Most regulatory frameworks still assume a human reviews every high-stakes decision about account access, transaction limits and identity trust scores. That assumption is breaking as financial firms put autonomous agents onto verification, fraud and compliance workflows without waiting for a playbook. The useful question is no longer whether agents will make those calls. It is what explainability, audit trails and escalation protocols look like when they do, and who writes the first draft of those standards before legislation arrives.
Sumsub's Asia-Pacific council puts that question to compliance officers, risk managers and technologists who see what breaks when an AI agent rejects a customer onboarding application or flags a transaction as suspicious. The gap between the human-review assumption and operational reality is widening every quarter.
The group's remit is to produce guidance that financial institutions can adopt before their local regulator publishes formal rules. It will focus on three areas: explainability standards for agent decisions, audit trails that satisfy compliance teams, and escalation protocols that define when a human must override the machine.
Sumsub's move reflects a broader pattern in which vendors and industry bodies write the first draft of governance frameworks because waiting for legislation would mean waiting years. The council will draw on case studies from member organisations, which means the guidance will reflect what actually breaks in production rather than what sounds sensible in a policy paper.
Learning and development leaders in financial services are already fielding questions from compliance officers who need to understand how agentic AI differs from the rules-based automation they have overseen for the past decade. A rules-based system follows a decision tree; an agentic system adapts its behaviour based on patterns it identifies in data, and that adaptability introduces risk that existing training programmes do not address.
The council's guidance will give L&D teams a reference point for building capability in three areas. First, compliance staff need to know how to audit an agent's decision log and identify when the agent has drifted from its intended behaviour. Second, risk managers need to understand how to set guardrails that prevent an agent from making decisions outside its competence. Third, customer service teams need to explain agent decisions to customers in plain language, which requires a working mental model of how the agent weighs evidence.
Organisations that wait for their regulator to mandate training will find themselves behind peers who have already upskilled their compliance and risk functions. The council's output will not carry legal force, but it will establish a de facto standard that auditors and regulators will reference when they assess whether a firm has exercised reasonable care in deploying agentic AI.
Most compliance teams can explain how a credit scoring model works because those models have been in use for decades and their logic is transparent. Agentic AI is different because the agent's decision-making process is emergent rather than programmed, and that emergent quality makes it harder to predict how the agent will behave when it encounters an edge case.
The council's guidance will need to address that predictability gap by defining what documentation and testing an organisation must complete before it grants an agent the authority to make binding decisions. It will also need to specify how often an organisation must review an agent's performance and what triggers should prompt a pause or rollback.
For L&D leaders, this creates an opportunity to position their teams as the function that builds organisational fluency in agentic AI before it becomes a compliance crisis. That means designing learning experiences that go beyond conceptual overviews and give compliance officers hands-on practice in interrogating agent behaviour, interpreting decision logs and calibrating guardrails.
The council's first deliverable will likely be a set of principles rather than a detailed rulebook, because the technology is still evolving and overly prescriptive guidance would become obsolete quickly. Those principles will establish expectations around transparency, accountability and human oversight, and they will give organisations a framework for making defensible decisions about where to deploy agents and where to insist on human review.
Financial services firms that participate in the council will gain early access to that framework and the ability to shape it based on their own deployment experience. Firms that sit out the process will still need to meet the standard the council establishes, but they will do so without the context that comes from contributing to its development.
For learning and development leaders, the immediate task is to identify which roles in the organisation need to understand agentic AI and to what depth. Compliance officers need a different level of fluency than customer service representatives, and both need a different level than the data scientists who build and maintain the agents. The council's guidance will help clarify those distinctions, but organisations that wait for the final document before they start building capability will lose six to twelve months they cannot afford to lose.
Sources:
.png)
The WorkFlow podcast is hosted by Steve Glaveski with a mission to help you unlock your potential to do more great work in far less time, whether you're working as part of a team or flying solo, and to set you up for a richer life.
To help you avoid stepping into these all too common pitfalls, we’ve reflected on our five years as an organization working on corporate innovation programs across the globe, and have prepared 100 DOs and DON’Ts.
