If a week is a long time in politics – it is becoming a lifetime in writing about AI in Trading. Every day this week there has been yet another flurry of LinkedIn posts on the need to govern AI, particularly agents.  But while the governance architecture is beginning to form, the problem is now fragmentation. IOSCO is writing guidelines for regulators, the industry is writing for model builders, and Five Eyes is writing for security teams – while Robinhood is reportedly planning to ship agentic retail through MCP without the controls attached. Everyone wants to move from policy to evidence, but along separate tracks. If execution becomes the output of evolving agent workflows across a global, counterparty-agnostic ecosystem, coordinated governance is going to need to travel with the output – a shared execution-layer carrier linking Intent → Constraint → Decision → Execution into one verifiable chain, before agents create exactly the sort of chaos some are predicting. Here’s what I learnt this week on AI in Trading:

1.      IOSCO Publishes What It Expects

Probably the most important piece of news this week came from IOSCO, which published its Supervisory Toolkit for AI Use in Capital Markets (FR/02/2026), based on a survey of 21 member authorities and structured across three layers, with four areas of supervisory focus: governance and risk management, third-party and outsourcing risk management, disclosure, and recordkeeping and reporting. IOSCO has opened a short feedback survey on the toolkit, running until 26 June, ahead of its next phase reviewing emerging industry practice on disclosure, recordkeeping and governance.

The Cambridge Centre for Alternative Finance’s parallel research – highlighted in this newsletter and covering 628 institutions across 151 jurisdictions – shows why this matters: 81% of the industry is adopting AI at some level, 52% are already piloting or deploying agentic systems, while 48% of the 130 regulators surveyed are still in an exploratory stage or not using AI at all. On agentic AI specifically, the CCAF data puts the industry-versus-supervisor gap at 52% to 28% – a 24-percentage-point oversight gap.

The other gap is the presumption that this only affects high-frequency trading firms. Buried on page 64 is the statement: “One member reported that AI is commonly applied in algorithmic high-frequency trading (HFT), primarily for trading signal generation (including deep learning, reinforcement learning and GenAI), and that AI is not commonly used directly in trade order routing, execution, or cancellation.”

Why this matters for AI in Trading: The Toolkit’s recordkeeping requirement is the one with teeth for agentic systems. In plain terms: regulators – IOSCO, alongside the EU AI Act and DORA – expect a firm to be able to show why an AI made a given decision: what data it used, which model, and what changed. Agentic AI makes this far harder, through emergent behaviours, cascading failures and goal-misalignment risk. This is what firms must be able to produce when regulators ask. But supervisors are operating at roughly half the rate of the institutions they oversee, and the data shows the gap is widening fastest precisely in agentic deployment. The recordkeeping pillar assumes a traceable decision path exists. For multi-agent systems where the most reliable read on the market is often produced before the agents start influencing one another that trace has to be built in from the start. A firm cannot bolt IOSCO’s recordkeeping requirement onto an architecture that only logs final outputs.

2.     Agentic Retail Moves Yet Another Step Closer

Robinhood announced that customers will soon be able to direct AI agents to trade equities and make purchases via an agentic credit card – through accounts deliberately walled off from the standard portfolio, so the funds an agent can touch are capped at what is deposited. Connection runs through the Robinhood Trading MCP (Model Context Protocol, the standard way an external AI agent plugs into a brokerage), launching in beta for equities, with options, crypto, event contracts and futures planned. As Matt Levine of Bloomberg commented: what investors actually want is a general-purpose technology to describe any trade in a few sentences and execute it with a click. His second point will matter for market structure – the convergence of agentic AI and free retail trading. An agent constantly rebalancing or buying oversold names and selling them as they recover, has no appeal at $10 a trade; at zero, the investment thesis could become thematic and high-turnover.

Why this matters for AI in Trading: If agents are deployed into retail via MCP, execution becomes the output of evolving agent-driven workflows interacting with each other – rather than the result of a single order – across a global, counterparty-agnostic, 24/5 ecosystem. An agentic permission chain wired to a brokerage and a credit card to fund deposits, at consumer scale and across any asset class Robinhood plans to add: what could possibly go wrong?

Secondly, if retail agents all automate the same stereotypical behaviours, you get herding and predictability rather than noise. We debated exactly this at the first FIX AI roundtable in June 2024; it looks like it will now start to play out.

3.      Accuracy Is Not Compliance: New Research Splits the Two Axes

A new paper from the Santander AI Lab, posted by José Manuel de la Chica this week, identifies a failure mode it calls governance-task decoupling: under structural stress, text-only governance degrades on both dimensions simultaneously, whereas mechanical enforcement preserves governance quality even as task performance drops. Moving certain controls outside the model’s interpretive loop –  so it cannot reinterpret or override them – changes this. (Read the paper.)

In the paper, 27% of deferrals under text-only governance carried zero decision-relevant information; mechanical enforcement reduced that by 73%, and task accuracy rose sharply on a standard accuracy measure, from 0.43 to 0.88. The point: accuracy is not a sufficient proxy for governance. They are distinct axes and must be evaluated separately.

This sits alongside previous JPMorgan AI Research’s framework on why agentic AI in finance is hard – where none of the five reasons given is the model itself: operational complexity; risk asymmetry (a 99%-accurate KYC check is still a regulatory failure); strict regulatory enforcement; implicit domain knowledge acquired through experience rather than training data; and a dynamic environment where a policy that is correct in March is wrong by October.

Why this matters for AI in Trading: Last week’s newsletter made the point that validating an output cannot fix what went wrong in the conversation that produced it. The Santander finding sharpens it: if governance lives only in text instructions the model can reinterpret, it collapses under the same stress that degrades accuracy – so the control has to sit outside the interpretive loop. This is precisely the proposal based on a Deterministic Control Envelope idea we have been discussing in FIX AI Working Group conversations: putting hard limits outside the model and certifying those limits mechanically rather than trusting the agent to police itself.

4.      Buy-Side Architectures Are Becoming Visible – but Only Up to a Point

Four buy-side firms have now published enough about their AI agent architectures that the workflow patterns are becoming readable. D.E. Shaw’s LLM Gateway logs every call, strips out personal data, and caps spending per desk, with DocLab adding audit hashes to retrievals so quants can build tools in around ten lines of code. Man Group’s AlphaGPT chains three agents – Hypothesis Generator, Python Implementer, Statistical Evaluator – with a human veto at every step; hallucination “remains a big issue,” but the model ships anyway, because the architecture is designed to absorb the failure rather than eliminate it. Balyasny runs a federated model where a central team owns the guardrails and each desk deploys scoped tools – one example being a Central Bank Speech Analyst that cut a two-day workflow to thirty minutes. Two Sigma says large language models are widening the top of the research funnel, moving the bottleneck from generating ideas to evaluating them faster.

The themes are consistent: containment, audit trail, sequential veto and guardrails. What none of them publish is the secret sauce – that stays inside the firm.

Why this matters for AI in Trading: Convergence is emerging, but only partially. The industry is starting to agree on the shape of agent governance – build an envelope rather than police each individual action; own the guardrails centrally and deploy tools locally. The open question is whether firms that have independently arrived at the same architecture can agree on a common way to signal a governance state to a counterparty without disclosing the rationale behind it. That will be a standards problem, not a technology one.

5.      If the Architecture Now Exists – the Next Question Is Who Carries It

Back at the start of May, six national cybersecurity agencies – CISA, the NSA, Australia’s ASD ACSC, the Canadian Centre for Cyber Security, New Zealand’s NCSC and the UK’s NCSC – jointly published Careful Adoption of Agentic AI Services, the first coordinated multinational security guidance specifically addressing agentic AI. It called for cryptographically anchored identity for each agent, short-lived credentials, and human oversight for high-impact actions, and named five risk classes: privilege escalation, design and configuration flaws, behavioural misalignment, structural cascading failures, and accountability opacity.

Then, on 28 May, OpenAI released its Frontier Governance Framework – a public document mapping its safety and security practices to emerging legal requirements, specifically California’s Transparency in Frontier AI Act (SB 53) and the EU AI Act’s Code of Practice for General-Purpose AI – covering risk areas from cyber-offence and CBRN through to harmful manipulation and loss of control. The work is visibly moving from policy to operating evidence: can a firm show how frontier capabilities are assessed before release, show who can stop or slow a deployment, show its incident-response path when model behaviour creates material risk, and show the security controls around the systems, data and people involved? Boards will not be able to fall back on “we have an AI policy,” given the change in regulatory direction signalled by ESMA, FCA, MAS and others.

Why this matters for AI in Trading: Every theme this week points to the same thread – the move from stated policy to demonstrable evidence, and to a structural gate between a proposed action and a real-world consequence. The question is no longer “was this approved and logged?” but “may this action produce a governed effect now, under present verified conditions?” That is a shift from supervising models to governing them at runtime, and from after-the-fact audit to pre-effect authorisation: an action is permitted not because the model looked reliable, nor because access was granted earlier, nor because a log can be reviewed later, but because at the moment before effect the required conditions still hold.

What is still missing is an agreed global standard – and a way to carry the governance information through the trade itself, so a counterparty can check, at the moment of execution, that an action has a valid mandate, sits within active limits, and reflects current conditions. Today’s FIX messaging fields identify the firm and the algorithm, but there is no field yet that ties an agent’s action to a verified human who authorised it. One proposal under discussion: give each agent a verifiable identity – a virtual Legal Entity Identifier (vLEI), an idea ISO TC68 is currently exploring – and run a “Know Your Agent” check with a traffic-light signal. Red halts and contains; amber forces a human to step in; only when everything matches, green, is it a “go.” Based on the research on Scalable Runtime Governance for Agentic AI in Financial Services by Lukasz Szpruch, Agus Sudjianto, Tanveer Bhatti and Gary Ang (https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6567199) a high-level version might look like this:

As “agentic governance” fast becomes the silver bullet meant to solve all AI risk in markets, the reality is that there is a world of difference between a proposal that reads well on a slide and the hard graft of making it work in a live trading environment, against regulation and at execution speed. Take the credential chain: a verifiable Legal Entity Identifier proving the regulated firm, a Know Your Agent credential proving the human who authorised the agent, and a Deterministic Control Envelope defining what the agent may do – Legal Entity → Authorising Human → Agent → Execution. On a diagram it is clean and additive. In practice there are real questions to debate as to how those amber edge cases can impact – interested to know your thoughts. As always, feedback and comments very welcome.

Have a good week.

Rebecca

Rebecca Healey | AI in Trading 2026