Financial institutions have spent years writing AI governance policies, but few have figured out how to actually enforce them in production systems. The Financial Industry Regulatory Authority (FINOS) is changing that equation by shifting from abstract principles to executable code, marking a fundamental transition in how the industry approaches AI oversight.

Why Are Banks Struggling to Implement AI Governance?

The challenge facing financial services isn't a lack of rules. Banks and financial firms operate under overlapping regulatory frameworks including the EU AI Act, UK Financial Conduct Authority expectations, model risk management requirements, data protection obligations, and cybersecurity standards. The real problem is translating these high-level mandates into concrete technical decisions.

Consider a bank deploying an automated loan approval system. Regulators require the institution to identify risks, implement controls, document decisions, and maintain audit trails. But the regulations don't specify which architectural patterns to use, where controls should sit in the system, or how to monitor them in production. Every institution ends up solving this puzzle independently, duplicating effort and creating inconsistent interpretations across the industry.

This "last-mile problem" is where governance breaks down. High-level policies must be translated into technical requirements. Technical requirements must map to architectures. Architectures must connect to controls, workflows, evaluations, and runtime evidence. Without a shared implementation model, governance processes struggle to keep pace with the speed of AI development.

How Is FINOS Turning Governance Into Working Software?

At the Open Source Finance Forum in London, FINOS announced the FINOS AI Fund, a member-led initiative designed to mutualize investment in shared AI challenges across financial services. The Fund's founding members include DTCC, Morgan Stanley, NatWest, and RBC, who serve on its Governing Board to set strategic priorities and direct investment.

The Fund's strategy focuses on three core objectives:

• Harmonize governance: Create concrete technical standards for AI governance across the financial services industry.
• Enable agentic workflows: Build industry-wide specifications that allow AI agents to work both within individual firms and across organizational boundaries.
• Drive adoption: Bring together a critical mass of financial services AI leaders to validate and implement these standards.

To demonstrate how this works in practice, NatWest and FINOS produced a "Steel Thread" proof of concept: a live, end-to-end demonstration showing how open-source standards chain together into a complete governance-as-code pipeline.

Rather than using a simple example, the team modeled a real-world financial services use case: automated loan approval. They mapped industry design patterns and AI governance controls directly into a solution architecture that demonstrates how abstract policy becomes functional software.

What Does Governance-as-Code Actually Look Like?

The Steel Thread demonstration showed how multiple open-source tools work together to create an auditable, observable AI system. The workflow orchestrates data extraction, fraud detection, compliance reviews, and credit risk scoring agents. If an agent flags a high AI risk score or produces low-confidence output, the system automatically routes the decision to a human reviewer before approval. Low-risk applications are auto-approved without human intervention.

Every workflow execution generates a transparent decision trail that compliance and audit teams can inspect. The system tracks operational metrics in real time, monitoring success ratios, API response latency, and token consumption down to individual tasks and agents. This level of granular observability answers questions that regulators increasingly ask: How much does an agent cost per decision? What evidence exists that the system made the right choice? Where did the decision process break down ?

"Demonstrating a working, observable engineering pipeline makes the case for enterprise AI governance a far easier sell to stakeholders," noted James McLeod, from NatWest Group.

James McLeod, NatWest Group

The technical foundation relies on several open-source projects working in concert. CALM (Common Architecture Language Model) codifies architecture definitions into machine-readable specifications for automated policy checking. Common Cloud Controls (CCC) validate infrastructure services like secure document storage. Fluxnova structures agentic tasks and business logic into executable workflows. Grafana collects operational data and cost information.

Steps to Implement Governance-as-Code in Your Organization

Financial institutions looking to adopt this approach should follow a structured path:

• Map your use cases: Start with a specific AI application like loan approval or fraud detection. Document the risks, required controls, and regulatory obligations that apply to that use case.
• Codify your architecture: Use tools like CALM to translate your system design into machine-readable specifications that can be automatically validated against policy requirements.
• Instrument your workflows: Implement observability from the start. Track token usage, latency, success rates, and decision confidence scores so you have evidence of how the system performed.
• Build human-in-the-loop safeguards: Design your agents to automatically escalate high-risk decisions to human reviewers rather than making autonomous decisions on borderline cases.
• Create audit trails: Ensure every decision generates a transparent record that compliance teams can inspect, including what data the agent considered and why it reached its conclusion.

The FINOS AI Governance Framework provides the connective tissue between these technical components. It maps AI use cases to risks, mitigations, regulations, reference architectures, and operational practices. Its catalog already includes mappings to frameworks such as the EU AI Act, NIST, OWASP, and ISO 42001.

What Happens Next for Financial Services AI?

The Steel Thread is a proof of concept, but FINOS plans to expand the underlying specifications in the second half of 2026. The community will validate these standards through additional use cases and work to make them easier for institutions to adopt.

The broader shift reflects a maturation in how the financial services industry approaches AI. Rather than treating governance as a compliance checkbox, institutions are beginning to see it as a technical architecture problem that requires shared standards, open-source tooling, and coordinated investment. By moving from principles to executable code, banks can finally answer the question that has eluded them: not just what rules apply to AI, but how to actually enforce them in production systems that auditors can verify and regulators can understand.