European banks are deploying AI agents faster than they are governing them.

European banking has adopted AI agents in back office and operations work faster than the public conversation suggests. Reconciliation, exception handling, customer correspondence drafting, control testing.

The security question these deployments raise is old in form and new in scale: who did this, and under what authority.

The credential problem

Most early agent deployments run under a service account, or worse, under the credentials of the employee who configured them. Both break the audit trail.

A regulator asking who approved a transaction wants a name and an authority. An answer that resolves to a shared service account is not an answer, and in several supervisory conversations reported by banks this year, it has been treated as a control failure.

What a governed agent looks like

Four properties recur among the banks that have got ahead of this. The agent has its own identity, distinct from any human. That identity carries an explicit, minimal entitlement set. Every action is logged against the agent identity and the human sponsor. And a named human owner is accountable for the agent's behaviour, reviewed periodically like any other access right.

The harder problem

Entitlement creep. An agent that gains capability over time accumulates permissions, and nothing in most access review processes is designed to notice that a non-human identity is now able to do considerably more than when it was approved.

The banks handling this apply the same recertification cycle to agent identities as to privileged human accounts. That is unglamorous and it is the control that works.

The regulatory direction

Supervisors have not yet published detailed expectations for agent identity, and the direction of travel is clear from the questions being asked in reviews. Institutions that can demonstrate agent-level accountability now will be describing an existing control rather than building a new one under deadline.