PEHTEE-NU
Talk to us

The oversight gap, verified

Every claim below is checked directly against a primary source (the actual supervisory letter, the actual framework document), not a summary of one.

The market is already moving

Juniper Research projects agentic commerce spend will reach $1.5 trillion by 2030, growing, in their words, “from only pilot deployments in 2025 and 2026”, and names trust as the number one barrier to deployment. In a joint white paper with Sunrate, Mastercard frames it as the determinant rather than the obstacle: autonomous payment decisions need “a clear, auditable chain of identity, intent and action,” and that is “what will determine whether agentic commerce scales past pilots.”

That trust gap has a specific, checkable shape in U.S. financial regulation.

Regulators named the exclusion explicitly

In April 2026, the Federal Reserve and the OCC issued matching guidance, in identical language, placing generative and agentic AI outside existing model-risk oversight, and announced a request for information on banks' use of AI, including agentic AI, which had still not been issued as of early October 2026.

Generative AI and agentic AI models are described as novel and rapidly evolving, and explicitly placed outside the scope of the guidance.

FEDERAL RESERVE SR 26-2 & OCC BULLETIN 2026-13 · APRIL 17, 2026

A real framework exists, but not for this

Two months earlier, the U.S. Treasury had published a Financial Services AI Risk Management Framework: 230 control objectives, an adoption questionnaire, an evidence guide.

The framework's control objectives are organizational: governance maturity, model oversight, third-party attestation.

FS AI RISK MANAGEMENT FRAMEWORK, U.S. TREASURY · FEB 19, 2026

The sector's own vocabulary, published alongside it, defines an AI agent precisely and states plainly that agents "take actions to achieve their goals." Yet across all 230 objectives, and that same vocabulary, the words "transaction" and "payment" appear zero times.

What that actually means

This isn't an absent rulebook. It's a rulebook that governs the organization, and stops before it reaches the specific thing an agent decided to do.

What institutions currently ask for is evidence of governance maturity (audit reports, attestation letters), not a reconstruction of what happened on one specific payment. Whether that gap represents unserved demand, or a deliberate choice not to govern at that level, is the open question this research is testing.

Sources