Last week the FSB and MAS set out how AI in financial markets should be governed. This week the FCA announced their plans to build a trusted framework for agentic finance around four areas: agent identity, delegated authority, accountability and execution. The HKMA also announced advancing its AI governance framework, and the US Conference of State Bank Supervisors has introduced an AI supervisory framework for state regulators. Until now, agent identity and authorisation was being built by technology firms, fintechs and banks – Know Your Agent (KYA), Authorised Financial Agent (AFA) concepts, protocols for verifiable delegated authority. Regulators are now moving to write the rules around it. On 19th October the FCA’s Jessica Rusu responded to the Mills Review alongside the first good and poor practice on AI. On 22nd October Nikhil Rathi used his Mansion House speech to warn of a dangerous “innovation delta”. Bloomberg reported the Bank of England is weighing an AI-driven market shock for its next system-wide stress test, and the CFTC published the agenda for Wednesday’s Frontier Forum.

The markets are moving ahead. Interactive Brokers launched autonomous AI trading across 75,000+ stocks, options and ETFs, and LTX confirmed around a dozen institutions are using Agentic BondGPT on live corporate bond workflows. Here are the five things I learnt this week on AI in Trading:

1. FCA – introducing good practice & the “innovation delta”

Rusu: no new rules, but clear expectations. In her speech, Rusu confirmed the FCA is embedding six of the Mills Review’s seven recommendations into live work, and was explicit that the shift does not stop at retail: AI is accelerating how wholesale firms analyse, trade, monitor and decide. The FCA’s good practice and areas for improvement covers AI built in-house, supplied by a third party or embedded in another system:

• Accountability – good practice is clear SMF ownership from the design stage, documented escalation thresholds and defined points where humans can challenge or override outputs. Areas for improvement include retrofitting governance after deployment and senior managers delegating AI entirely to technical teams.

• Resilience – pilot lower-risk uses first, map model and provider dependencies (including reliance on a single model), keep tested fallbacks, and challenge vendor assurances rather than accept them – firms remain accountable for outsourced AI.

• Agents – Rusu said greater autonomy “changes the risk”, so assurance must be continuous, and significant AI failures and near-misses should be reported under existing incident rules. Good practice includes registering agents in a central inventory showing who owns them, what they can access and which controls apply.

The FCA will co-develop a trusted framework for agentic finance with industry, other regulators and frontier labs, and is becoming an agentic regulator itself – building a “market first responder” agent to supervise around 9,000 small wholesale transaction-reporting firms.

Rathi: the rulebook can’t keep up. In his Mansion House speech, Rathi warned the UK risks an “innovation delta”, where regulators and accountability lag behind technology. He named 24/7 trading with prices increasingly forming over weekends, parallel market structures and new forms of market abuse – and said supervisors will need to judge when agentic coordination becomes market manipulation. On resilience, he warned that pressing a kill switch may be easier than getting a system running again. The FCA will use its existing powers more assertively, including on harms originating outside the perimeter, end tickbox compliance, and Sarah Pritchard will look at whether it is time to revisit the three lines of defence.

Why this matters for trading:

• Accountability concentrates on the SMF. With the FCA and PRA proposing to remove the Certification Regime (consultation closes 22nd January 2027), the senior manager’s reasonable steps matter more. The FCA’s AI good practice already expects named SMF ownership and documented escalation thresholds for each use case.

• “The vendor said so” is not assurance. Untested vendor assurances are an explicit area for improvement. Broker algos, EMS features and TCA with embedded AI belong in the inventory, with assurance you have tested yourself.

• Start the near-miss log now. The FCA expects incident reporting to extend to significant AI failures and near-misses; log agent errors caught on the desk so the significant ones can be escalated.

• Plan recovery, not just the kill switch. Can the desk get back to trading – by voice if needed – with best execution evidence intact?

• Weekend price formation is on the FCA’s radar. Rathi flagged prices increasingly forming over weekends as a market integrity risk – expect questions on who, or what, is monitoring your exposure outside core hours.

• Agent identity is now on the regulator’s agenda. The trusted framework will be co-developed with industry, and the FIX AI Working Group’s work with GLEIF’s verifiable LEI is a natural input.

2. Interactive Brokers: the order is autonomous, the responsibility is not

IBKR Autonomous Trading lets eligible clients authorise a connected third-party AI – ChatGPT, Claude, Grok or Perplexity via MCP – to find and submit orders without approving each one, with strategies set in plain language. The controls are coarse but real: a cash-only AI Partition, individual non-margin accounts only, funding caps, and at least 10 approved trades in “Review & Approve” mode before autonomy is switched on.

The product is clear; the regulatory position is not. Responsibility now splits three ways:

• The client owns the decision – but it is a plain-language mandate interpreted at runtime by a model the client cannot inspect, and IBKR has said it will not supervise what the AI decides.

• The AI provider sits outside the perimeter. Rusu noted four in five less-experienced investors aged 18-40 have used AI to help with investing, yet only 40% of consumers recognise there is no recourse if something goes wrong after acting on general-purpose AI advice. The FCA’s immediate answer is to clarify the boundary and ask AI providers for clear disclaimers, rather than simply expanding its remit – though a review of the perimeter remains on its agenda.

• The broker carries the controls – market access checks, limits and surveillance sit with IBKR, and FINRA’s 2026 oversight report already expects human oversight, tracking and controls around AI agents.

That leaves questions existing rules were not written for. When an unregulated model makes runtime decisions for a client, does it start to look like discretionary management or advice? If an agent’s orders resemble spoofing, whose intent counts? And nothing yet requires an order to be flagged as agent-originated. With Robinhood targeting millions of agentic traders, up from around 150,000 today, and IBKR’s Milan Galik expecting AI to lift volumes, scale is arriving before the regulatory solutions.

Why this matters for trading:

• The flow you trade against is changing. Rules like “rebalance each morning” will fire together across thousands of accounts – watch opening imbalances and options flow around volatility triggers.

• Flagging agent-originated orders is a natural question for FIX – for venues, surveillance and anyone measuring market impact.

• “We don’t supervise the AI” will not hold for institutions. For any agent your desk deploys, the FCA’s SMF ownership and override thresholds apply in full.

• Borrow the controls, not the liability model. Partition, caps and a graduation period are a sound template for internal agents – paired with your own pre-trade checks and surveillance.

3. LTX puts agents on the credit blotter – but the buy-side is not yet letting GenAI trade

Agentic BondGPT opened to clients in mid-September; around a dozen institutions were using it by mid-October, some launching trades, though LTX has yet to confirm any fully autonomous execution. CEO Jim Kwiatkowski’s example: for any blotter order under $2m, in a bond that has already traded $10m today, where LTX liquidity beats the last TRACE print – execute. Agents connect to the OMS and can alert, populate tickets, select dealers, launch RFQs or auto-execute.

Where IBKR stretches the rules, LTX is designed to fit them. The LLM interprets the trader’s intent, but agents are assembled from pre-approved modules rather than code generated at trade time, which Kwiatkowski says cannot be quality-assured. Data is curated, the conditions behind each result are shown to the trader, and LTX can stop auto-executions one at a time or all at once. That still leaves questions:

• Is the agent an algorithm? One that sets size, price and timing with no human intervention looks like algorithmic trading under MiFID II – bringing testing, limits, kill functionality and the annual self-assessment.

• Who surveils? LTX counts auto-executions but cannot see them, by design. The firm must monitor agent orders for market abuse and identify the agent in its order records and transaction reports.

• Best execution by rule. “Better than the last TRACE print” is testable, but the firm must show the rule delivers best execution across liquidity conditions.

• From execution to investment decision. Clients are asking for portfolio-level agents – any relative-value switch worth five basis points – and Kwiatkowski sees agents negotiating with dealer RFQ algos, raising information leakage and collusion risk.

Contrast that with what we learnt from FILS Europe. A Susquehanna survey found only 10% of traders define an axe as a firm price; desks are swamped with axes, trust few of them, and increasingly judge dealers on hit ratios and how much of a price is firm. Questions are being raised as to whether RFQ in its current form will become obsolete – broker selection is becoming “a data question, not a relationship question”.

Why this matters for trading:

• Classification is now needed – every venue-hosted agent needs to go through the algo inventory and certification gate – Two Sigma for example, now automatically registers agents built on approved frameworks with their owner, purpose and access.

• Ask every vendor LTX’s question. Is the model writing code at trade time, or assembling tested components? The answer decides how much of the necessary validation sits with the desk as opposed to the vendor.

• Own the audit trail. Record the instruction, its interpretation, the data used and the outcome; a venue counting orders is not your best execution or market abuse evidence.

• Data before autonomy. If dealer selection is a data question and axes are untrusted, clean axe, hit-ratio and chat data is what any credit agent will rely on.

• Agree agent-to-dealer standards early. Identity, permitted information and audit for agent negotiation are best agreed as industry best practice standards in FIX before bilateral workarounds take hold.

4. The Bank of England considers stress testing for herding agents

AI-driven market turmoil is one of the themes under discussion for the Bank of England’s next system-wide exploratory scenario, according to Bloomberg. Officials fear trading firms using similar AI agents could all react to a shock the same way and deepen a sell-off. It follows the FSB’s herding warning last week, and Rathi’s point that supervisors must now judge when agentic coordination becomes manipulation.

New research shows why correlated agents are a real risk:

• Fake news beats prompt injection. A false but credible-looking article changed a trading agent’s trade 62% of the time, against 14% for hidden instructions – and with a named source and a “BREAKING” tag it fooled the agent on all 15 stocks tested. Every agent reading the same feed is exposed at once.

• Code checks miss judgement. A paper-trading agent rewrote its own rules nightly for five weeks; automated checks rejected none, but a human later removed 11 of 19.

• Agents and cartels. Reinforcement-learning agents matched forced price cuts but rarely retaliated – a reminder that collusion-like outcomes can emerge without intent, which is exactly the judgement Rathi described.

Why this matters for trading:

• Correlation is the risk, not the single agent. Three vendors on the same model and news feed are one strategy in a stressed situation necessitating a requirement to map the stack, not treat suppliers independently.

• Treat news inputs as an attack surface. Any agent that reads headlines needs source verification and limits on how far a single story can move it.

• Run the internal scenario first. What do signals, broker algos and liquidity forecasts do on a day everyone else’s agents choose to sell?

• Keep a human on rule changes. An agent that edits its own parameters needs the same sign-off as an algo parameter change.

5. The CFTC opens the US “super intelligence” conversation

The CFTC published the agenda for its inaugural Frontier Forum on Wednesday 28th October, covering implementation, impact on US markets, and the Commission’s role in fostering adoption while protecting participants from new risks.

The tone contrasts with the ROW. The FCA and the Bank of England, MAS and ESMA are framing agents through accountability, resilience and herding; the CFTC leads with innovation and opportunity – and has been consulting on listing compute derivatives, treating AI as an asset class as well as a market participant.

Why this matters for trading:

• Watch for US direction on agent access to DCMs and FCMs – it will shape global futures workflows.

• Divergent tones, convergent controls. Build once to the FSB’s twelve practices; identity, limits and kill-switch questions are the same in Washington, London, Singapore and Hong Kong.

This week’s launches show where the pressure points for all regulators are building. Existing algo rules cope well when an LLM only configures a deterministic workflow, as with LTX. They strain when a third-party model makes runtime decisions for retail clients, as with IBKR, where the client owns the decision, the AI provider sits outside the perimeter and the broker carries the controls.

What no rule yet covers is flagging an order as agent-originated, logging an agent’s reasoning, identifying which firm an agent acts for and under what authority, and spotting herding when thousands of users run the same few models. These are practical, standards-shaped problems – exactly where the FIX community can help close the gap before every broker and venue builds its own answer. For Heads of Trading, the list is familiar: named accountability, thresholds for human intervention, a near-miss log, and a switch someone outside the agent can pull – with a plan to recover once they do.

Thanks for reading as always.

Rebecca