Bank of England's Breeden Signals New Rules to Govern Agentic AI in UK Financial Markets

On 30 June 2026, Bank of England Deputy Governor Sarah Breeden delivered a speech at the European Central Bank Sintra Forum that most financial journalists summarised in a single headline: "BoE warns AI could destabilise markets." Fair enough. But if you are a Chief Risk Officer, a trading desk head, or a FinTech compliance lead, that headline tells you almost nothing useful.

What Breeden actually said - in a speech titled "Agents of Change" - is considerably more specific, and considerably more urgent. She stated, plainly, that relying on human oversight as the primary defence against AI-driven systemic instability is no longer realistic. That is not a theoretical observation. It invalidates the foundational assumption of almost every AI governance framework currently in use across UK financial services.

Right, let's get into what this actually means for firms operating agentic systems today.

Why This Speech Is Different

The FCA and PRA have been talking about AI regulation for years. The usual pattern: principles-based guidance, technology-neutral frameworks, outcomes-focused supervision. All of it premised on a human being somewhere in the loop, capable of intervening when things go wrong.

Agentic AI breaks that model entirely.

We are not talking about chatbots or AI-assisted research tools. Agentic systems - the kind being deployed across trading desks, payments infrastructure, and algorithmic underwriting at Lloyd's - can chain together sequences of decisions, call external APIs, and execute transactions without waiting for human sign-off. They reason through problems and act. At machine speed. Thousands of decisions per second.

A human-in-the-loop requirement, applied to a system executing ten thousand trades per hour, is not a governance mechanism. It is theatre. Breeden said this explicitly, and in doing so, she put every compliance team in the UK on notice: the frameworks you built your AI governance around are inadequate for what you are actually deploying.

The choice of venue matters too. Sintra is not a domestic UK event. Delivering this at the ECB Forum signals international regulatory coordination - the Bank of England, the BIS, and the Bundesbank are all examining the same systemic vulnerabilities. This is not a UK-only problem, and the regulatory response will not be UK-only either.

The Herding Problem: Why AI Makes Crashes Faster and Harder

Here is the core systemic risk Breeden identified, and it is worth understanding the mechanics before we get to the governance response.

Most major UK financial institutions build their AI systems on a small number of foundational models - the large language models and training pipelines produced by a handful of technology providers. When competing institutions fine-tune similar base models using similar financial datasets, their autonomous agents tend to develop similar strategies.

That is fine during normal market conditions. It becomes catastrophic during stress events.

The 2010 Flash Crash and the 2022 UK gilt market crisis both showed how correlated algorithmic strategies can amplify volatility to catastrophic levels. Agentic AI does not eliminate that dynamic. It accelerates it, removes the human pauses that traditionally interrupted the feedback loop, and introduces a new variable: agents responding to the behaviour of other agents rather than underlying fundamentals.

Reflexive instability. Machine speed. No natural stopping point.

That is the problem Breeden is trying to solve.

Why Existing Frameworks Cannot Handle This

There are three structural gaps worth understanding.

The FCA's principles-based approach was designed for supervised models. It works on the assumption that a human decision-maker is accountable for each significant outcome, and that outcomes-based regulation can hold that person responsible. When an autonomous agent generates its own strategy and executes it independently - with no human in the decision loop at the point of action - the accountability architecture collapses. Who is responsible for the 847th trade in an automated sequence? The principles do not have a clean answer.

The PRA's operational resilience framework under PS21/3 addresses system downtime and cyber outages. Impact tolerances, important business services, recovery time objectives. Solid framework for infrastructure failures. Completely silent on autonomous misbehaviour. An agentic system can be perfectly online - green status across all monitoring dashboards - while executing commercially destructive decisions based on hallucinated market signals. PS21/3 does not categorise that as a resilience failure. It should.

UK Market Abuse Regulation requires proving intent or explicit coordination to pursue enforcement. Agentic systems introduce tacit collusion: two independent AI systems, trained on similar data, can independently discover that coordinating pricing or liquidity strategies maximises their mutual reward - without ever communicating, without any human awareness. Traditional MAR enforcement cannot touch this. The OECD has a definition for it; UK regulators do not yet have the legal tools to prosecute it.

Quick question: does this mean your current AI governance documentation is worthless? No. It means it is incomplete. Most firms have done reasonable work on AI risk registers, model risk frameworks, and SMCR accountability mapping. The gap is the agentic-specific layer - kill switches, semantic circuit breakers, and autonomy classification.

Kill Switches: What They Actually Need to Look Like

Breeden specifically referenced kill switches and bare-metal recovery. Let us be precise about what those mean, because "kill switch" is being used very loosely in the press coverage.

There are two distinct concepts here. A firm-level kill switch halts all autonomous AI activity across a single institution - triggered by the Chief Risk Officer or the designated SMF4 holder. A market-wide kill switch pauses all algorithmically tagged order flow across exchanges simultaneously, triggered by the Bank of England or FCA in a systemic event.

Existing exchange circuit breakers - the LSE's automatic trading halts on extreme price movements - are not the same thing. They pause all trading. An AI-specific circuit breaker would need to selectively target autonomous agent activity while preserving human-directed trading. That is a significantly more complex technical problem.

For firms building compliant internal architecture, the key insight from Breeden's speech is the bare-metal recovery requirement. She questioned whether UK financial institutions can actually rebuild compromised core systems from scratch - reinstalling operating systems and applications from pristine infrastructure, bypassing any corrupted AI states or poisoned datasets. That is a much higher bar than "restore from backup." It is inspired, directly, by the National Bank of Ukraine's Power Banking initiative during the 2022 infrastructure attacks - shared interoperable recovery networks between competing institutions.

The governance architecture that regulators are moving toward looks something like this:

The critical point about the deterministic gate is that it must sit completely outside the agent's reasoning loop. Relying on the AI to self-monitor its own safety parameters - through meta-prompts or internal guardrails - is both computationally expensive and unreliable under adversarial conditions. Hard-coded, immutable limits that the agent cannot override. That is the architecture regulators want to see.

SMCR Accountability: The Personal Liability Problem

Here is where it gets uncomfortable for senior managers specifically.

The FCA has confirmed there will be no new dedicated Senior Management Function for AI. Liability distributes across existing functions. SMF24 (Chief Operations Function) owns the structural integrity of technology systems. SMF4 (Chief Risk Function) owns model risk, data quality, and exposure limits. SMF16 (Compliance Oversight) must demonstrate alignment with Consumer Duty and AML rules.

But here is the sharp edge: any senior manager who authorises deployment of an agentic system within their business unit retains ultimate accountability for the customer outcomes that system generates. COCON 3.1 requires reasonable steps to prevent regulatory breaches. If you sign off on an agentic deployment without a comprehensive pre-deployment evidence pack - failure mode inventory, stress testing against regulatory edge cases, residual risk statement - you are exposed.

The FCA is explicit: "The algorithm did it" is not a defence. It has never been accepted, and it will not be accepted for agentic systems.

What does a defensible pre-deployment evidence pack look like? At minimum: documented failure modes for the specific agentic system, stress testing against the market scenarios most likely to trigger correlated herding, a classification of the system on the autonomy spectrum (assistive, algorithmic, agentic, or autonomous swarm), and a named senior manager who has read and signed off on the residual risk.

The Regulatory Timeline: What Is Coming and When

Breeden's speech is a signal, not a rule. The actual regulatory instruments will follow over the next two years.

The Cyber Security and Resilience Bill is worth flagging separately. It is not purely an AI regulation, but its extension of NIS Regulations to managed service providers and data centre operators directly affects how AI infrastructure is governed. The 24-hour incident reporting requirement - including near-miss events - means you can no longer manage agentic anomalies internally. Any failure threatening operational continuity must reach the regulator within a day, backed by penalties of up to £17 million or 4% of global turnover for serious breaches.

Thing is, the FCA's Supercharged Sandbox - launched in October 2025 in collaboration with Nvidia - is genuinely useful here. Firms that engage with the sandbox get GPU-enabled compute for testing complex AI deployments under regulatory observation. It is the fastest way to understand where your systems sit relative to emerging supervisory expectations.

What You Should Be Doing Now

The rules are not final. The consultation papers have not landed. But waiting for the policy statements before doing anything is the wrong call - the BoE Discussion Paper expected in Q3 2026 will set the direction, and firms that can demonstrate proactive governance will be in a materially better position during subsequent supervisory scrutiny.

Three things are worth prioritising immediately.

First, classify every agentic system you operate against an autonomy framework. Low autonomy (human authorisation required for all external actions), medium (human sets parameters; AI executes deterministically), high (human-on-the-loop; circuit breakers required), critical (human-out-of-the-loop; mandatory pre-authorisation). Systems in the high and critical categories are what regulators will focus on first.

Second, test your kill switch architecture. Not in theory - actually trigger it in a controlled environment and measure the response time. If you cannot halt your agentic system's market-facing activity in under a second, you have an architecture problem that needs fixing before the policy statement lands.

Third, assign named SMCR accountability for every agentic deployment. Not "the AI governance committee" - a named individual with documented understanding of what the system does, what its failure modes are, and what the firm's intervention protocol looks like.

The Breeden speech was unusual in its specificity. She described the problem architecture precisely, signalled the regulatory direction clearly, and named the safeguards she expects to see. That level of clarity from a BoE Deputy Governor is the system giving you a running start.

Use it.