DXRG's Response to the FSB's Agentic AI Consultation

On 21 July 2026, DX Research Group submitted a technical response to the Financial Stability Board's consultation on responsible AI adoption in finance. The consultation asks directly whether its practices adequately address agentic AI and invites additional case studies from nonbanks.¹ The response we submitted contributes evidence from DX Terminal Pro: a bounded 21-day deployment of 3,505 user-funded agents operating with real ETH, scoped authority, outside-model policy checks, owner interruption controls, and invocation-level traces.

Evidence boundary: This article summarizes the response DXRG submitted to the FSB, and submission does not imply FSB acceptance, endorsement, or inclusion in its final report. The case study covers one bounded market, one production model family, one action space, and one 21-day period. Profitability, suitability, regulatory status, universal safety, and transfer to other markets remain outside what this evidence establishes.

The Core Recommendation: Separate Proposal from Authority

For transaction-capable agents, final authority over the action should sit outside the model that proposes it.

An agent acts through a larger system. The system authenticates a human or institutional principal, compiles a mandate, assembles current market and portfolio state, and renders context. It then invokes a model, parses a typed action, checks that action against policy, submits an approved payload, and reconciles the result. A failure at any one of those stages can become a financial action even when every other stage works as intended.

In our response, we ask the FSB to make that boundary explicit. The model may propose an action. Deterministic software outside its reasoning path should decide whether the exact venue-ready payload is permitted under current identity, credential, asset, venue, and order-type constraints. The same decision covers capital, exposure, loss, price-impact, and data-freshness constraints.

This is the difference between asking a model to follow a rule and enforcing the rule at the point where capital can move. Generated text should lack any path to expand permissions, alter a policy version, or disable the systems responsible for monitoring and interruption.

The full process begins with mandate integrity. Natural-language strategy, structured controls, current state, memory, and execution rules need an explicit order of authority. A stale portfolio snapshot, prior reasoning treated as policy, a buried market mechanic, or a malformed action can break the path even when the user instruction and model are individually reasonable. The controlled examples in our mandate-compilation evidence table (CSV) record how that path changes behavior.

What a Transaction-Capable Agent Should Have

The response recommends a concrete minimum control set. The first group secures identity, scope, and mandate integrity:

1. A unique agent identity linked to a principal, policy version, and narrowly scoped credential.
2. Least-privilege tools, venues, assets, order types, and account operations.
3. Capital isolation that keeps one agent from reaching balances outside its approved allocation.
4. A mandate compiler that preserves authenticated intent, structured controls, current state, and memory provenance.

The second group enforces limits at the point of action and supports recovery:

1. Deterministic checks on the final action, including transaction, exposure, concentration, loss, slippage, and message-rate limits.
2. Payload-bound approval for novel, large, irreversible, or out-of-mandate actions.
3. Reconciled traces linking the mandate, state, and versions to the action. The same trace carries the validation result, venue acknowledgement, fill, and portfolio effect.
4. Independent monitoring, credential revocation, cancellation coverage, and a tested kill switch.
5. Recovery that remains halted until exposure is reconciled, the failure is bounded, regression tests pass, and authority is explicitly restored.

These controls are collected in the DXRG Agentic Trading Guardrail Matrix (CSV). The matrix maps twelve controls to evidence requirements, failure signals, enforcement points, and fail-safe responses. It is an evaluation framework rather than a certification.

The Nonbank Case Study We Submitted

DX Terminal Pro began in February 2026 and ran for 21 days in a bounded 12-asset onchain market. The system operated 3,505 funded vaults, with one agent per participating wallet. Owners funded and configured the vaults, supplied natural-language strategies, and selected five structured behavioral settings. They retained pause, withdrawal of unallocated funds, closure, and emergency-liquidation controls, while agents selected ordinary buy and sell trades.²

The deployment produced scale and throughput:

• 7.5 million agent invocations;
• roughly 300,000 onchain actions;
• about $20 million in transaction volume;
• more than 5,000 ETH deployed; and
• roughly 70 billion inference tokens.

Across the deployment, policy-valid submitted transactions recorded 99.9% settlement success.

The model produced typed actions. Those actions reached submission only when an outside-model policy layer accepted the exact action, and the operator role was contractually scoped. The system linked user configuration, rendered prompt, model response, and tool call at invocation level. The same record carried the validation result, portfolio state, and chain outcome.

The surrounding control system changed measurable outcomes. In a separate internal EVM transaction-construction evaluation, aligned successful construction was 87% for Claude 4, 96% for Claude 4.6, and 99.9% for Claude 4.6 with a Terminal Pro-style harness. In controlled pre-launch tests, moving an unchanged fee statement earlier in the rendered context increased fee citation from 3% to 74%. A compound intervention that demoted prior reasoning from precedent to context reduced fabricated sell rules from 57% to 3% in the affected test population.²

These figures measure construction quality and behavioral control rather than returns. They show that model choice, mandate compilation, validation, and execution should be evaluated as one operating path while retaining enough detail to identify which stage changed.

Correlated Behavior Without an Agent Communication Channel

Individual action validity alone falls short when many agents share infrastructure and observe the same market.

During the bounded event, 1,544 of 3,454 active vaults bought the same asset within one hour. The agents had no shared chat or direct agent-to-agent signalling channel. Common market state, model infrastructure, and prompt structure likely contributed, while settled trades changed the state seen by agents acting later. The study stopped short of isolating a single cause.²

The same market also produced substantial two-sided flow: 92.9% of trades occurred in five-minute asset windows containing both buys and sells. A shared model therefore left room for differing actions, yet shared architecture and observations could still concentrate attention locally.

This is why our response recommends monitoring population-level concentration, correlated order flow, message rates, shared model and data dependencies, and the speed at which exposure accumulates. Agent governance must work at both the individual-action and system levels.

Auditability Requires Trace Governance

Transaction-capable agents can produce unusually detailed operational records. That is valuable only when the records remain attributable, protected, and usable.

An invocation-level instruction-to-outcome trace can help determine whether a failure originated in mandate compilation, stale state, model selection, or policy enforcement. It can equally point to execution, settlement, or the principal's stated objective. The same record can support incident reconstruction, sampled replay, regression testing, and comparisons across model and harness versions.

The same record may contain user-authored strategy, portfolio state, model outputs, identifiers, or security-sensitive operational data. Trace systems should therefore collect proportionately, classify sensitive fields, minimize unnecessary content, and preserve lineage and version hashes. They should restrict and audit access, apply purpose-based retention and deletion schedules, and publish only aggregates or appropriately de-identified artifacts.

Supervisors need reconstructable evidence rather than indiscriminate retention of every raw internal artifact.

Evidence Should Name the Environment That Produced It

The response also asks the FSB to make evidence labels routine. Simulation, replay, paper, shadow, bounded historical live, and current live observation answer different questions. A strong replay result stops short of establishing settlement reliability. Reliable settlement, in turn, leaves decision quality and profitability unproven.

The DXRG Agentic Trading Evidence Ladder defines these environments, and the Agentic Trading Benchmark Card (CSV) provides a common disclosure template. A credible case study should identify the evaluation subject, decision rights, information available at the time, and the action space. It should also state costs, baselines, repeated runs, controls, artifacts, and limitations.

The denominator should also be recoverable. Decision cycles, proposed actions, policy rejections, and submitted transactions can appear in one operational account. Venue acknowledgements, settlements, and portfolio outcomes belong in that same account, with each stage identifiable rather than collapsed into one score.

A Functional Definition of Agentic AI

For the glossary, we suggested defining an agentic AI system by what it does: it operates under a delegated objective, uses current state to select among actions, can change external state through tools or execution systems, and incorporates the result into later decisions.

The glossary should distinguish the model from the agent system. The model produces inferences. The system includes mandate compilation, state assembly, memory, orchestration, and permissions. It also includes tools, deterministic controls, monitoring, execution, and recovery. Most enforceable control points sit in that surrounding system.

The Public Record Behind the Response

The submission relies on public, inspectable materials. The technical record:

• the deployment paper on arXiv (arXiv:2604.26091), the technical record for DX Terminal Pro;
• DX Terminal Pro, the deployment account and evidence boundaries.

The evaluation frameworks and evidence tables:

• the Agentic Trading Guardrail Matrix and CSV;
• the Agentic Trading Benchmark Card and CSV;
• the Mandate Compilation Evidence Table and CSV; and
• the Agentic Trading Evidence Ladder.

The infrastructure we are building supports evaluating, constraining, and eventually deploying market agents under explicit permissions and evidence gates.

The FSB consultation is a consultative exercise rather than a certification, and submission confers no regulatory status. Its importance is that the final report can make concrete controls, evidence boundaries, and nonbank operating experience part of the international policy record. The evidence we submitted can be checked, corrected, and reused; we asked for engagement on substance rather than acceptance of a capability claim.

Corrections and reproducibility questions can be sent to poof@dxrg.ai.

Footnotes

1. Financial Stability Board, “Sound Practices for Responsible Adoption of Artificial Intelligence: Consultation Report”, 10 June 2026. Responses were due 22 July 2026, and the report requested additional nonbank case studies. ↩

2. Barton, T.J. et al., “Operating-Layer Controls for Onchain Language-Model Agents Under Real Capital”, arXiv:2604.26091, 28 April 2026. ↩ ↩² ↩³