Risk 2030: Rebuilding the Three Lines of Defence for the Agentic Bank

Report Overview

By 2030, much of UK banking will be delivered through always-on AI agents that reason, act and adapt in real time. The control frameworks banks built for humans won’t hold. This paper sets out how Tier 1 banks should redesign governance, risk oversight and assurance for a world where every customer journey can take its own path.

Inside the report

• Why the Three Lines of Defence still works, and how to rebuild it around continuous supervision and machine-enforceable controls
• A proposed agentic risk taxonomy, with a four-tier classification model and eight risk domains
• A three-tier approach to live assurance, and the four things the second line must see before any agentic capability goes live
• What risk functions will look like in 2030, plus six priority programmes for delivery