Written by: Karol Sobieraj, Founder & CEO, Digital Colliers
VentureBeat surveyed 107 enterprises this year and found 54% had already experienced an AI agent incident. Wrong action, wrong data, wrong customer. That number is going to look quaint by the time the next survey lands. Most of the banks I talk to are scaling copilots and agents into production on shared service accounts, and they're about to learn what that costs.
If you run financial services in the EU or UK, the regulator is not going to accept "the agent did it" as an audit answer. You need to know which agent, acting on whose behalf, under what scope, approved by which human. Right now, most stacks can't answer any of those questions.
Shared credentials are already a compliance problem
DORA has been in force since 17 January 2025. The whole point of it is operational resilience with a clear chain of accountability for every action that touches a critical system. An agent using the same service account as forty other agents is not a chain of accountability. It's a bucket.
Stack the EU AI Act on top. High-risk obligations apply from 2 December 2027, and fines for high-risk violations reach up to 15 million euros or 3% of global turnover. Credit decisioning is already exposed under GDPR after the SCHUFA ruling from the Court of Justice in December 2023, which pulled automated scoring into Article 22 territory. GDPR fines themselves go to 20 million euros or 4% of turnover.
Now imagine your model risk team gets a Section 166 letter, or a DORA incident report request, asking which agent adjusted a customer's credit limit at 03:14 on a Tuesday. If your answer starts with "we'd have to reconstruct that from application logs," you already have a finding.
The identity data model that actually holds up
The pattern that works is boring, which is why it works. Every agent gets its own identity, the same way every employee does. Treat it like a badge.
At minimum you want four things wired together:
- Principals. Each agent is a distinct principal with a stable ID, an owner, a lifecycle, and a revocation path. No shared secrets. No copies. If you spin up three instances of the same agent, they get three IDs.
- Scopes. Every principal carries a narrow set of allowed actions and data domains. The reconciliation agent cannot open a ticket in the KYC system. The KYC agent cannot post journal entries. Least privilege, enforced at the token, not in a policy PDF.
- Action logs. Every call the agent makes is logged with the principal ID, the human it was acting for, the input, the output, and the tool invoked. Immutable, queryable, retained on your DORA schedule.
- Human approvers. Any action above a materiality threshold routes to a named human, and that approval is bound to the log entry. Not a Slack thumbs-up. A signed decision tied to the trace.
The teams doing this well treat the agent identity registry as a first-class system, sitting next to IAM and the model registry. Not a spreadsheet. Not a tag on a Kubernetes pod.
Migrating a bank that's already in production
If you already have agents live, you don't get to start over. The migration path most operators are landing on looks roughly like this:
- Inventory. List every agent, every service account it uses, every tool it can call, and every human who owns it. You will find agents nobody remembers deploying. That's the point.
- Freeze scope. Cap what existing agents can do at their current behaviour. No new tools, no new data domains, until they have their own identity.
- Issue badges. Mint per-agent principals in your IAM. Rotate the shared service accounts out one agent at a time, starting with the highest-materiality flows.
- Wire the log. Route every agent action through a broker that stamps principal, scope, human, and trace ID. Feed it into the same SIEM your auditors already trust.
- Retire the shared accounts. Only when the last agent has moved off. Then you delete them, and you don't recreate them.
This takes a quarter, maybe two, at a mid-market bank. It is not glamorous work.
The cost of doing nothing
Around 95% of enterprise AI projects fail to reach production or ROI. The ones that do reach production and then get pulled back are a different category of failure, and they're the ones I expect to dominate 2026 headlines in financial services. A regulator finding, a customer harm event, a public incident, and the whole agent programme goes on ice for eighteen months while legal takes the wheel.
The banks that come out of the next two years with working agent estates will be the ones that gave every agent a badge before they had to. The rest will be case studies.