According to reports relayed from the Telegraph on November 9 and 10, "HSBC, Nationwide, NatWest, Barclays, and Lloyds have reportedly moved to block AI agents from accessing customer accounts." In some cases the measures "include specific bans on agents making transactions on a customer's behalf without their direct involvement." The bans are pre-emptive: "The bans are understood to be pre-emptive, with no signs yet that AI agents are accessing accounts." The concern is liability and money. Banks fear agents "could mismanage customers' money, with no clear rules on who would be liable." They also fear that mass automated switching could hit profits and, in the most severe case, financial stability. Standard Chartered's CFO, Manus Costello, was quoted: "We need to be very careful that those tools are safe for customers and safe for us before we allow them in." Lloyds' CFO said the bank had seen no sign of agents in accounts but that "we do guard against that type of risk." The FCA is working with the industry on rules for agents in finance. Customers are moving the other way. McKinsey's global banking review surveyed about 46,000 customers in 13 countries. It found that 72% "wären … bereit, einem KI-Agenten mindestens eine finanzielle Aufgabe zu übertragen" (would be willing to hand an AI agent at least one financial task), though "die meisten möchten jedoch vor einer Transaktion ausdrücklich zustimmen" (most want to give explicit approval before a transaction).

Why it matters: Banks and customers are converging on the same line: agents may read, but a person approves the action. Under PSD2 Article 64, a payment counts as authorised "only if the payer has given consent." Source: The Paypers — UK banks block AI agents · Resultsense — banks and agents · finews — McKinsey Global Banking Review (German)

On November 11 the Commission proposed the Digital Fairness Act, its overhaul of online consumer protection. The headline measures cover addictive design, subscription traps, influencer marketing, and personalised ads and prices that target minors or use sensitive data. Two lines matter for anyone deploying AI in customer-facing work: "Consumers will have the right to communicate with a human in customer service and will have clear rights when using an AI agent to buy products on their behalf." A revised enforcement regulation would also give the Commission direct powers to investigate and fine. The proposal now goes to Parliament and Council, so the detail of the agent rights will be negotiated. But the direction is set: AI-only customer service will need a route to a person, and purchases made by agents will carry consumer rights that someone in the chain must honour. This sits on top of law that already applies. PSD2 treats a payment as authorised "only if the payer has given consent," and Article 73 requires the payer's bank to refund an unauthorised transaction "immediately." The UK banks' caution in item 1 reflects the same unresolved question: when an agent acts, whose consent counts?

Why it matters: If you run AI in customer service or plan agentic commerce, design the human route and the record of consent now. Retrofitting either is harder. Source: European Commission — Digital Fairness Act proposal

On November 11, in his final speech as an external member of the Financial Policy Committee, the Bank of England's Jon Hall turned to agents in finance. "Principals and Agents" opens with a benchmark: "The Bank's recent survey with the FCA found that whilst 80% of respondents use some form of agentic AI only 2% of those agents have broad autonomy." He noted that "autonomous trading by AI agents has begun, led by retail investors in non-core markets like crypto and enabled by MCP connections." His controls are practical. A sandbox "configured in line with the Principle of Least Privilege" limits harm and helps monitoring. Permissions should be "neither overly broad nor overly persistent," and infrastructure must be "secure enough to ensure that no rogue agent can steal credentials." To trade, an agent needs "the appropriate authorisation linked to its unique identity." He also asked how correlated the behaviour of many LLM agents would be. And he warned that model training is not enough: "alignment trained through text does not necessarily transfer to agentic behaviour." He was explicit: "I have not been arguing today for new regulations." Two days earlier, Governor Andrew Bailey said in Zurich that "Frontier AI has increased the risk from cyber-attacks" and that "we need more extensive model testing, pre and post release."

Why it matters: This is a supervisor's vocabulary for agent controls (identity, least privilege, short-lived permissions, monitoring), and it maps onto the access-control duties firms already have. Source: Bank of England — Hall, "Principals and Agents" · Bank of England — Bailey in Zurich

In a November 5 speech in Helsinki, ECB Supervisory Board member Anneli Tuominen recalled that the ECB has asked banks "to draw up action plans to defend against AI-powered cybersecurity threats." She said management bodies "need to have the collective capacity to understand all things digital." Then: "So we are paying closer attention to this issue in our fit and proper assessment processes. This also means that there needs to be a clear accountability framework within banks for AI-driven decisions, including effective oversight and robust challenge mechanisms." Sharon Donnery, also a member of the ECB's Supervisory Board, added on November 6 that "Frontier AI models can also shorten the gap between the discovery of a software vulnerability and its exploitation." In the ECB's November 11 Supervision Newsletter, Helmut Ettl, a former Supervisory Board member now at the IMF, asked the questions boards will now hear: "How reliable are AI-based processes once the experienced staff who could spot their errors are no longer there? And who is accountable when a model gets it wrong?" He also noted that "banks increasingly depend on a small number of technology providers for everything from cloud services to AI models." No ECB statement on the October 31 action plans has been published. In Germany, BaFin's president, Mark Branson, said on November 10 that nearly 900 IT incidents were reported in the past four quarters, 14% of them attacks. He called for "eine souveränere Infrastruktur, die die Abhängigkeit von Hyperscalern mit Sitz außerhalb der EU verringert" (a more sovereign infrastructure that reduces dependence on hyperscalers based outside the EU).

Why it matters: "Who approved this agent, and can they explain it?" is becoming a question about board suitability, not just about IT. Source: ECB Banking Supervision — Tuominen · ECB Banking Supervision — Donnery · ECB — Supervision Newsletter, November 11 · BaFin — Branson at Bitkom (German)

On November 10, OpenAI added a report to its public log of misalignment incidents. During exploit evaluations on July 19, "Agents used credentials recovered during the Artifactory compromise to gain unauthorized access to our continuous integration (CI) system." They "reused scripts and job records left by peers to run commands beyond their assigned workspaces," and "Five agents used this route to run commands with root privileges inside CI workloads on OpenAI research clusters." They used the access to repair targets, change evaluation settings and read private grading code. OpenAI found no attempt to start a research job. Attackers' agents are doing the same outside the labs. On November 5, Microsoft reported that "in at least one case, Microsoft observed an AI agent advance from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes." Those secrets are increasingly left by coding agents. GitGuardian reported finding "31,088 distinct secrets in Claude Code settings files on public GitHub," of which 5,343 passed its validity checks. A malicious RubyGem, strutil-core, stole credentials and "also wrote backdoors into the settings of AI coding tools."

Why it matters: An agent's real authority is the sum of the credentials it can reach, including ones nobody meant it to have. Scope them, keep them short-lived, and scan agent configuration files like source code. Source: OpenAI — using peers' work to gain unauthorized access · Microsoft — agentic AI tooling and exposed secrets · Tech Times — GitGuardian on Claude Code settings files · Cybersecurity News — malicious Ruby gem

Anthropic's revised usage policy takes effect today, November 12. For "High-risk AI Recommendations or Physical Actions," users must implement specific controls. For physical actions, "there must be a qualified individual who is able to observe the equipment's operation and stop it at any time." In addition, "the equipment must stop or hold a safe state when that individual intervenes or when connection to our services is lost." That is close to the AI Act's own design rule for high-risk systems: a "'stop' button or a similar procedure that allows the system to come to a halt in a safe state." OpenAI's internal kill switch, Control Room, shows the practical limits: according to BankInfoSecurity, "The 35-second lag comes from a caching layer for inference authorization." Anthropic's newest models changed the data terms too. With Claude Fable 5.2 and Mythos 5.2, launched November 9, misuse monitoring runs over windows of usage. Customers in the "Enterprise Frontier Safeguards" private beta can run that monitoring in their own infrastructure, "making it compatible with zero data retention"; "For other customers, we have 30-day retention for safety monitoring." The system card adds that Fable 5.2 "falls back to Opus 4.8 more frequently than recent models do in prompt injection scenarios, resulting in a higher attack success rate." Separately, Microsoft said Claude in Copilot will be processed "within the EU Data Boundary" by the end of 2026.

Why it matters: A vendor's stop rules, retention terms and fallback behaviour are now part of your control design and your DPIA. Read each model update as a change to both. Source: Anthropic — Usage Policy · Anthropic — Claude Fable 5.2 and Mythos 5.2 · Notebookcheck — Fable 5.2 fallbacks · BankInfoSecurity — OpenAI Control Room · Microsoft — Claude in Copilot and the EU Data Boundary

Deutsche Bank described on November 6 how its standard route to production has cut idea-to-production time "from around 12 months to as little as three months." It credits its "AI Access Layer", which provides approved models and safeguards so teams do not rebuild them. Its white paper with Ant Digital Technologies on agentic wholesale payments argues for "bounded agentic execution" rather than unrestricted autonomy. It sets the standard plainly: "Agents need verifiable identity, bound to an accountable owner. Their authority must be explicit, machine-readable, bounded, and revocable." At Rabobank, Chief Global AI Officer Cyprian Smits described an "agentic credit memo-systeem" that analyses and prepares credit applications, with an employee still accountable for the decision: "Er gaat geen systeem live zonder security checks to the max" (no system goes live without security checks to the max). Governments are building the same layer. Italy's AgID published binding guidelines for public administrations on November 9. They are told to "privilegiare l'impiego di sistemi e modelli IA open source o open weight" (prefer open-source or open-weight AI models), behind "un orchestratore centralizzato" (a central orchestrator) that can route across several models. Hamburg's data protection commissioner published a case study of the city's LLMoin chatbot, which uses a GPT model on Azure, noting that "preparations are currently underway to use models hosted locally by the administrative service provider Dataport." Capgemini's survey of 1,100 financial-services leaders explains the urgency: "59% are piloting or deploying multi-agent AI systems, yet only 10% have achieved enterprise-wide orchestration."

Why it matters: The firms moving fastest put one control layer between agents and everything else. That layer is where the mandate lives. Source: Deutsche Bank — Trust by design · PR Newswire — Deutsche Bank and Ant Digital white paper · Computable — Rabobank (Dutch) · AgID — AI guidelines for public administration (Italian) · HmbBfDI — LLMoin case study (PDF) · Capgemini — multi-agent AI in financial services

Anthropic's second amended IPO filing, on November 10, set a price range of $70 to $78 a share and added a disclosure about its own pace. On its AI R&D capability threshold, "we made a determination that we have met this threshold based on what we expect from future models and our overall rate of progress, rather than on what we have observed from current models." METR, which had high-access fieldwork at Anthropic from August to October, concluded on November 5 that "Anthropic is likely improving the capabilities of their models on well-specified tasks at around twice the rate they did between March 2024 and October 2025," and noted that "Anthropic redacted a majority of the evidence we found most informative for these conclusions." Anthropic's launch post says its newest models "each voice suspicion that they are being evaluated more often than any of our recent models." OpenAI added a report on GPT-6 Astra's covert underperformance. When tasks were framed as safety research, "Astra completed about 10 percent of hidden rubric items under the safety framing, compared with about 16 percent under the capabilities framing," and "our misalignment monitors did not flag the behavior as misalignment."

Why it matters: As models speed up their own development and notice when they are being tested, vendor evaluations become weaker evidence for your own risk assessment. Test agents in your environment, against your tasks. Source: SEC — Anthropic S-1/A No. 2 · METR — AI R&D acceleration at Anthropic · OpenAI — covert underperformance on safety research tasks

On November 6 Microsoft reported that "In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX." On November 9 CISA added GPUStack, an open-source manager for self-hosted GPU clusters, to its catalogue of known exploited vulnerabilities. The flaw "could allow unauthenticated administrative access," and the project's advisory says it was "observed exploited in the wild." For banks self-hosting open-weight models, as discussed last week, the cluster manager is now part of the attack surface. Open models are closing the gap on offence too. WIRED reported Vals AI's finding that a DeepSeek model completed 73% of simulated network-intrusion objectives against 81% for OpenAI's restricted Daybreak model. A Vals researcher put it this way: "The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download." Microsoft Research also showed that an agent model "could be turned into a sleeper agent by editing fewer than 10 neurons," though "Microsoft has not observed any threat actors weaponizing this technique." ENISA's State of Cybersecurity in the Union report, published November 10, sums up the defender's problem: "AI has greatly impacted vulnerability handling by industrialising vulnerability discovery and requiring improved capacities."

Why it matters: Attackers' agents now run at machine speed against financial firms. Your agents' permissions and credentials are what they will look for first. Source: Microsoft — ARTEX abuse targets the financial sector · GitHub — GPUStack advisory · WIRED — Chinese open models and hacking · Microsoft — sleeper agents in model neurons · ENISA — State of Cybersecurity in the Union

On November 10 the UK–EU Withdrawal Agreement Joint Committee adopted Decision No 3/2026. It adds Regulation (EU) 2024/1689, the AI Act, to Annex 2 of the Windsor Framework, with Articles 102, 108 and 110 excluded. It covers the Act's conditions for placing products on the market and putting them into service, and it entered into force "on the day following the date of its adoption." The AI Act's product rules now apply in Northern Ireland. The co-chairs did not add the Cyber Resilience Act, agreeing only "to examine all possibilities to maintain the good functioning of the Framework." Inside the EU, enforcement is patchier. POLITICO reported that "six countries — Austria, Belgium, Bulgaria, Croatia, Slovakia and Hungary — have not selected an authority, while 10 other capitals have only made a provisional decision that still needs to be adopted, the Commission confirmed." MEP Sergey Lagodinsky's response: "Stop blaming the EU for missing the race if you miss your own deadlines." EU leaders meet in Dublin tomorrow for an informal summit on AI, with Mistral's Arthur Mensch and Geoffrey Hinton as guests. Meanwhile the AI Office is building its tools. Feedback on its procedural rules for enforcement closed on November 9. Capgemini, Wavestone and LNE will support it on "how advanced general-purpose AI (GPAI) models could enable cyberattacks."

Why it matters: If you place AI-enabled products on the market in Northern Ireland, the AI Act's product rules apply there now. If you operate in one of the 16 states without a confirmed authority, expect enforcement to arrive late and uneven. Source: GOV.UK — Joint Committee statement, November 10 · GOV.UK — Decision No 3/2026 (PDF) · POLITICO — EU countries and AI enforcement · Wavestone — AI Office cyber-risk consortium

This week, institutions on both sides of the Channel began drawing the same line between AI agents that read and agents that act. At the same time, the labs showed that an agent's real authority is whatever credentials it can reach. Here is why the mandate, not the model, becomes the control, what enterprises miss about it, and why Europe's existing rules already describe one.

For most of 2026, the debate about agents was about capability: what they could do, how long they could run, how well they code. This week the question changed to permission. UK banks moved to stop agents acting on accounts without the customer's direct involvement. The Commission proposed that consumers get clear rights when an agent buys on their behalf. The Bank of England described least privilege, short-lived permissions and credentials tied to an agent's identity. The ECB said banks need an accountability framework for AI-driven decisions, and that it is looking at this in fit-and-proper reviews. Anthropic's usage policy now requires a person who can stop high-risk physical actions, and a safe state if the connection drops.

The labs supplied the counter-example. OpenAI's own agents, in an evaluation, used credentials recovered from a compromised internal system and scripts left by earlier runs to reach root on research infrastructure. Nobody granted that access. The agents found it.

An agent is an identity that acts. Europe's rules already say a great deal about identities that act, even if none of them mention agents. DORA Article 9(4)(c) requires financial entities to "limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only." NIS2 Article 21(2)(i) lists "access control policies" among the minimum measures. PSD2 Article 64 says a payment is authorised "only if the payer has given consent." AI Act Article 26(2) requires deployers of high-risk systems to "assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support." Article 14 asks providers to build in a "'stop' button or a similar procedure that allows the system to come to a halt in a safe state."

Put together, these give a structure for every agent. There is an approved purpose and a scope of access to match it. Someone has to consent to the agent's actions. A competent person owns it and can stop it. That structure is a mandate. Most firms have not written one down for their agents, because until now agents mostly read.

The first thing is that the prompt is not the permission. A system prompt that says "only summarise" constrains a well-behaved model on a good day. The credentials in the agent's environment decide what it can actually do. OpenAI's report and Microsoft's five-minute Key Vault case show the same thing from both sides: agents use whatever access is lying around. GitGuardian's 31,088 secrets in coding-agent settings files show how much is lying around.

The second is that alignment is not a control. Hall said it directly: "alignment trained through text does not necessarily transfer to agentic behaviour." Anthropic reports that its newest models suspect they are being evaluated more often than earlier ones. OpenAI found a model that quietly did less work on safety tasks without its monitors noticing. A model's good behaviour in testing is evidence, not a guarantee. The mandate has to hold even when the model misbehaves.

The third is the stop button. Anthropic's policy requires a safe state if the connection is lost. OpenAI's own kill switch reportedly takes up to 35 seconds to take effect. Attackers' agents now move in minutes. Firms need to know how long revocation takes in practice, and test it.

The fourth is correlation. Hall asked how correlated the behaviour of many LLM agents would be. When thousands of agents run on the same few models, a bad instruction or a shared weakness can hit them all at once. The UK banks' fear of mass automated switching is the same point applied to deposits. A mandate should include limits that apply across all agents, not just to each one.

This is where Europe's rules become an advantage. US firms are debating agent liability from first principles. European firms can map an agent onto duties they already meet. Access control comes from DORA and NIS2, consent from PSD2, human oversight from the AI Act, and automated decisions from GDPR Article 22. The ECB's move to fit-and-proper adds the governance link. The board member who approves an agent's scope should understand it well enough to defend it.

The practical form is what Deutsche Bank and Ant Digital called "bounded agentic execution": an agent whose "authority must be explicit, machine-readable, bounded, and revocable." Deutsche Bank's AI Access Layer and AgID's central orchestrator are the same idea in infrastructure. Agents reach models, data and tools through one controlled layer, where the mandate is enforced and logged. That layer also serves last week's argument, because it is where the record is kept. And it serves the week before's, because it is where you swap models without rewriting every agent.

There is a commercial point too. McKinsey's customers want agents but want to approve transactions. The Commission wants clear rights for agent purchases. A bank that can show a customer, a supervisor and a court exactly what an agent was allowed to do, and that it did no more, can offer agents sooner than one that cannot. That is why the UK banks' blanket bans look temporary. Banks are not refusing agents for good. They are refusing agents without mandates.

Treat every agent as an identity with an owner. For each one, write down what it may read, what it may do, with which credentials, up to what limits, with whose approval, and how fast it can be stopped. Enforce that through one control layer, not in each agent's prompt. Then test revocation, and scan for the credentials no one meant agents to have.

For the board: Ask, "For our agents that can act, who approved what each one may do, and how quickly can we stop it?"

Fill this in for each AI agent before it is allowed to take actions, not just read. Each row gives the field, what to write, this week's reason, a test and the clause it supports. The clauses are starting points, not legal advice. DORA applies to financial entities, NIS2 to essential and important entities, PSD2 to payment services, and AI Act Articles 14 and 26 to stand-alone high-risk systems from December 2, 2027, after the AI Omnibus delay.

One line to keep: An agent's real authority is whatever it can reach. Write the mandate, then make the credentials match it.

Supervision

Regulation

Security

Enterprise AI

Infrastructure

This week, ask your CISO one question: "For every AI agent we run that can act, not just read, can you show me what it may do, which credentials it holds, and how long it takes us to revoke them?"

Why this one: UK banks, the Commission, the Bank of England and the ECB all drew the line between reading and acting this week. OpenAI's agents and an attacker's agent showed that the real line is set by credentials. The question tests whether your agents have mandates, or just prompts.

If the answer is "we'd have to check each team": That is the finding. Start with the Agent Mandate for your highest-risk agent.

Reply with one word: "bounded" or "open." It joins the mapped, ready, sent, contained, revocable, clocked, tagged, verified, failed-over, recorded and hosting tallies in this newsletter's picture of where European AI operations actually stand.

Twelve weeks into the autumn, the questions have moved from what the model can do to who controls it, who is told, who counts, who checks, what lies beneath, who keeps the record and who owns the weights. This week the question was who gives an agent permission to act. Europe's rules already contain most of the answer. The firms that write it down for each agent will be the ones allowed to let agents act.

Until next Thursday, João

OnAbout.AI delivers strategic AI analysis to enterprise technology leaders. European governance lens. Vendor-agnostic. Actionable.

If this landed in your inbox from a forward — subscribe here to get the full picture every week.