Taiwan's Financial Supervisory Commission released a consultation document on the secure use of agentic AI by financial institutions on 13 October 2026. The paper is open for comment for 30 days through the Join Talk section of the government public policy participation platform and through the Commission's public mailbox. It is a consultation step rather than a binding instrument, and the Commission has said the responses will feed later policy, guidance and supervisory dialogue.
The paper states that it does not replace existing law, supervisory rules, outsourcing management requirements or internal control obligations, and that it sits alongside them. Its security chapter applies zero trust principles and draws on international security standards. The Commission describes agentic AI as systems that plan steps, call tools and reach data across systems, separating them from chat style models that mainly generate replies.
Banks, insurers and securities firms supervised by the Commission are asked to grade each agentic AI use case on three axes: the sensitivity of the data reached, the impact of the actions the system can take, and capability boundaries together with the scope for spread. The highest score on any one axis sets the overall rating. That rating governs approval thresholds, whether a pilot or a full launch is permitted, the depth of controls, and the supervision and audit applied, and it is reassessed over the life of the deployment.
The Commission has asked respondents not to argue for particular models, products, vendors or single technical architectures, and to address applicable use cases, risk levels, practical limits, alternatives, maturity, resource needs, integration with existing systems and verifiable control effects. The comment period runs for 30 days from 13 October 2026. Questions go to the Commission's Information Service Department.
Licentium advises banks, insurers, payment firms and technology vendors on AI governance and financial services supervision in Asia Pacific and Europe. Work we undertake includes AI use case risk classification, control design against supervisory expectations, outsourcing and vendor contract review, and drafting consultation responses.