AI agents will soon manage your money and insurance. Who sets the rules?

This edition is about agentic finance: AI agents that act for customers, and the rules taking shape around them.

• The FCA plans a trusted framework for agentic finance, covering agent identity, delegated authority, accountability and execution.
• The FSB and MAS finalise their AI risk guidance for financial institutions. MAS will consult on agentic AI guidance in 2027.
• Lemonade wants customers’ AI agents to buy and manage insurance directly in its systems, and Sierra’s draft Poppy protocol sets out how agents identify themselves and get the customer’s permission.
• A European standards committee starts work on sharing insurance data with AI agents, and Manulife gives its advisors an AI underwriting assistant.
• The Digital Fairness Act proposal is expected this autumn, most likely in November.

But first, some personal news.

The FCA plans a trusted framework for AI agents that act for customers

On 19 October 2026 Jessica Rusu, the FCA’s Chief Data, Information and Intelligence Officer, described AI moving from helping people understand and decide to acting on their behalf. The FCA will work with industry, other regulators and frontier AI labs on a trusted framework for agentic finance, covering agent identity, delegated authority, accountability and execution.

My summary covers the five points that matter for agentic advice: consumers already using AI for investing, a clearer regulatory boundary with disclaimers from AI providers, the planned framework, reporting of AI failures and near-misses, and the good and poor practice paper the FCA published the same day.

Read my summary of the FCA speech.

The FSB finalises 12 sound practices for responsible AI adoption

On 15 October 2026 the Financial Stability Board (FSB) published its final report on Sound Practices for Responsible Adoption of Artificial Intelligence, following a consultation in June. It sets out 12 sound practices that financial institutions are encouraged to consider, in two groups:

1. Organisation-wide AI governance: the board and senior management aligning AI adoption with the business model, risk appetite and strategy; clear roles and responsibilities; AI risks built into the risk management framework, with documentation of AI use; and continuous learning and adaptation.
2. Managing risks across the AI lifecycle: assessing the materiality and risks of each use case at inception and thereafter, choosing appropriate AI technologies, data governance, explainability, performance evaluation, human oversight, AI-related cyber and ICT risks, and third-party AI dependencies.

The FSB strongly encourages boards and senior management to reference the sound practices when developing and refining their AI governance, risk management and control frameworks. It describes them as a practical toolkit that institutions can tailor to their own risk profile and fit into existing frameworks, including those for cyber and third-party risk.

Read the FSB report.

MAS finalises its AI risk management guidelines for financial institutions

On 7 October 2026 the Monetary Authority of Singapore (MAS) issued its final Guidelines on Artificial Intelligence Risk Management. They apply to all financial institutions and all forms of AI, and the approach stays principles-based and risk-proportionate. Four key expectations stand out:

1. Clear accountability for AI risk oversight at board and senior management level. No dedicated AI committee is needed if existing governance structures do the job.
2. Identify, assess and manage AI risks across the whole AI life cycle. That starts with knowing where you use AI and keeping an inventory.
3. Manage third-party AI risks. The institution stays accountable, even when someone else built or runs the system.
4. Apply it all in proportion to risk. Basic policies can be enough where the potential impact is low.

The Guidelines take effect on 7 October 2027 and can be implemented in phases, with the remaining sections due by 7 October 2028. MAS also intends to consult the financial sector in 2027 on what additional guidance on agentic AI would be useful. Read next to the FSB practices, the direction is consistent: board accountability, an inventory of AI use, controls across the lifecycle and accountability for third-party AI.

Read the MAS announcement.

Lemonade wants customers’ AI agents to buy and manage insurance directly in its systems

In October 2026 Lemonade announced Lemonade Agentic, an experience on its Lemonade OS technology stack designed exclusively for customers’ personal AI agents. Instead of browsing a website, an agent will be able to buy a policy, change coverage and handle claims directly in Lemonade’s systems. It is not live yet; Lemonade has opened a beta waitlist.

My summary covers what agents will be able to do, how this differs from opening a website to agents, and the questions it raises in Europe, from the best-interest and demands and needs rules of the Insurance Distribution Directive (IDD) to the upcoming Digital Fairness Act.

Read my summary of Lemonade Agentic.

Sierra publishes Poppy, a draft protocol for how personal AI agents work with companies

On 9 October 2026 Sierra published a draft of the Personal Agent Protocol, known as Poppy. It sets out how a personal AI agent identifies itself to a company, gets the customer’s permission and gets a task done. Design partners include Bank of America, BBVA, Visa, Mastercard and PayPal, and from insurance GEICO, Liberty Mutual, Cigna and Insurify, which blocked Meta’s personal agent Muse from its insurance marketplace on 23 September.

In a live demonstration, Muse got a mortgage pre-approval from Rocket’s agent within moments. My summary explains in plain language how the protocol works and how it overlaps with the FCA’s planned framework.

Read my summary of Poppy.

The Digital Fairness Act proposal is expected this autumn

On 5 October 2026 the European Parliamentary Research Service (EPRS) published a briefing, Towards a digital fairness act. The European Commission is expected to publish its proposal this autumn, most likely in November. In 2024 the Commission found that EU consumer law remains broadly relevant but has shortcomings requiring further action. The debate now focuses on which practices the act should address and how it will interact with existing EU legislation.

The act will matter for all financial and insurance services that reach consumers online, from product design and personalised pricing to user experience, distribution and finfluencer marketing.

If you want to stay ahead of it, I can help in two ways: keeping you updated through the policy process so there are no surprises later, or a deeper look at what it means for your business. That can be a briefing, a team training or a tailored impact analysis. Reply to this email if that would be useful.

Read the EPRS briefing.