic-AI governance document with international standing is non-binding, and the domestic framework that does bind them explicitly does not cover these systems.
AmEx's specification addresses one narrow but critical slice of the problem: proving that what an agent bought matches what a consumer authorized. Card issuers can use those records to help detect fraud, approve payments, and resolve disputes. For retailers, the framework could help determine whether an ordering mistake originated with an AI agent.
What's next
AmEx said Intent Intelligence is one of five services it introduced in April through its ACE developer kit. The company's open publication strategy invites other payment and technology providers to adopt its approach. ANALYSIS Whether that invitation gains traction depends on whether competing protocols from other networks converge on similar intent-verification architectures or fragment the emerging standard. The FSB's practices, meanwhile, will test whether voluntary guidance can shape bank behavior in the absence of binding U.S. rules. The gap between the two efforts, one setting principles and the other shipping code, defines the current state of agentic-AI governance in finance: fast-moving, structurally incomplete, and split between institutions that can recommend and institutions that can build.