AI dominated the IMF and World Bank meetings in Bangkok this week. HSBC’s Michael Roberts told Bloomberg he expects agents to be trading bonds within a few years; Andrew Bailey, Governor of the Bank of England and Chair of the FSB, told the G30 that regulators “have got to address” who is liable when agents act; and the G7 agreed to simulate AI-driven cyberattacks on the financial system.

On 15th October the FSB finalised its 12 sound practices for AI, with a survey of use cases that mirror trading workflows. Within three days Europe cited its first harmonised AI Act standard, ISO published its AI security guidance and IEEE a recommended practice on AI governance. JPMorgan researchers showed what it takes to turn trading chat into trade data, Deutsche Bank put its AI platform inside its own walls, and J.P. Morgan Asset Management set out where AI adds value in the investment office. Meanwhile banks closed their doors to outside agents, CERT-In disclosed agents reaching live systems undetected, and 400+ scientists called for cyber-capable models to be contained by default. Here are the five things I learnt this week on AI in Trading:

1. The FSB maps how AI is used in trading – and how to govern it

The FSB’s final report lists AI uses across investment and trading – portfolio reporting, sentiment analysis, liquidity forecasting, volatility modelling, credit risk, pattern detection and signal extraction from alternative data – with gains in algo design, data processing and discovery of new opportunities. Three examples stand out:

• Agents that sequence trading tasks – scanning news, generating signals and preparing execution instructions, with less manual intervention. There is little evidence yet of fully autonomous trading.

• Research assistants for traders – e.g. an agent comparing hedging strategies across several market data sources in real time, with tools to visualise outcomes and run statistics. Early results show significant time savings.

• Opportunity identification – AI tools widening the opportunity set for research and portfolio construction.

The structure follows June’s consultation (4 governance practices, 8 lifecycle practices), but the agentic content has grown: seven agentic risks, including unauthorised actions and sub-agent orchestration, and an admission that agent practice “remains nascent”. The controls will be familiar from algo governance – unique agent IDs and certification within defined boundaries (SP3), traceability of permissions across every step, monitoring independent of the model, human approval triggers before higher-risk transactions or strategy changes (SP10), and third-party risk (SP12): concentration, silent model changes and unclear liability. It also flags herding when firms share models and data – Goldman’s prime desk noted fundamental, systematic and multi-strategy funds have fallen sharply on the same day three times this year, against never between COVID and end-2025.

Most AI risks already have homes in model, operational, cyber, data, compliance and third-party risk; the job, as Deloitte’s Andrew Mackay put it, is to strengthen existing systems. Because agent risk spans model, data, tools, permissions and orchestration, the FSB wants the whole workflow tested: validate components once, then the composition – modular validation plus end-to-end assurance.

The standards bodies moved from what to how:

• EN 18286 (14th Oct) – the AI Act’s first harmonised standard, giving high-risk AI providers a presumption of conformity with Article 17 QMS rules; bias (EN 18283) and environmental (EN 18287) standards are in public enquiry.

• ISO/IEC 27090 (14th Oct) – AI security threats (poisoning, evasion, prompt injection, model theft) mapped to CIA, an AI bill of materials, and a clear split: providers secure the model, deployers secure the integration.

• IEEE 2863 (16th Oct) – turning responsible AI principles into board-level governance processes.

The growing risk is duplicate policies and committees, and no single authority to intervene when a risk crosses all three – or sits with a vendor. An integrated control map beats three parallel frameworks. In the UK, the FCA told MPs it is not writing AI-specific rules while using agentic AI in its own supervision (FT); however its Mills Review response is due tomorrow – one to watch. The CFTC’s Frontier Forum on agentic finance follows on 28th October.

Why this matters for trading:

• Sentiment, liquidity, volatility and signal models already sit inside OMS, EMS and broker tools – these now need to be mapped – vendor-embedded ones included.

• Agents that draft execution instructions save manual steps; the control is who, or what pre-trade check outside the agent, turns an instruction into an order. Record the data used, the recommendation and the trader’s decision – that is best execution evidence.

• Best execution, algo governance, model risk and vendor due diligence cover most of it; one framework built to the FSB’s twelve practices suits a global desk. Agents with OMS/EMS reach go through the algo gate: defined boundaries, named owner, expiry date.

• A right order can still come from wrong data or exceeded permissions. Decide which actions need a human – a child order, a parameter change, a participation breach – and evidence that the trigger fired.

• Name who can stop it, including on a vendor’s platform. Deployers own API keys, data access and monitoring; model-change notification belongs in contracts.

• Agent identity is fast becoming an expectation – exactly what the FIX AI Working Group is building with GLEIF’s verifiable LEI.

2. How AI is entering the investment process

HSBC’s Michael Roberts told Bloomberg’s Lisa Abramowicz: “you can see agents trading bonds using quantum computing. That’s the future,” with the next two to four years changing “the pace, speed and scope of what we are trading” – humans staying in the loop. After the interview he pointed to AI lifting coder productivity 50% and quantum improving bond price prediction – HSBC’s IBM trial reported a 34% improvement in predicting whether a bond trades at a quoted price, against the single-digit gains HSBC usually targets.

At BattleFin London, NBIM’s Mark Thompson, Reflexivity’s Giuseppe Sette and Man Group’s Jahmal Nicholson described a research stack where agents connect internal research, alternative data, market data and external intelligence to surface signals and challenge theses – with human judgement still central.

On earnings calls, JPMorgan’s Jeremy Barnum described a model-agnostic bank running proprietary and open-weight models, with benefits not yet visible in earnings. Goldman’s David Solomon set four conditions – “rigorous testing, independent review and continuous monitoring and clear human accountability”. Morgan Stanley’s Ted Pick called AI “existentially important”, with Sharon Yeshaya citing AI tools for equities sales. Deutsche Bank’s on-premise Farsight platform keeps documents inside the bank and bends to each team’s standards, and J.P. Morgan AM’s “AI in the Investment Office” sets out where AI adds value and its limits.

Why this matters for trading:

• The opportunity is in preparation, not the decision – signals, pre-trade analysis, hedging research and draft instructions, freeing traders for judgement and liquidity, as DMA did.

• Plan for dealer agents now. Two to four years means agreeing identification, limits, audit trails and escalation with dealers today.

• Fill probability compounds. Better trade-at-price estimates drive RFQ selection and sizing – ask dealers what sits behind quotes and test it in hit rates and TCA.

• Controls travel with shared agents. If one agent spans research and execution, information barriers, MNPI and licensing go with it.

• Use Solomon’s four tests for every desk tool, and set baselines now – tickets per trader, time to trade, slippage – to prove value. Model-agnostic and on-premise choices also reduce concentration and simplify data control.

3. From chat to blotter: the data work behind execution

JPMorgan’s FinDialogLens reads trading chatrooms to find missed trades: 92.1% accuracy on price and 94.3% on outcome with GPT-4o, small 3B models close behind, and a router cutting LLM calls 85%. Sense Street’s Haroon Hassan countered that specialised prompts(61% zero-shot vs 92% fine-tuned), the schema lacks ISIN, size and direction, prices quoted before the request are missed, and end-to-end accuracy is nearer 82% – below the 95% production needs. The fix: curated data built around the hard cases.

At the Fixed Income Leaders Summit, traders told The TRADE “it’s not an information overload, but an information consumption problem” – implementation is the challenge as desks “do more and more with fewer traders”. One asked whether to buy an EMS, hire, or “start spending your budget on tokens”. A “Kill the blotter” post told of a 200-column Excel blotter that was the desk’s workaround for systems that didn’t fit.

Why this matters for trading:

• Chat is the next data frontier. Fixed income price discovery is still in the voice chats but joined to RFQ records by ISIN, size and direction, it could transform TCA and liquidity estimates.

• Fit for research does not equate to fit for production – set accuracy thresholds before deployment, measured on the hardest cases.

• Specialised models can win – cheaper, in-house and less dependent on a few providers.

• Watch traders work; a 200-column blotter maps where OMS and EMS fall short – that’s what needs automating.

4. Bailey says economic agents are not legal agents: who is liable when the agent acts?

At the G30, Bailey warned “you can create what I call economic agents but you can’t create legal agents”, so “people could get misled” about liability. He called AI “a major issue” for stability and favoured model testing over new regulation. The Bank of Korea’s Shin Hyun-song called AI “a very, very clever black box” but said capital, leverage and collateral rules still apply; the IMF’s Georgieva warned that without guardrails now “we may wake up with something that is not guardrail-able any more”.

Banks are drawing lines. Dimon said JPMorgan won’t let outside agents in, warning of “thousands” of rogue agents; Citi restricted agent access, with every agent going through its Arc platform, and Jane Fraser warned AI also arms bad actors. CERT-In showed why: agents under test reached live Indian systems via exposed credentials and over-permissioned cloud roles – and no one noticed. 400+ scientists, including Yoshua Bengio, urged air-gapping cyber-capable models, an international body for containment standards, and mandatory incident reporting. The UK will explore AI “loss of control” protections, near-miss reporting and agent incident response, with AI Minister Kanishka Narayan arguing in the FT for Industrial Revolution-style safety laws. Responses stressed developers cannot mark their own homework and, as Amber Rudd put it in a CNI discussion, resilience cannot be retrofitted.

Why this matters for trading:

• The agent can’t be liable, but a human has to be. Under SM&CR, document the chain from authoriser to orders, and set vendor liability in contracts.

• Prepare for the tabletop. Can the desk switch off agents, revert to voice and keep best execution evidence?

• Credentials are the attack surface. Scan for and rotate FIX credentials, API keys and EMS tokens in code; give each agent a short-lived, least-privilege identity and tamper-resistant logs.

• Contain, then widen – sandbox first, as with a new algo – and test whether surveillance would spot an agent using a trader’s entitlements.

5. Agents trading for clients: creating the new rules of engagement

Schwab’s Rick Wurster said agents should only trade on a customer’s “rules of the road”, calling a full hand-over to automated agents “risky”. Robinhood had 150,000+ agentic accounts by late September, per Fortune, where Nansen’s Alex Svanevik predicted agent trading will be the norm by 2028.

Why this matters for trading:

• Rules of the road are a mandate – the same structure as a broker algo, with limits enforced outside the agent.

• Retail agent flow will cluster around news in short windows; that needs to be factored into any scheduling – particularly with the move to 23/6.

• The frameworks exist – RTS 6, the Market Access Rule and best execution are the starting point.

AI is rebuilding the research stack, preparing signals and execution instructions, reading the chat where bond prices form – and may be trading bonds within a few years. The FSB has set out how to govern it, and Bailey framed the key question: an agent can act economically but not be legally responsible. Most controls already have a home: an inventory, a certification gate, an independent monitor, a named owner and a way to stop an agent mid-task. The opportunity lies in the data underneath; the discipline in keeping humans accountable for what reaches the market. From DMA to algos to agents, it is the same path – and the firms that treat it that way will move fastest.

Thanks for reading as always.

Rebecca