Taiwan’s Financial Supervisory Commission has published a consultation paper on the security controls required for agentic artificial intelligence in financial institutions. The document addresses systems that can plan multi-step tasks, call tools and access data across platforms. It is open for public comment and is intended to form the basis of later guidance rather than replace existing laws or internal-control rules.
The regulator distinguishes agentic AI from generative chat systems. An agent that can initiate actions across operational platforms introduces new failure modes: purpose drift, tool misuse, privilege escalation, sensitive-data leakage and error compounding across sequential steps. Most current use in Taiwan’s financial sector remains at the trial stage, according to Lin Yu-tai, Director-General of the FSC’s Information Services Department. The consultation is timed to establish controls before wider operational deployment.
Governance is organised by application scenario rather than by model or vendor. For each scenario the institution must define the business purpose, the accountable parties, the data the agent may access, the tools it may call, the actions it may execute, the destinations of any output or write, and the procedures for abnormal-state handling, suspension and audit trail. Risk-based human review, continuous monitoring, degradation, stop and recovery mechanisms are required according to the assessed risk level.
Risk classification rests on three axes: data sensitivity, impact of the agent’s actions, and capability boundaries or potential for diffusion. The higher of any conflicting ratings is applied. Illustrative tiers run from L1 (low-risk query, summary or draft assistance) to L4 (actions that can affect core financial operations, transactions, payments or material client rights). Classification results feed directly into lifecycle management: approval thresholds, pilot-to-production criteria, control depth, ongoing supervision and re-assessment when the scenario or capabilities change.
Security controls treat the agent as a non-human identity and workload operating under zero-trust principles: no default trust, continuous verification, least privilege and full traceability. Requirements cover identity, device and execution environment, network, application and workload, data protection, behavioural controls, and visibility and analytics. Basic and advanced controls are differentiated by risk tier. High-risk or irreversible actions must retain authorisation, policy checks and human review; systems lacking adequate blocking and recovery capability should not be allowed to execute automatically.
Five control objectives are stated: observability, restrictability, interruptibility, recoverability and traceability. These sit alongside the existing information-security and outsourcing frameworks. The FSC emphasises that the paper does not displace current statutes, supervisory rules or internal-control requirements. It is a forward-looking discussion document while technology, use cases and governance practices continue to evolve.
For private banks, securities firms, investment-trust companies and the expanding family-office advisory channel the practical consequence is documentary. Any 2027 deployment that moves beyond internal research assistance into client-facing or transaction-adjacent functions will need a written scenario definition, a risk-tier assignment and evidence that the five control objectives can be met. The same discipline applies to third-party or cloud-hosted agents that interact with Taiwan-licensed systems.
The consultation therefore functions as an early gate for 2027 technology choices. Institutions that treat agentic capability as an efficiency tool without the corresponding scenario, tier and interruptibility documentation will face a governance gap once formal guidance is issued. Those that map each intended use against the three axes and the five objectives now will be positioned to scale under a known framework rather than under ad-hoc remediation.
The decision that will govern 2027 agentic systems is not the model; it is the scenario definition and the interruptibility rule written beside it.