FIS's rollout of AI banking agents into operational workflows confirms what we already knew: the big vendors are shipping AI into production faster than the regulated firms using it can manage the risk. The headline number is telling—84% of senior compliance leaders are concerned about AI-enabled financial crime. That is not concern about whether AI works. It is terror about whether AI working in their systems will help criminals work better. For UK regulated firms under FCA Consumer Duty PS22/9 and PRA SS1/23, this is a live problem. An AI agent making compliance decisions or handling customer transactions operates inside the perimeter of your firm's accountability. The FCA does not care that FIS built it. Your firm owns the risk.

What this story reveals is the gap between vendor pace and regulatory readiness. FIS is in a strong position—scale, legacy relationships, compliance pedigree—yet even FIS is deploying while compliance leaders are still arguing about whether their institutions can trust AI not to make things worse. The pattern is familiar: experimentation phase ends, pressure to operationalize begins, governance lags behind. This is how financial crime gets smarter. Tools like Microsoft Copilot and Harvey have shown how AI can accelerate work across law and services firms, but they have also shown the cost of governance failure—leaked client data, hallucinated clauses, regulatory questions about data residency and audit trails. The compliance leaders' concern is not paranoia. It is pattern recognition.

Here is what we believe about this: deploying AI agents into regulated financial workflows without first establishing what we call 'governance-first architecture' is not brave, it is reckless. The difference between FIS's approach and what we advise is the sequence. FIS deploys the agent, then asks compliance teams to manage the risk. Trovix works the other way—build the governance layer first, then plug agents into it. This means knowing in advance: who sees what outputs, how decisions are audited, where the human override sits, what the system logs for regulatory proof, how you meet ISO 42001 requirements, what your response is when the EU AI Act enforcement mechanism lands. Trovix Audit sits between your AI systems and your compliance framework. It is not a box you tick. It is a living record of how your AI makes decisions and whether those decisions stay within regulatory bounds. Harvey and Legora do brilliant work on the AI side; Trovix does the governance side that neither of them can solve for you because it is firm-specific and regulation-specific.

For a mid-market financial services firm, insurance firm, or accountancy practice thinking about AI agents right now: do not follow FIS's timeline. Follow the regulatory timeline. That means three things starting now. First, audit where AI is already being used in your workflows—most firms have more than they think, often in shadows. Use Trovix Watch to track regulatory change as the FCA consults on AI governance frameworks (they will, the Lloyd's Blueprint Two and ICO GDPR guidance make that clear). Second, do not buy an AI agent that does not have a clear audit trail and decision log built in. If the vendor cannot tell you how the system reached a conclusion, it should not be reaching conclusions in your name. Third, have a governance conversation with compliance and risk leadership before IT has the procurement conversation. The firms that survive the next regulatory cycle will be the ones that decided what AI could safely do before they bought the tool, not after.

Source: Forbes