Key takeaways
- Regional and mid-market banks ($2–50B) face identical agent governance questions to the majors — inventory, identity, approvals, evidence — without platform teams to self-build.
- The first agent workflows at this scale are document-heavy evidence work: onboarding and KYC, lending files, reconciliation breaks, complaint responses.
- Proportionate governance = the same six control layers, operated by a control plane plus the bank’s own review committee — not a bespoke platform build.
- The regulators’ expectations do not scale down with assets: evidence quality is the equalizer, and evidence is cheaper to buy than to build.
The squeeze regional banks are in
The signal sweep across regional banking reads the same way quarter after quarter: CIOs and CTOs at $2–50B institutions are openly working through AI strategy — hiring AI leads, running pilots with core vendors, testing agentic features their core provider ships — while their risk and compliance functions carry the same supervisory expectations as the majors, with a fraction of the staff. The mega-banks respond with internal AI platforms and model-risk armies. A regional bank copying that answer buys a cost structure it cannot carry.
The squeeze has three specific shapes:
Pilots arrive faster than governance. Core vendors and fintech partners now embed agentic features by default. The bank’s data is processing through vendor AI before anyone at the bank wrote an agent policy. The governance question arrives as “what is already running?” rather than “what should we run?”
The staffing math never works for self-build. A credible internal agent platform — gateway, registry, approvals, evidence — is a multi-year, multi-team build. Regional banks know this; it is why their AI strategy documents read “explore” and “partner” more often than “build.”
The exam does not curve. FFIEC-style expectations and the SR 26-2 trajectory apply the same evidence demands at proportionate depth: what AI is running, who owns it, how decisions are explained, what the third-party contracts say, and whether the bank can show what happened on a case.
The proportionate governance answer
The six control layers an examiner or auditor tests are the same at every scale — what changes is who operates them:
| Control layer | Mega-bank answer | Regional-bank answer |
|---|---|---|
| Inventory | Internal registry, platform team | Registry operated by the control plane, maintained by vendor management + risk |
| Identity | Enterprise IdP integration, platform team | Same IdP integration, configured not coded |
| Policy enforcement | Self-built gateway stack | Policy gateway as a product, rules owned by the bank’s risk function |
| Approvals | Workflow tooling built in-house | Approval gates in the control plane; the bank’s own officers decide |
| Evidence | Internal audit-log platform | Tamper-evident records produced by the workflow, exportable to the bank’s SIEM |
| Stop controls | Platform-run drills | The same drill, run against the control plane’s stop mechanism |
The point of the right-hand column: every control is available as configuration when the governance layer is a product rather than a construction project. The bank’s staff contribute what only they can — the workflow knowledge, the policy decisions, the approvals — and contribute none of what they cannot carry — gateway engineering, evidence infrastructure, registry tooling.
Where to start: the workflows that fit
The best first agent workflows at regional scale share three properties: document-heavy, review-boundaried, and owned. In practice:
- Commercial onboarding and KYC. The agent assembles the evidence file — entity documents, screening results, beneficial-ownership checks — and the analyst decides. Every file carries its own evidence trail. This is also the workflow examiners understand best, which makes it the gentlest governance introduction.
- Lending file assembly. Spreads, financials, exceptions, covenants — collected and checked, with the credit officer deciding. The adverse-action and credit-memo trails get better because the agent cites its sources.
- Reconciliation and breaks. The agent investigates the break, proposes the resolution, routes the judgment calls. The break queue is the cost center everyone already wants to fix.
- Complaint and regulatory responses. The agent reconstructs the timeline from the record inside the regulatory clock — the highest-stakes deadline work in the building.
Each starts with a diagnostic: how the workflow runs today, where the exceptions pile up, what the baseline numbers are. The banking workshop is that diagnostic, free, in 90 minutes.
What the evidence buys at exam time
A regional bank that runs governed agents walks into the exam with: the inventory (registry), the policy documentation (the gateway’s rule set, versioned), the decision evidence (replayable runs), and the drill results (stop tests with timestamps). That package answers the AI questions the way strong banks answer any examination question — from the record. It also answers the SR 26-2 RFI before it arrives, which is the entire strategic content of that guidance for a bank below $30B: the scope exclusion is temporary; the evidence expectation is not.
Sources
- Federal Reserve/OCC/FDIC, SR 26-2 (April 2026) — SR 26-2 explained.
- FFIEC examination guidance on third-party risk and IT governance. Accessed October 2026.
- Public regional-bank AI strategy statements and earnings commentary, 2025–2026.
Frequently asked questions
How do regional banks govern AI agents differently from large banks?
Proportionately. Regional banks need the same controls — inventory, identity, approvals, evidence, stop conditions — but operated by a control plane and a small oversight group rather than an internal platform team. The controls are the same; the staffing model is different.
What agent workflows make sense first at a regional bank?
Document-heavy evidence work with clear review boundaries: commercial onboarding and KYC, lending file assembly, reconciliation breaks, and compliance or complaint responses. These have named owners, measurable baselines, and a natural human-decider structure that examiners recognize.
Do regional banks need to build their own AI platform?
No. Building a platform is the mega-bank answer to a mega-bank staffing reality. A regional bank can run governed agents on a control plane deployed in its own cloud — getting identity, policy, approvals and evidence as configuration, with its own staff operating the approvals and review.
Governing Autonomous AI Agents in Production
Moring provides the runtime control layer, identity verification, human-in-the-loop approvals, and audit records needed to deploy production-grade AI agents safely.
About the author
Balaji Nagaraj KumarChief AI Officer, Moring AI, Moring AISweden
Leads platform and delivery engineering at Moring AI, turning each engagement into a substrate the customer’s own team operates at handoff. His background spans developer-platform leadership at Volvo Cars and engineering at CERN. He writes about governance for agents that take actions in production systems.
LinkedIn profile