Your model risk framework does not reach the agent.

What a rule looks like

constants:
  operator_approves_daily_total_above_usd: 3000

state_models:
  user:
    key: "{{ event.entity_id }}"
    buckets:
      # Counted from the terminal event, when the money has actually moved.
      refunded_today:
        type: fixed_window
        window: "24h"
        timezone: "UTC"

rules:
  refund_needs_an_operator_for_the_day:
    all:
      - path: "event.type"
        op: eq
        value: "mcp.input"
      - path: "event.data.tool.name"
        op: eq
        value: "refund_transaction"
      - path: "state.user.buckets.refunded_today"
        op: gte
        value: "{{ constants.operator_approves_daily_total_above_usd }}"
    effects:
      verdict: flagged
      actions:
        - action: hitl/create_case
          params:
            queue: "finance"
            priority: 80
            timeout_duration: "24h"
            timeout_decision: "reject"

A running daily total per customer, a threshold, and a queue with a timeout whose answer is declared in advance. Every individual refund is defensible; the hundredth in a day is not, and no per-call check will ever see it. That is why the rule has to remember.

The regulator hands you the problem and not the method

The same footnote continues: a banking organization's own risk management and governance practices "should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document."

Agentic systems are out of the framework, and you are still answerable for governing them — with something you choose and can defend. The supervisor has named that gap in writing, so you no longer have to argue it exists.

What the letter says about its own force, because your validation team will read the letter and mark down any vendor who left this part out: "This guidance does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism against a banking organization." Its footnote 1 continues: "However, supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk."

The exposure is safety and soundness, not non-compliance with a letter.

On who it reaches. Above $30 billion in total assets. Below that, the models at those organizations are generally excluded: models at those organizations "typically are subject to internal risk management and governance practices appropriate for the size and risk profile of these banking organizations, and generally excluding them from this guidance is consistent with a tailored supervisory approach."

The exception is narrow — "However, in some situations," it may also reach a smaller organization with "significant exposure to model risk because of the prevalence and complexity of their models or because of activities outside the scope of traditional community banking." Read that second clause twice if you are an AI-native lender: it is the one that reaches you, and it reaches you for what you do rather than for what you hold.

On what counts as a model. The definition excludes deterministic rule-based processes and software "where there are no statistical, economic, or financial theories underpinning their design or use". A threshold, a counter and a comparison are outside that definition — so the rules you write here are a control you add, not another model your validation team inherits.

Footnote 3 states the other half: "the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models."

Who is asking, and what you can show them

The boundary your procurement team will ask about: Swiftward enforces and proves the rules you and your AML and KYC vendors define. It is not an AML data vendor and not a KYC provider.

Across the businesses

Payments and transfers — caps, velocity, cooldowns, screening before the money moves. Lending — approval logic and the adverse action notice a declined applicant has a right to. Capital markets — pre-trade validation, position and notional limits, on the order path. Insurance has its own page: claims and underwriting.

Where an AI-native team has no risk tooling, this is the layer you start with. Where a bank already runs AML screening and model risk management, this governs the agent-decision layer those do not reach, and feeds your existing SIEM.

Where it connects

A direct call from your own code before it acts, the tool layer your agent already uses, or an industry protocol like FIX on the order path. Same engine underneath. See gateways.