DXRG's Response to the FSB's Agentic AI Consultation

On 21 July 2026, DX Research Group submitted a technical response to the Financial Stability Board's consultation on responsible AI adoption in finance. The consultation asks directly whether its practices adequately address agentic AI and invites additional case studies from nonbanks.¹ Our response contributes evidence from DX Terminal Pro: a bounded 21-day deployment of 3,505 user-funded agents operating with real ETH, scoped authority, outside-model policy checks, owner interruption controls, and invocation-level traces.

Evidence boundary. This article summarizes the response DXRG submitted to the FSB. Submission does not imply FSB acceptance, endorsement, or inclusion in its final report. The case study covers one bounded market, one production model family, one action space, and one 21-day period. It does not establish profitability, suitability, regulatory status, universal safety, or transfer to other markets.

The Core Recommendation: Separate Proposal from Authority

For transaction-capable agents, the model should not be the final authority over the action it proposes.

An agent acts through a larger system. The system authenticates a human or institutional principal, compiles a mandate, assembles current market and portfolio state, renders context, invokes a model, parses a typed action, checks that action against policy, submits an approved payload, and reconciles the result. A failure at any one of those stages can become a financial action even when every other stage works as intended.

Our response asks the FSB to make that boundary explicit. The model may propose an action. Deterministic software outside its reasoning path should decide whether the exact venue-ready payload is permitted under current identity, credential, asset, venue, order-type, capital, exposure, loss, price-impact, and data-freshness constraints.

This is the difference between asking a model to follow a rule and enforcing the rule at the point where capital can move. Generated text should not be able to expand permissions, alter a policy version, or disable the systems responsible for monitoring and interruption.

The full process begins with mandate integrity. Natural-language strategy, structured controls, current state, memory, and execution rules need an explicit order of authority. A stale portfolio snapshot, prior reasoning treated as policy, a buried market mechanic, or a malformed action can break the path even when the user instruction and model are individually reasonable. Our mandate-compilation evidence table (CSV) records controlled examples of how that path changes behavior.

What a Transaction-Capable Agent Should Have

The response recommends a concrete minimum control set:

1. A unique agent identity linked to a principal, policy version, and narrowly scoped credential.
2. Least-privilege tools, venues, assets, order types, and account operations.
3. Capital isolation so one agent cannot reach balances outside its approved allocation.
4. A mandate compiler that preserves authenticated intent, structured controls, current state, and memory provenance.
5. Deterministic checks on the final action, including transaction, exposure, concentration, loss, slippage, and message-rate limits.
6. Payload-bound approval for novel, large, irreversible, or out-of-mandate actions.
7. Reconciled traces linking the mandate, state, versions, action, validation result, venue acknowledgement, fill, and portfolio effect.
8. Independent monitoring, credential revocation, cancellation coverage, and a tested kill switch.
9. Recovery that remains halted until exposure is reconciled, the failure is bounded, regression tests pass, and authority is explicitly restored.

These controls are collected in the DXRG Agentic Trading Guardrail Matrix (CSV). The matrix maps twelve controls to evidence requirements, failure signals, enforcement points, and fail-safe responses. It is an evaluation framework, not a certification.

The Nonbank Case Study We Submitted

DX Terminal Pro began in February 2026 and ran for 21 days in a bounded 12-asset onchain market. The system operated 3,505 funded vaults, with one agent per participating wallet. Owners funded and configured the vaults, supplied natural-language strategies, selected five structured behavioral settings, and retained pause, withdrawal of unallocated funds, closure, and emergency-liquidation controls. Agents selected ordinary buy and sell trades.²

The deployment produced:

• 7.5 million agent invocations;
• roughly 300,000 onchain actions;
• about $20 million in transaction volume;
• more than 5,000 ETH deployed;
• roughly 70 billion inference tokens; and
• 99.9% settlement success for policy-valid submitted transactions.

The model produced typed actions. Those actions could not reach submission unless an outside-model policy layer accepted the exact action, and the operator role was contractually scoped. The system linked user configuration, rendered prompt, model response, tool call, validation result, portfolio state, and chain outcome at invocation level.

The operating layer changed measurable outcomes. In a separate internal EVM transaction-construction evaluation, aligned successful construction was 87% for Claude 4, 96% for Claude 4.6, and 99.9% for Claude 4.6 with a Terminal Pro-style harness. In controlled pre-launch tests, moving an unchanged fee statement earlier in the rendered context increased fee citation from 3% to 74%. A compound intervention that demoted prior reasoning from precedent to context reduced fabricated sell rules from 57% to 3% in the affected test population.²

These are not return measures. They show that model choice, mandate compilation, validation, and execution should be evaluated as one operating path while retaining enough detail to identify which stage changed.

Correlated Behavior Without an Agent Communication Channel

Individual action validity is not enough when many agents share infrastructure and observe the same market.

During the bounded event, 1,544 of 3,454 active vaults bought the same asset within one hour. The agents had no shared chat or direct agent-to-agent signalling channel. Common market state, model infrastructure, and prompt structure likely contributed, while settled trades changed the state seen by agents acting later. The study did not isolate a single cause.²

The same market also produced substantial two-sided flow: 92.9% of trades occurred in five-minute asset windows containing both buys and sells. A shared model therefore did not force identical actions, but shared architecture and observations could still concentrate attention locally.

This is why our response recommends monitoring population-level concentration, correlated order flow, message rates, shared model and data dependencies, and the speed at which exposure accumulates. Agent governance must work at both the individual-action and system levels.

Auditability Requires Trace Governance

Transaction-capable agents can produce unusually detailed operational records. That is valuable only when the records remain attributable, protected, and usable.

An invocation-level instruction-to-outcome trace can help determine whether a failure originated in mandate compilation, stale state, model selection, policy enforcement, execution, settlement, or the principal's stated objective. It can support incident reconstruction, sampled replay, regression testing, and comparisons across model and harness versions.

The same record may contain user-authored strategy, portfolio state, model outputs, identifiers, or security-sensitive operational data. Trace systems should therefore collect proportionately, classify sensitive fields, minimize unnecessary content, preserve lineage and version hashes, restrict and audit access, apply purpose-based retention and deletion schedules, and publish only aggregates or appropriately de-identified artifacts.

Supervisors need reconstructable evidence, not indiscriminate retention of every raw internal artifact.

Evidence Should Name the Environment That Produced It

The response also asks the FSB to make evidence labels routine. Simulation, replay, paper, shadow, bounded historical live, and current live observation answer different questions. A strong replay result does not establish settlement reliability. Reliable settlement does not establish decision quality or profitability.

The DXRG Agentic Trading Evidence Ladder defines these environments, and the Agentic Trading Benchmark Card (CSV) provides a common disclosure template. A credible case study should identify the evaluation subject, decision rights, information available at the time, action space, costs, baselines, repeated runs, controls, artifacts, and limitations.

The denominator should also be recoverable. Decision cycles, proposed actions, policy rejections, submitted transactions, venue acknowledgements, settlements, and portfolio outcomes can appear in one operational account without being collapsed into one score.

A Functional Definition of Agentic AI

We suggested defining an agentic AI system by what it does: it operates under a delegated objective, uses current state to select among actions, can change external state through tools or execution systems, and incorporates the result into later decisions.

The glossary should distinguish the model from the agent system. The model produces inferences. The system includes mandate compilation, state assembly, memory, orchestration, permissions, tools, deterministic controls, monitoring, execution, and recovery. Most enforceable control points sit in that surrounding system.

The Public Record Behind the Response

The submission relies on public, inspectable materials:

• Operating-Layer Controls for Onchain Language-Model Agents Under Real Capital, the technical record for DX Terminal Pro;
• DX Terminal Pro, the deployment account and evidence boundaries;
• the Agentic Trading Guardrail Matrix and CSV;
• the Agentic Trading Benchmark Card and CSV;
• the Mandate Compilation Evidence Table and CSV; and
• the Agentic Trading Evidence Ladder.

We are building reusable infrastructure for evaluating, constraining, and eventually deploying market agents under explicit permissions and evidence gates.

The FSB consultation is not a certification process, and submission does not confer regulatory status. Its importance is that the final report can make concrete controls, evidence boundaries, and nonbank operating experience part of the international policy record. We submitted evidence that can be checked, corrected, and reused rather than asking supervisors to accept a capability claim.

Corrections and reproducibility questions can be sent to poof@dxrg.ai.

Footnotes

1. Financial Stability Board, “Sound Practices for Responsible Adoption of Artificial Intelligence: Consultation Report”, 10 June 2026. Responses were due 22 July 2026, and the report requested additional nonbank case studies. ↩

2. Barton, T.J. et al., “Operating-Layer Controls for Onchain Language-Model Agents Under Real Capital”, arXiv:2604.26091, 28 April 2026. ↩ ↩² ↩³