The model proposes, the ledger decides

Finance teams are not choosing between deterministic systems and AI. Every production deployment we could document draws the same line: the model reads, matches and drafts, and something deterministic or a named person decides what moves money. BNY's roughly 140 "digital employees" each report to a human manager. Allianz's claims agents cut handling time by 80%, but a person authorises every payout. Rillet's AI ledger proposes entries and posts through rules. The live argument is not whether to cross that line but how quickly to move it, and in April US bank regulators declined to say, leaving generative and agentic AI out of their new model-risk guidance altogether.

At a glance

What named firms say they run, and who has the final say. Every result figure is self-reported; none has been independently audited.

Firm	What the agent does	Who decides	Reported result
BNY	About 140 "digital employees", such as payment-validation agents that flag stuck transactions	Each has its own login and a human manager; every action is logged with its rationale	Stuck payments flagged in minutes instead of hours
Allianz (Australia)	Seven agents handle food-spoilage claims under about AUD 500	A claims professional authorises every payout	80% less processing and settlement time
Rillet	AI-native ERP that proposes classifications and entries	Postings come from rules, policies and mapping tables; accountants approve	Over 600 customers; valued at $1B in August 2026
BlackLine	Verity Prepare: multi-agent reconciliation preparation	Produces an audit-ready package "for human sign-off"	Generally available since 27 July 2026
Ramp	Policy Agent reviews expenses against company policy	Starts in review-only mode; reviewers keep final authority	99% approval accuracy and about 85% fewer manual reviews among early customers
Goldman Sachs	Claude agents for trade accounting and client onboarding	Not disclosed	"Early stages" in February 2026; no results published since

The pattern every deployment shares

The sources differ in detail and agree in shape. Four controls recur, and between them they make up what BCG and SCBX, in a 2026 paper on banking agents titled "The Agent is the Easy Part", call "a probabilistic core inside a deterministic boundary".

The arrangement behind every deployment in the table: the model's output is a proposal until code or a person acts on it.

The model proposes, and a person or a rule commits

Allianz's payout authorisation, BlackLine's sign-off package, Ramp's review-only start and Morgan Stanley's advisers editing a meeting summary before it is sent all put a person at the point where the output takes effect. Anthropic's finance agent templates, published in May 2026, include a general-ledger reconciler and a month-end closer, and describe the same arrangement: users review and approve Claude's work "before it goes to a client, gets filed, or is acted on." BCG's phrasing is the clearest version: "the agent proposes; the system commits," and autonomy is earned "as the evidence comes in."

A deterministic layer writes the record

Rillet states the rule outright: "final ledger postings are produced via deterministic logic (rules, policies, mapping tables), even when AI is used to propose classifications." Stripe's payments foundation model improved card-testing detection, but the decision to authorise or decline stays in its Radar rules. The model can make the signal better; it does not take the action.

Code does the arithmetic

Bridgewater's investment assistant writes Python and lets the code compute. Claude in Excel puts its formulas in the workbook, where they can be audited. The academic evidence points the same way. Vals AI's Excel Modeling benchmark finds that "numerical accuracy is the main weakness," with formula checks passing far more often than numeric ones. A 2026 preprint on calculation-heavy financial questions, CIFQA, reached 95.54% by restricting the model to language and sending every calculation to Python. Our own reconciliation experiment found the failure that matters most: the model's arithmetic was usually right, and its answer looked the same when it was not.

Every agent has an identity and a log

BNY gives each digital employee "logins, email addresses, and human managers", and BNY's Michael Demissie says "every action the digital employee performs is fully auditable … the rationale is logged." JPMorgan's technology team summarised its 2026 Innovation Week with the line that "autonomy and controls must grow in tandem." This is the least glamorous control and the one regulators ask about first.

What went wrong where the line was missing

The public failures in professional and financial services have one thing in common. Generated output reached a client or the public with no deterministic check in between.

Deloitte Australia, 2025: a government assurance review worth about AUD 440,000 contained fabricated references and an invented quotation from a Federal Court judge. The revised report disclosed GPT-4o, and Deloitte refunded the final instalment.
EY Canada, May 2026: a study on loyalty-programme fraud was withdrawn after 16 of its 27 references turned out not to exist.
Commonwealth Bank of Australia, August 2025: CBA reversed 45 job cuts it had attributed to a voice bot after the union challenged them, saying call volumes were rising, and called the original decision an "error".
Klarna, 2025: after its assistant took on two-thirds of customer chats, Klarna's chief executive said the AI-first approach had produced "lower quality" service, and the company began hiring people again.
Moffatt v. Air Canada, 2024: not a finance case, but the one finance lawyers cite. A tribunal held the airline liable for a refund policy its chatbot invented and rejected the argument that the chatbot was "a separate legal entity".

The absence on this list matters as much. We found no public case of a model's arithmetic error reaching filed financial statements, and no audit regulator sanction specific to generative AI. The PCAOB's 2024 review found audit firms using it mostly for "administrative and research" work. That is consistent with the pattern above: where money is computed, firms have kept the model away from the computation.

What regulators asked for in 2026

The rules are moving in different directions, and the differences matter for anyone operating in more than one market.

United States: generative AI left out of model risk

On 17 April the Federal Reserve, the OCC and the FDIC replaced SR 11-7 with SR 26-2. Its footnote 3 puts generative and agentic AI outside the guidance as "novel and rapidly evolving", and our model-risk page covers what examiners still expect. One detail of the new definition is easy to miss and bears directly on this debate: a "model" now "excludes simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes." So an architecture that moves every number into code and every decision into rules takes those parts out of model-risk scope, while the model itself is out by carve-out. What is left for governance is the model's routing and judgement, which is the part no framework yet covers. FINRA's 2026 oversight report treats AI agents for the first time, and its concerns follow the same line: autonomy without human checks, authority creeping beyond what was granted, and multi-step actions that are hard to reconstruct.

Europe and the UK: delayed in one, never carved out in the other

The EU's Digital Omnibus, in force since 27 July 2026, moves the AI Act's high-risk obligations for credit scoring and life and health insurance pricing from August 2026 to 2 December 2027. The logging, human-oversight and accuracy duties are unchanged; only the dates moved. The UK took the opposite view of model risk to the US: the PRA's SS1/23 is technology-agnostic and was never written to exclude generative AI. The FCA's second AI Live Testing cohort, announced in April, includes Barclays, UBS and Lloyds' Scottish Widows, with use cases spanning agentic payments, AML and KYC.

Asia: registries and named accountability

Singapore's MAS published final AI risk management guidelines on 7 October, covering "all forms of AI technologies", with an AI inventory, materiality assessment and human oversight. The first sections apply from October 2027, and MAS intends to consult on agent-specific guidance in 2027. A week later, the HKMA announced its ART framework and a coming discussion paper that proposes "a registry of material A.I. agents" and "intent-anchored accountability". If that idea spreads, the BNY model, where every agent is a named identity with a human owner, becomes a supervisory expectation rather than a good practice.

The argument, from both sides

For: the baseline is not zero

The case for letting models do more starts with the process they replace. Raymond Panko's spreadsheet research puts the cell error rate at around 1%, and found errors in most of the spreadsheets studied. In April 2024 an $81 trillion credit was entered at Citi instead of $280. The payments employee and a second reviewer both missed it, and a third employee caught it about 90 minutes later. The FT counted ten near misses of $1 billion or more at the bank that year. Four-eyes review has a miss rate too. If a model with checks makes fewer mistakes than two people without them, holding it to a perfect standard means keeping a worse process.

Against: the errors are a different shape

The counter-argument does not claim models are worse on average. It claims the average is the wrong measure:

The distribution of errors differs. People make slips. Models produce fluent, internally consistent fabrications, such as a reference list that looks right or a reconciliation that says 0.00, which reviewers are worse at catching.
Tail risk decides. BCG's measure is the blast radius: "how far the action of a single agent travels before something deterministic, or someone human, stops it." It argues this is "the risk number that matters" because "it is the single worst outcome, not the average."
Accountability does not transfer. The former Acting Comptroller Michael Hsu warned in 2024 that "with AI, it is easier to disclaim responsibility for bad outcomes than with any other technology in recent memory." The Air Canada tribunal showed that the disclaimer fails.
Checking costs money. A 2025 survey by researchers at Stanford and BetterUp, published in HBR, estimated that cleaning up low-quality AI output costs about two hours per incident. A model that is right 95% of the time but must be checked 100% of the time saves less than it appears to.

Where we come down

Both sides are right about different steps. For reading documents, matching records and drafting, a model with checks plausibly beats the manual baseline today, and refusing to use one is a cost. For computing and deciding, the comparison is the wrong one: code does arithmetic perfectly and rules decide consistently, so the alternative to a model there is not a person but a function. The boundary is what makes the "beats humans" claim testable at all. With it, every model output is checked and its error rate can be measured. Without it, you only find out when someone outside the firm does.

What happens next

Five developments to expect, each with a signal that would show whether we are wrong.

Autonomy granted by action class, not by model

Firms will raise agent permissions one kind of action at a time (flagging, then preparing, then posting below a limit), each step justified by measured error rates on the previous one. Signal: agent approval limits appearing in delegated-authority policies the way they exist for staff.

Agent registries become regulation

The HKMA's proposed registry of material agents will be copied, because it is cheap to supervise and maps onto practice firms like BNY already follow. Signal: a second regulator, or the FSB's final sound practices, asking for an agent inventory with named owners.

US guidance on generative AI arrives as principles, not rules

The agencies have said they will issue a request for information on AI use, including generative and agentic AI. Given SR 26-2's non-enforceable tone, expect principles on logging, human review and third-party accountability rather than a validation regime. Signal: the RFI's publication, and whether it asks about reproducibility.

Vendors compete on the commit layer

Rillet, BlackLine and FloQast already sell the deterministic layer and the audit package as much as the model. The audit firms' alliances (EY with both FloQast and Rillet) are the market test. Signal: an audit firm publicly relying on a vendor's agent-prepared reconciliations as audit evidence.

The adoption gap closes slowly

Gartner found 59% of finance teams using AI in 2025, and in May 2026 reported that 63% of finance organisations said implementation was slower than expected. McKinsey found no business function, finance included, where more than 10% of companies had scaled agents. The Evident AI Index for October 2026 put JPMorgan first for the fifth year, but only 12% of the use cases it tracks disclose any effect on operating metrics. Signal: that 12% rising, which would mean firms can measure what their agents changed.

FAQ

Can AI be used in financial processes that must be deterministic?

Yes, if the model only proposes and something deterministic decides. In the deployments we found, models read documents, match records and draft commentary, while code computes every amount and rules or named people approve anything that moves money.

Should an LLM ever do the arithmetic in a finance workflow?

No. Benchmarks find numeric accuracy to be the weakest part of models' financial work, and a wrong answer looks the same as a right one. Code does arithmetic exactly and cheaply, so the model should call code for any number that is used as a number.

Do US model-risk rules cover generative AI agents?

Not since April 2026. SR 26-2, which replaced SR 11-7, puts generative and agentic AI out of scope, and its definition of a model also excludes simple arithmetic and deterministic rule-based processes. Banks are still expected to govern these tools under their general risk management.

Are AI agents more accurate than people at finance work?

For reading and matching, they can be, when their output is checked. People also make errors, as Citi's $81 trillion near miss showed. But models make confident, fluent errors that reviewers catch less easily, so the useful comparison is a checked model against a checked process.

What do regulators expect from banks using AI agents?

A consistent set across FINRA, MAS, the HKMA and the EU AI Act: logs that can reconstruct what an agent did, human oversight where the stakes are material, testing before deployment and after changes, and firms remaining accountable for third-party models.

The model proposes, the ledger decides: how finance is actually adopting agents