Report | 2026
Rebuilding the Three Lines of Defence for the Agentic Bank
A 2030 blueprint for Tier 1 banks on control, assurance and risk oversight when AI agents run the customer journey
By 2030, much of UK banking will be delivered through always-on AI agents — reasoning, acting and adapting in real time. The control frameworks banks built for humans won’t hold. This paper sets out how Tier 1 banks should redesign governance, risk oversight and assurance for a world where every customer journey can take its own path.
Inside the report
Why Three Lines of Defence still works — and how to rebuild it
From periodic review to continuous supervision and machine-enforceable controls.
A proposed agentic
risk taxonomy
A four-tier classification model and eight risk domains including autonomy, conduct, traceability and change governance.
A three-tier approach to
live assurance
How specialist models, context-aware assessment and human oversight combine into a unified command centre.
A structured approval record for agentic use cases
The four things the second line must see before any agentic capability goes live.What risk functions will look like in 2030
Six ways teams adapt — from shaping agentic propositions early to using AI to monitor AI at scale.Six priority programmes for delivery
The linked workstreams that move a bank from ad hoc pilots to one scalable control model.
Free Report
Read the report
Download the
report
- Explore where financial services stands on AI today, and what leaders must prioritise next.