Sumsub Launches APAC Council to Develop Guidance on AI Agents

Financial services firms are deploying autonomous AI agents to handle customer verification, fraud detection and compliance workflows without waiting for regulators to publish a playbook. Sumsub has responded by convening an APAC council to develop practical guidance on how these agents should behave when they make decisions that affect account access, transaction limits and identity trust scores.

The council will bring together compliance officers, risk managers and technologists from across the Asia-Pacific region to document what good looks like when an AI agent rejects a customer onboarding application or flags a transaction as suspicious. That matters because most regulatory frameworks still assume a human reviews every high-stakes decision, and the gap between that assumption and operational reality is widening every quarter.

What the council will do

The group's remit is to produce guidance that financial institutions can adopt before their local regulator publishes formal rules. It will focus on three areas: explainability standards for agent decisions, audit trails that satisfy compliance teams, and escalation protocols that define when a human must override the machine.

Sumsub's move reflects a broader pattern in which vendors and industry bodies write the first draft of governance frameworks because waiting for legislation would mean waiting years. The council will draw on case studies from member organisations, which means the guidance will reflect what actually breaks in production rather than what sounds sensible in a policy paper.

Why this matters for L&D and compliance teams

Learning and development leaders in financial services are already fielding questions from compliance officers who need to understand how agentic AI differs from the rules-based automation they have overseen for the past decade. A rules-based system follows a decision tree; an agentic system adapts its behaviour based on patterns it identifies in data, and that adaptability introduces risk that existing training programmes do not address.

The council's guidance will give L&D teams a reference point for building capability in three areas. First, compliance staff need to know how to audit an agent's decision log and identify when the agent has drifted from its intended behaviour. Second, risk managers need to understand how to set guardrails that prevent an agent from making decisions outside its competence. Third, customer service teams need to explain agent decisions to customers in plain language, which requires a working mental model of how the agent weighs evidence.

Organisations that wait for their regulator to mandate training will find themselves behind peers who have already upskilled their compliance and risk functions. The council's output will not carry legal force, but it will establish a de facto standard that auditors and regulators will reference when they assess whether a firm has exercised reasonable care in deploying agentic AI.

The capability gap

Most compliance teams can explain how a credit scoring model works because those models have been in use for decades and their logic is transparent. Agentic AI is different because the agent's decision-making process is emergent rather than programmed, and that emergent quality makes it harder to predict how the agent will behave when it encounters an edge case.

The council's guidance will need to address that predictability gap by defining what documentation and testing an organisation must complete before it grants an agent the authority to make binding decisions. It will also need to specify how often an organisation must review an agent's performance and what triggers should prompt a pause or rollback.

For L&D leaders, this creates an opportunity to position their teams as the function that builds organisational fluency in agentic AI before it becomes a compliance crisis. That means designing learning experiences that go beyond conceptual overviews and give compliance officers hands-on practice in interrogating agent behaviour, interpreting decision logs and calibrating guardrails.

What comes next

The council's first deliverable will likely be a set of principles rather than a detailed rulebook, because the technology is still evolving and overly prescriptive guidance would become obsolete quickly. Those principles will establish expectations around transparency, accountability and human oversight, and they will give organisations a framework for making defensible decisions about where to deploy agents and where to insist on human review.

Financial services firms that participate in the council will gain early access to that framework and the ability to shape it based on their own deployment experience. Firms that sit out the process will still need to meet the standard the council establishes, but they will do so without the context that comes from contributing to its development.

For learning and development leaders, the immediate task is to identify which roles in the organisation need to understand agentic AI and to what depth. Compliance officers need a different level of fluency than customer service representatives, and both need a different level than the data scientists who build and maintain the agents. The council's guidance will help clarify those distinctions, but organisations that wait for the final document before they start building capability will lose six to twelve months they cannot afford to lose.

Sources:

• Fintech News Singapore