Agentic AI in trading: what regulators are watching

An agent differs from an automated system in one respect that matters more than any technical detail: nobody wrote down what it will do. A conventional system executes a plan a person specified, so its possible actions can be enumerated before it runs. An agent is given an objective and constructs its own sequence, which is exactly the property that makes conformance testing, annual self-assessment and clean shutdown fit badly. IOSCO addressed the topic in May 2026. Meanwhile only 2% of AI use cases in the UK regulator survey were fully autonomous — the supervisory attention is running ahead of the deployment.

Published 28 August 2026 · AI Trading Book Editorial · Reading time about 12 minutes

What makes a system agentic

The term is used loosely, including by vendors describing ordinary rule-based automation. The distinction that carries weight is narrow.

A conventional automated system is given a procedure. It may be complex, adaptive within parameters, and driven by a machine-learning model, but the set of things it can do is defined by its code. You can list its possible actions, test each path, and reason about what happens in a condition you specify.

An agentic system is given an objective and decides its own sequence — planning steps, calling tools, observing results, revising. The set of actions it might take is not enumerable in advance, because the plan is generated at run time. Two runs with the same objective and similar conditions may proceed differently.

That property is the whole story for supervision. Everything that follows — the testing problem, the shutdown problem, the audit problem — is a consequence of not being able to write down beforehand what the system will do.

Where the regulators are

IOSCO, the international body for securities regulators, published a report addressing agentic AI in May 2026 — IOSCOPD823, carrying the reference FR/02/2026. It follows IOSCOPD788 of 12 March 2025, which examined AI in capital markets more broadly, and an earlier IOSCO survey in 2024 that found algorithmic trading among the most common AI use cases at 63.3% of respondents, behind client communications at 66.7%.

Neither report creates binding rules. IOSCO sets standards its members implement domestically, so its output shapes what national regulators do next rather than imposing obligations now. The practical significance is directional: agentic systems are on the supervisory agenda before they are in widespread use, which is unusual and reflects how quickly the capability arrived.

Domestically, nothing addresses agents specifically. The FCA's position, on its AI approach page updated 13 February 2026, remains that it does not plan extra AI regulation. ASIC's CP 386 of 27 August 2025 proposes controls for Trading Algorithms including immediate suspension capability, drafted functionally rather than for agents in particular. New Zealand has no equivalent framework.

How much of this actually exists

Worth establishing before discussing risk. The best UK evidence is the Bank of England and FCA survey published 21 November 2024 covering 118 firms: 75% used AI, 55% of reported use cases involved some automated decision-making, and 2% were fully autonomous.

Two per cent is the number to hold onto when reading marketing about autonomous trading agents. Firms that have examined the question are overwhelmingly keeping a human in the decision, and the same survey found only 34% reporting a complete understanding of the AI technologies they used, with 46% reporting partial understanding. Deploying an agent into that comprehension gap is a different proposition from deploying a rule engine.

Where the existing controls fit badly

The UK algorithmic trading framework is functional and technology-neutral, so it reaches agents without amendment. Reaching them is not the same as fitting them. Three requirements in onshored RTS 6 assume properties an agent does not have.

None of this makes the requirements inapplicable, and none of it is an argument for lighter rules. It means a firm satisfying the letter — annual review completed, kill switch present — can satisfy the paperwork while missing the risk. The same gap appeared in the FCA's multi-firm review of 21 August 2025, where all ten firms had adequate pre-trade controls but some users of third-party algorithms could not explain how those algorithms were built.

The shutdown problem specifically

Article 12 requires the ability to cancel unexecuted orders immediately, and ASIC's CP 386 proposes equivalent immediate-suspension controls. Both are necessary and neither is sufficient for an agent.

Cancelling orders stops new exposure. It does not resolve a position an agent built halfway through a plan — a hedge leg executed without its pair, a spread partially assembled, an instruction already accepted by a venue. A conventional algorithm generally has a defined state you can inspect. An agent has a plan you may not have seen, executed to a point you have to reconstruct.

The practical implication is that an agent needs two things a rule engine does not: a stopping mechanism that also captures the intended plan and its progress, and a defined procedure for unwinding a partially executed sequence.

Accountability does not dilute

A recurring intuition is that autonomy diffuses responsibility — that if the system chose, the human chose less. Under the UK regime the opposite holds.

The Senior Managers and Certification Regime assigns accountability to the named individual responsible for the business area. There is no AI-specific senior management function and none has been proposed. A senior manager who deploys an agent is accountable for outcomes they did not specifically direct, because they are accountable for the decision to deploy something whose specific actions they could not specify.

Australia works the same way through the section 912A obligations on AFS licensees, including the requirement to provide services efficiently, honestly and fairly and to maintain adequate risk management systems. Neither obligation contains an exception for systems that acted on their own.

The Bank of England and FCA survey found 84% of firms reporting an accountable person for their AI use, which suggests the point is understood. The 34% reporting complete understanding of the technologies suggests it is not always operationalised.

The audit problem

Regulatory obligations across all three markets assume you can explain what happened. With a rule engine that is straightforward: the rule was applied, here is the rule and here are the inputs. With an agent you have a sequence of decisions, each conditioned on the results of the previous ones.

Reconstructing that after the fact requires logging designed in from the start — the objective given, the plan generated, each tool call and its result, each revision and its trigger, and the state at every point. None of this is exotic engineering, but it must exist before an incident, and it is not what a system built for performance produces by default.

The record also has to be interpretable by someone other than its author. A supervisor asking why a position was taken needs an answer, and "the agent determined it was optimal" is not one.

The systemic concern

The risk that regulators discuss most is not one agent behaving badly but many behaving alike.

The Bank of England set out the mechanism in its Financial Stability in Focus publication of 9 April 2025, noting that correlated positions arising from similar models and data can amplify shocks. Agents sharpen that concern for structural reasons: they are typically built on a small number of foundation models, they draw on similar public data, and they are given similar objectives.

The concentration figures from the same 2024 survey give the shape of it. Among named third-party providers, the top three cloud providers accounted for 73%, the top three model providers 44% and the top three data providers 33%. A third of use cases were implemented by third parties. Systems built on that stack are less independent than the number of firms running them suggests.

The architecture that holds up

The defensible design separates what the agent decides from what constrains it, and the separation has to be structural rather than a matter of good behaviour.

1. The agent proposes; deterministic logic disposes. Every order passes independent validation against position limits, exposure caps, order-rate limits and sanity checks. That validation does not consult the agent.
2. Constraints are hard, not instructed. A limit expressed in the prompt is a suggestion; a limit in the order path is a limit.
3. The kill switch stops the agent and the orders. Halting order flow while the agent continues planning solves half the problem.
4. Log the plan, not only the actions. Objective, generated plan, tool calls, results, revisions.
5. Bound the blast radius. A sub-account funded with the allocation you accept losing, per our API key security page.
6. Define the unwind procedure before deployment, covering a stop mid-sequence with partial positions open.

The first point is the one that matters most and the one most often compromised, usually by asking the model to check its own output. A model's failure mode is confident wrongness, which is precisely what a risk check exists to catch — a check that consults the model inherits the error it was built to stop.

What evidence exists

None that we could locate for performance. No study of agentic trading against a benchmark after costs was identified, and no audited live track record for any agentic trading product.

The surrounding evidence is unfavourable rather than neutral. A peer-reviewed review of 27 machine-learning equity experiments found no conclusive evidence of returns at scale, and AI hedge fund indices returned 9.8% annualised against 13.7% for the S&P 500 from December 2009 to July 2024. Nothing about giving a model more autonomy addresses the reasons for those results.

Supervisory interest reflects potential risk rather than demonstrated capability. Reading IOSCO's attention as validation of the technology inverts what the documents are for.

For retail readers

Products marketed as autonomous AI agents exist, and the label is applied to things that are not agentic in any meaningful sense. Conventional rule-based automation is routinely described this way because the word is currently persuasive.

Two checks apply regardless. Whatever it is called, the entity offering it should appear on the relevant register with permissions covering what it offers — and any promise of autonomous profit generation should be read against the documented scale of AI-branded fraud, where ASIC coordinated the removal of 11,964 scam websites during 2025. "Autonomous AI" is the current version of a claim our scams page tracks across several brand names.

What we could not establish

• Any performance evidence for agentic trading systems. Data not found.
• Adoption figures for agentic systems specifically. The 2% autonomy figure covers all AI use cases, not agents. Data not found.
• Any binding domestic rule addressing agentic AI in the UK, Australia or New Zealand. Data not found — none exists at the time of writing.
• Documented incidents involving agentic trading systems. Data not found.

Key takeaways

• Unenumerable actions is the defining property, and every control difficulty follows from it.
• The rules reach agents but fit them poorly — three RTS 6 articles assume a stable artefact.
• Cancelling orders is not the same as stopping cleanly. Plan an unwind before deploying.
• Accountability concentrates rather than diffuses. No AI-specific senior management function exists.
• Correlation is the systemic concern, sharpened by concentration in cloud, model and data providers.
• Supervisory attention is not evidence of capability. No performance evidence exists.

Frequently asked questions

What is agentic AI in trading?

A system given a goal rather than a procedure, which plans its own sequence of steps, uses tools, observes results and adapts. The distinguishing feature is that the specific actions are not specified in advance — an automated system executes a plan you wrote, an agent writes the plan.

How is an agent different from a trading bot?

A conventional bot follows rules a person defined, so its possible actions are enumerable before it runs. An agent decides its own sequence toward an objective, so the space of things it might do is not enumerable in advance. That difference is what makes testing and control harder.

Has any regulator addressed agentic AI?

IOSCO published a report addressing agentic AI in May 2026 — IOSCOPD823, reference FR/02/2026 — following its earlier work on AI in capital markets in IOSCOPD788 of 12 March 2025. Neither creates binding rules; both set out supervisory concerns.

How common are fully autonomous AI systems in finance?

Rare. In the Bank of England and FCA survey published 21 November 2024, covering 118 firms, 55% of reported use cases involved some automated decision-making but only 2% were fully autonomous. Adoption is broad; autonomy is not.

Why does RTS 6 fit agents badly?

Because it assumes a stable artefact. Article 6 conformance testing tests a system before deployment, article 9 requires an annual self-assessment, and article 10 requires stress testing against anticipated conditions. An agent that plans differently each run has no single tested version, and its failure modes are not enumerable a year ahead.

Can you kill-switch an agent?

You can stop it sending orders, which is what article 12 of onshored RTS 6 requires and what ASIC's CP 386 proposes. Stopping it cleanly mid-plan is harder: an agent halted between steps may leave partially built positions, open hedges or in-flight instructions that a simple order cancellation does not resolve.

Who is accountable if an agent causes harm?

Under the Senior Managers and Certification Regime, the named individual responsible for the business area. There is no AI-specific senior management function and no proposal to create one. Autonomy does not distribute accountability; it concentrates it on whoever authorised deployment.

Does an agent count as algorithmic trading?

If it determines order parameters with limited or no human intervention, yes — the definition is functional and does not mention how the decision was reached. An agent that only produces research for a human to act on falls outside it.

What is the systemic concern with agents?

Correlation. The Bank of England noted in April 2025 that correlated positions arising from similar models and data can amplify shocks. Agents built on a small number of foundation models, reading similar data and pursuing similar objectives, are more likely to act alike under stress than independently designed systems.

Are there agentic trading products for retail?

Products marketed as autonomous AI agents exist, but the label is applied loosely and often describes conventional rule-based automation. Any product promising autonomous profit generation should be checked against the register and read alongside the documented scale of AI-branded fraud.

Should I let an agent trade my account?

The defensible architecture keeps the agent out of the risk layer: it can research, plan and propose, while deterministic logic independently validates every order against position limits, exposure caps and rate limits before it reaches the broker. That validation must not consult the agent.

What is the audit problem with agents?

Reconstructing why a decision was made. Regulatory obligations assume you can explain what happened and demonstrate control. An agent that chose its own sequence produces a trail of actions rather than a rule that was applied, so logging the plan, the inputs and the tool calls has to be designed in from the start.

What evidence exists that agentic trading works?

None that we could locate. No study of agentic trading performance against a benchmark after costs was identified, and the broader machine-learning evidence is unfavourable. Supervisory interest reflects potential risk rather than demonstrated capability.

Sources

• IOSCO — IOSCOPD823 (FR/02/2026), May 2026, addressing agentic AI; IOSCOPD788, 12 March 2025, on AI in capital markets; 2024 use-case survey — algorithmic trading 63.3%, client communications 66.7%, robo-advising 60%, surveillance 53.3%, productivity 50%.
• Bank of England and FCA — "Artificial intelligence in UK financial services – 2024", 21 November 2024, n=118 — 75% using AI, 55% of use cases with automated decisioning, 2% fully autonomous, 33% third-party implementation, 84% with an accountable person, 34% complete and 46% partial understanding; provider concentration top three cloud 73%, model 44%, data 33%.
• Bank of England — "Financial Stability in Focus", 9 April 2025 — correlated positions from similar models and data amplifying shocks.
• UK-onshored MiFID II RTS 6 — article 6 conformance testing, article 9 annual self-assessment, article 10 stress testing, article 12 kill functionality; FCA Handbook MAR 7A.
• FCA — AI approach page, updated 13 February 2026; multi-firm review of algorithmic trading controls, 21 August 2025.
• ASIC — CP 386, 27 August 2025 — proposed immediate-suspension controls; Corporations Act 2001 section 912A.
• ASIC — 26-063MR, 8 April 2026 — 11,964 scam websites removed during 2025.
• Buczynski, Cuzzolin and Sahakian, International Journal of Data Science and Analytics 11(3), April 2021; Eurekahedge AI Hedge Fund Index.

Informational research only. Nothing on this page is financial, legal, tax or investment advice, or a recommendation to deploy any system. Autonomous trading systems can lose money rapidly and the evidence base for their performance does not exist.