The AI rulebook for banks just got real: FSB, Hong Kong and the IMF in one week

Three official bodies put out AI-and-finance warnings or rulebooks within four days of each other. One is a global standard, one is a regional regulator getting ready for AI that acts on its own, and one is the IMF's reminder that the same AI wave is making cyberattacks faster. Read together, they show where supervisors are heading: less debate about whether banks may use AI, more focus on who is accountable when it acts.

The global standard: FSB's 12 sound practices

On October 15, 2026, the Financial Stability Board published the final version of its Sound Practices for Responsible Adoption of Artificial Intelligence, after a consultation that opened in June 2026. The FSB brings together national authorities from 24 countries and jurisdictions, and is chaired by Andrew Bailey, Governor of the Bank of England.

The report lists 12 practices in two groups. The first group is about organization-wide governance:

• The board and senior management oversee how AI adoption fits the business model, risk appetite and strategy.
• Roles and responsibilities are clearly defined.
• AI risks are built into the risk management framework, with documentation of where AI is used.
• Institutions keep learning and adapting.

The second group covers the AI lifecycle: assessing the materiality and risk of each use case at the start and afterward, choosing appropriate technology, data governance, explainability (with compensating controls where a model cannot explain itself), performance evaluation, appropriate and effective human oversight, AI-related cyber and ICT risk, and risks from third-party AI dependencies.

The FSB calls the practices a toolkit that institutions can tailor to their context. It strongly encourages boards and senior management to reference them. It does not describe them as binding law.

The regional move: Hong Kong's ART Framework

Also on October 15, the Hong Kong Monetary Authority announced its ART Framework, short for Accountability, Resilience and Trust. It includes new supervisory guidance on responsible AI adoption, an AI training-data sharing platform built with Cyberport and the University of Hong Kong, and more testing of agentic AI in its GenA.I. Sandbox++.

The HKMA also said more than 60% of the use cases in the second GenA.I. Sandbox cohort explored agentic AI, meaning automated planning and execution of multi-step tasks within defined boundaries and controls².

The forward-looking part is a planned discussion paper on a proposed supervisory framework for agentic AI governance. The HKMA says it will explore intent-anchored accountability, a registry of material AI agents, and effective intervention mechanisms. That is a proposal to be discussed. It is not a rule in force today.

The risk side: the IMF on cyber speed

In its October 2026 Global Financial Stability Report and an accompanying blog dated October 13, the IMF named three risks that could tighten financial conditions: an AI-driven market correction, a sharp rise in sovereign bond yields, and cyberattacks.

On cyber, the IMF said that in more than 70% of reported cases so far this year, software providers had almost no time to patch a vulnerability before attackers exploited it¹. The IMF's blog says that is more than double the share in 2021, when providers typically had close to 300 days. Reuters reports the jump as 20 percentage points from a year ago.

The IMF added that frontier AI models could speed up both attacks and defenses, and stressed cyber resilience, incident reporting, crisis preparedness and oversight of critical third-party providers.

How the three connect

The FSB's practices on human oversight, cyber risk and third-party dependencies read like a direct answer to the IMF's warning. The HKMA's agentic work asks the next question: if an AI agent plans and carries out several steps on its own, who set its intent, who can stop it, and how does a supervisor know it exists? A registry of material agents is one idea for answering that.

For anyone following AI in markets, the practical takeaway is about risk, not returns. The tools that touch money are being pulled into the same governance rules as other critical systems, and the weak point regulators keep naming is third-party dependence.

What to watch next

• Whether the HKMA's discussion paper is published, and what it says about agent registries.
• Whether other FSB member jurisdictions say they will reference the 12 practices in supervision.
• Any follow-up from the IMF or national regulators on third-party technology provider oversight.

This article tracks official publications only. It does not evaluate any bank's AI, and nothing here is a recommendation on any security.