Reference
FINMA Guidance 08/2024 in three requirements
In December 2024 FINMA published Guidance 08/2024 on the governance and risk management of artificial intelligence in supervised institutions. The essays on this site cite it constantly, because it sets the conditions under which a Swiss bank may let an agent decide. The constraint is less restrictive than most bankers assume, and more specific than they expect. Three requirements matter for an agentic operating model.
Accountability cannot be delegated to AI
A named person with authority and expertise answers for every decision an agent makes. That does not mean a human approves every decision. It means someone owns the outcomes, the way a team lead owns a team's output. The accountability is organisational, not transactional.
Autonomous operation requires demonstrated reliability
FINMA states that AI may be used autonomously once it is "sufficiently reliable and this can ultimately be proven." This is a design requirement, not a prohibition. The bank must show that the agent operates reliably within its defined envelope: testing before deployment, monitoring in operation, and evidence a supervisor can inspect.
The institution must retain the expertise to override
The bank cannot become so dependent on a system that no one inside it understands or can challenge its decisions. Skilled staff must be able to review, explain and, if necessary, reverse any outcome an agent produced.
What this means in practice
An agent may autonomously approve a standard mortgage within a defined policy envelope, provided the bank can prove the agent's reliability, name the accountable person, explain any individual decision and override it when needed. The guidance also expects an inventory of AI applications, documented and tested methodologies for applications in critical processes, and explainability proportionate to the decision. It prescribes none of the methods. It requires the bank to choose them and to defend the choice.
This is principles-based regulation applied to agentic systems. It sets the bar. It does not prohibit the model. The EU AI Act, by contrast, classifies credit assessment as high-risk and prescribes detailed requirements for it, which is why the comparison recurs on this site.
Where the essays apply it
- Case Sketch: Mortgage Lending in an Agentic TOM: The three requirements applied to one end-to-end process.
- Escalation by Design: How a decision returns to the accountable human.
- From ABS to Autopilot: Reliability evidence as the permission slip for each level of autonomy.
- Who Manages the Agents?: Where accountability sits within the three lines of defence.
- The Swiss Agentic Advantage: Why a principles-based regulator leaves room for agentic systems.
Source: FINMA, Guidance 08/2024 “Governance and risk management when using artificial intelligence”, 18 December 2024. The summary above is the author's reading, written for an operating model discussion, not a legal opinion.