FSB, HKMA, and FCA Tighten AI Accountability Rules for Financial Firms
Three of the world's most influential financial regulators published AI governance guidance within days of each other in October 2026, and the message is consistent: regulated firms that deploy artificial intelligence without robust board-level oversight, documented use cases, and genuine human control are taking on regulatory and operational risk they may not have fully priced in. For crypto-native businesses and the accounting and compliance teams that serve them, these frameworks land at a moment when AI-assisted KYC, transaction monitoring, and on-chain risk tools are becoming standard kit. Crypto accounting software vendors and the firms that rely on them will need to understand what the new expectations mean in practice.
The FSB's Twelve Sound Practices: A Global Baseline
On 15 October 2026, the Financial Stability Board published its report on AI governance for the financial sector, drawing on a public consultation held earlier in the year. The FSB operates under the G20 and the Bank for International Settlements, which gives its output significant weight even where, as here, it is not formally binding.
The report identifies twelve sound practices across two broad categories.
Organisation-wide AI governance
The FSB expects boards and senior management to take direct ownership of AI strategy, not delegate it entirely to technology teams. Firms should establish formal governance structures for AI systems, document each AI use case and conduct a risk assessment for it, and revisit those arrangements as their deployment of AI evolves. Governance that was adequate when a firm ran one narrow fraud-detection model may be inadequate once agentic AI has access to customer data, payment rails, or credit decisions.
AI lifecycle management
The second category addresses a failure mode the FSB observed repeatedly: firms treating AI governance as a one-time exercise completed at the point of deployment. Instead, the FSB wants firms to maintain oversight across the full lifecycle, from initial design through live monitoring to decommissioning. That includes data quality governance, ongoing testing and validation, and mechanisms that keep humans genuinely in the loop rather than nominally responsible. The report singles out agentic AI, systems capable of taking autonomous actions in connected environments, as a particular concern, noting that high levels of autonomy "can create or amplify certain risks, which can materialise at great speed." The specific risks cited include unauthorised or erroneous actions, data breaches, disruptions to connected systems, and the erosion of effective human oversight.
Because the FSB's practices are voluntary, some firms may be tempted to treat this as a watch-and-wait situation. That would be a mistake. When the FSB frames something as a global standard, domestic regulators in G20 jurisdictions tend to follow with binding rules. The HKMA and FCA publications released in the same month illustrate exactly that pattern.
HKMA's ART Framework: Binding Obligations in Hong Kong
The Hong Kong Monetary Authority launched its Accountability, Resilience, and Trust (ART) Framework on the same day the FSB published its report, and the HKMA's version comes with teeth. The framework applies to HKMA-supervised institutions, which covers banks and licensed entities operating in Hong Kong's financial system, including those handling digital assets and stablecoin activities.
Three concrete initiatives
The HKMA is moving on three fronts simultaneously. First, it has issued updated supervisory guidance that spells out specific obligations: boards and senior management must approve and oversee AI strategies; every AI use case must have a named owner; human oversight of each system is mandatory; and testing and validation must occur before and during deployment. These are not aspirational principles, they are compliance requirements.
Second, the HKMA is establishing an AI training data sharing platform to support data quality governance across the sector. Poor training data is one of the root causes of AI hallucinations and biased outputs, and the regulator is positioning itself to help firms address that at an industry level rather than leaving each institution to solve it alone.
Third, the HKMA is running a GenAI Sandbox++ to test agentic AI applications in banking. Findings from that sandbox will feed into a proposed regulatory framework specifically for agentic AI governance. For firms operating in Hong Kong or planning to, this is the clearest signal yet that a dedicated agentic AI rulebook is coming, and that the sandbox observations will shape it.
Firms using AI in their AML, KYC, or transaction-monitoring workflows in Hong Kong should treat the ART guidance as immediately relevant to their next internal audit cycle. The obligation to name an owner for each AI use case in particular has direct implications for how compliance and technology teams structure accountability.
FCA Observations: What Good and Bad Practice Looks Like
On 19 October 2026, the UK's Financial Conduct Authority published its findings on AI practice in financial services, drawn from its AI Lab initiatives including the Supercharged Sandbox. The FCA's approach here is supervisory rather than rule-making, but the practical implications are real: firms whose AI practices resemble the FCA's "bad practice" examples face a higher risk of regulatory scrutiny.
Characteristics of good practice
The FCA identified several markers of firms handling AI responsibly. These included designing and continuously testing controls to address risks like bias and inaccuracy; restricting AI systems to approved, high-quality source material to reduce hallucination risk; embedding risk-based approval processes before deployment; and giving staff meaningful training to support genuine human oversight rather than superficial sign-off.
Characteristics of poor practice
The poor-practice findings are equally instructive because they describe failure modes that compliance teams can check against right now. The FCA observed weak or reactive governance arrangements that were defined after problems arose rather than before. It also found over-reliance on staff to catch AI errors without those staff having the tools, training, or time to do so, combined with inadequate model testing. A lack of clarity about which individual was responsible for which AI system appeared repeatedly.
For UK-regulated firms in the crypto and digital asset space, the FCA's observations function as an unofficial inspection checklist. A firm that cannot clearly name who owns each AI system, who approved it, and what testing was conducted before go-live is already behind the curve.
OCC Stablecoin Rules: A Connected Development
Alongside the AI governance publications, the US Office of the Comptroller of the Currency released a 721-page proposed rule implementing the GENIUS Act's stablecoin regime, which is currently targeted to take effect from 18 January 2027. The rule sets out obligations for permitted payment stablecoin issuers (PPSIs), covering national banks, federal savings associations, foreign payment stablecoin issuers, certain state-qualified issuers, and nonbank entities seeking approval to issue payment stablecoins.
The yield question remains unresolved
One issue the OCC's proposed rule has not settled is whether market intermediaries such as crypto exchanges may pay interest to customers on stablecoins they hold. The GENIUS Act bars issuers from paying yield to holders, but is silent on intermediaries. The banking industry has argued that Congress should close this gap to protect community banks and lending activity, while the crypto industry contends that consumers should have access to yield. This debate remains live and will likely influence the final rule.
The stablecoin angle connects directly to the AI governance thread: stablecoin issuers and the exchanges distributing them are precisely the firms that use AI-driven KYC, sanctions screening, and transaction monitoring at scale. A firm preparing for GENIUS Act compliance while also deploying agentic AI in its compliance stack needs to satisfy both sets of requirements simultaneously, and the governance obligations from the FSB, HKMA, and FCA will inform how US regulators eventually approach the same territory.
Practical Implications for Accounting and Compliance Teams
The convergence of AI governance expectations across the FSB, HKMA, and FCA creates a clear set of near-term actions for finance and compliance professionals, particularly those working in or advising firms that use AI in their digital asset operations.
For accounting firms and CFOs (B2B)
Boards need a formal AI governance policy and a record of having approved it. That document should map every AI system in use, name an owner, describe the risk assessment conducted, and set out the testing and validation process. Firms using crypto accounting software or digital asset accounting software with AI-assisted categorisation, reconciliation, or reporting features should confirm whether those features fall within scope and document accordingly. Audit committees will increasingly ask about AI risk as part of their technology risk review, and having a governance register in place now reduces the likelihood of a reactive scramble later.
The AML and KYC dimension is particularly acute. AI-driven transaction monitoring is now standard in digital asset compliance, and both the FSB and HKMA explicitly call out KYC workflows as a use case requiring robust governance. A firm that relies on an AI screening tool without documented validation, named ownership, or a human escalation path is carrying compliance risk that may not yet be visible on its risk register.
For individual filers and retail-adjacent businesses (B2C)
If you use a platform or service that applies AI to classify your crypto transactions, flag suspicious activity, or prepare tax reports, you now have a reasonable basis to ask the provider what governance sits behind that AI. The FCA's findings suggest that some firms in the market are not adequately testing the models they deploy. Errors in AI-generated transaction categorisation can flow directly into incorrect tax filings, and the liability for a mis-filed return stays with the taxpayer, not the software vendor. Knowing your tool's governance posture is no longer a niche concern.
Firms operating in the EU should also note that these developments sit alongside existing MiCAR obligations and the forthcoming AMLA AML/CFT guidance. For context on how those frameworks interact with operational compliance requirements, see our coverage of the end of the MiCAR transitional period and AMLA's AML/CFT guidance for CASPs. On the stablecoin side, the OCC's proposed GENIUS Act rule connects to a broader global pattern examined in our piece on stablecoin regulatory scrutiny and lobbying dynamics.
Frequently Asked Questions
Are the FSB's twelve AI sound practices legally binding?
No. The FSB publishes guidance and recommendations rather than enforceable rules. However, FSB outputs carry significant weight with domestic regulators in G20 jurisdictions, and many of its recommendations are eventually incorporated into binding national or regional rules. Treating them as aspirational rather than directional would be a strategic error.
Which firms are directly subject to the HKMA's ART Framework?
The ART Framework applies to institutions supervised by the Hong Kong Monetary Authority. That covers banks and licensed financial institutions operating in Hong Kong, including those involved in digital asset activities under the HKMA's oversight. If your firm holds an HKMA authorisation or licence, you should treat the updated supervisory guidance as a compliance obligation rather than voluntary guidance.
What does the FCA's AI review mean for UK crypto firms?
The FCA published its findings as supervisory observations rather than new rules, but they effectively signal what the FCA considers adequate and inadequate practice. UK-registered crypto asset businesses that use AI in customer-facing or compliance functions should compare their internal arrangements against the FCA's good-practice markers: named system ownership, pre-deployment testing, data quality controls, and genuine staff training for human oversight.
How does AI governance connect to crypto accounting software compliance?
Many crypto bookkeeping and digital asset accounting software tools now incorporate AI for transaction classification, reconciliation, or anomaly detection. Under the emerging frameworks from the FSB, HKMA, and FCA, regulated firms using such tools need to understand the AI components, document them as use cases, assess the associated risks, and ensure human review of outputs. Firms cannot outsource accountability for AI-generated outputs to a vendor.
What should firms do right now ahead of the GENIUS Act stablecoin deadline?
Firms in scope for the OCC's proposed rule implementing the GENIUS Act, which targets a January 2027 effective date, should begin reviewing the 721-page draft now. The key near-term steps are identifying whether the firm qualifies as a permitted payment stablecoin issuer or a covered intermediary, mapping existing AI-driven compliance tools against the new governance expectations, and monitoring the unresolved yield-on-stablecoins debate, since the final rule on that point could affect both product design and accounting treatment.
Source: Elliptic