Your trading agent’s biggest risk is the wallet you gave it. An agent that signs its own transactions holds credentials, acts at machine speed and has no legal identity of its own.
Every obligation it triggers lands on your firm and on the person who approved the design. Most teams govern that with a system prompt and a hope that nobody asks.
This guide gives you the four things a technical leader actually needs: the deadlines now in your calendar, where the exposure really sits, the architecture that contains it, and the three steps that make your agents audit-ready. Read it before your next model upgrade, because that upgrade is a new trading strategy, whether you logged it or not.
TL;DR: What a CTO Needs to Decide
- Autonomy is a permissions problem. Auditors ask what your agent can reach, what it did, and on whose authority.
- A prompt is not a control. Policy belongs in the signing path, where the model cannot negotiate with it.
- Every prompt edit and model upgrade creates a new trading strategy. ESMA expects each one to be versioned, testable and reconstructable.
- The FCA gateway opens on 30 September 2026 and closes on 28 February 2027. Applications ask what your systems and controls actually do.
- The EU deferred its heaviest AI obligations until December 2027, but transparency duties took effect on 2 August 2026. The requirements did not change, only the deadline.
- If you cannot replay any trade from last week within an hour, that is your ceiling on autonomy, not your model’s accuracy.
Why AI Agents in DeFi Are a Permissions Problem, Not a Model Problem
Ask what the agent can reach. Three different things get called an agent, and only one of them changes your risk:
Only the third moves execution authority away from a person. That is where governance stops being a policy document and becomes an engineering requirement.
It also helps to stop treating autonomy as a single setting. Split it into four: strategy formation, order parameterisation, execution authority and key custody.
Some products sold as autonomous only move the first two dials, and the marketing rarely specifies which ones. Research into DeFi investment agents found the same gap in a cohort of projects whose peak valuations passed three billion dollars. Claimed autonomy consistently outran actual autonomy.
Before you inherit a vendor’s assumptions, find out where the keys sit.
If agents are spreading beyond the trading desk, the CTO’s guide to agentic AI risk and governance asks the same permissions question across the wider estate.
The UK Deadline Most Crypto CTOs Have Not Put in the Calendar
If you serve UK customers, your clock started before the EU’s did.
Parliament made the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 on 4 February 2026. Dealing, arranging, custody, stablecoin issuance and staking arrangements now sit inside the FSMA perimeter.
The FCA published its final rules for the new cryptoasset regime on 30 June 2026. The authorisation gateway opens on 30 September 2026, applications close on 28 February 2027, and the regime applies from 25 October 2027.
Two points matter for engineering leaders.
- Scope follows substance. Automation, decentralisation and blockchain architecture do not, by themselves, put an activity outside the perimeter. An agent-driven workflow is assessed on what it does and not on how it is built.
- The application itself asks about systems and controls. If your agent stack has no policy layer and no evidence trail, that becomes a written answer sitting in front of a supervisor who is already deciding whether to authorise you.
What the EU Changed in 2026, and What It Did Not
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and came into force on 27 July.
- Annex III standalone high-risk obligations move from 2 August 2026 to 2 December 2027.
- Annex I embedded systems move to 2 August 2028.
- Article 50 transparency and labelling duties apply as originally scheduled, from 2 August 2026.
- The Article 4 AI literacy duty was untouched.
Read that as a resourcing change. Risk management, data governance, documentation, record-keeping, human oversight, accuracy and cybersecurity requirements all survived intact. The deferral buys you room to build evidence infrastructure properly.
The ESMA Line That Turns Compliance Into an Engineering Spec
ESMA published a supervisory briefing on algorithmic trading on 26 February 2026, covering pre-trade controls, outsourcing, stress testing and the growing use of AI in trading workflows.
The briefing says an algorithmic trading strategy must be distinguishable, testable and identifiable, so that it can be scrutinised. It also says the definition should be read broadly.
Translate that into your backlog. Every strategy needs a version. Every version needs a test harness. Every execution needs a record that can be replayed against the market state it saw.
A prompt edit produces different behaviour. So does a model upgrade. Both create a new strategy. Most teams ship them as configuration changes with no approval trail.
Responsibility does not move either. Where an algorithm comes from outside the authorised perimeter, the authorised firm stays responsible. Providers of direct electronic access carry responsibility for their clients’ compliance, too. Outsourcing the model never outsources the obligation.
DORA Turns Your Model Vendor Into a Third-Party Risk
DORA has applied since January 2025, and it classifies your model supplier as an ICT third-party service provider. Contractual terms, concentration risk, exit planning, and incident reporting all follow from that classification.
Most trading loops run on one inference provider, in one region, behind one endpoint, and few teams have measured what happens when it stops answering mid-position. A Bank of England and FCA survey found third-party implementations now account for a third of all AI use cases, up from 17% in 2022.
Supervisors already suspect the understanding gap is real. The same survey found that 46% of responding firms had only a partial understanding of the AI they use, largely because of third-party models, while 84% reported having an accountable person for their AI framework. Somebody is signing for systems the firm cannot fully explain.
Where the US Sits Right Now
The Digital Asset Market Clarity Act passed the House in July 2025 and cleared the Senate Banking Committee in May 2026, but it is not law. The SEC and CFTC have kept moving through classification and rulemaking instead.
For a firm touching both markets, the FCA and EU requirements are the binding constraints. Build to those, document once, and you will not be rebuilding your evidence layer when a US statute finally lands.
Six Risks You Sign Off On When an Agent Trades
- Non-Attributable Decisions. Two runs of the same prompt produce different orders, and nothing records which reasoning path was executed. You cannot explain that order, at that size, at that moment.
- Market Abuse by Emergence. Wash trading, spoofing and layering are prohibited by effect, whoever or whatever executed them. Rules built around human intent sit awkwardly on systems that have none.
- Sanctions Exposure in the Transaction Path. Onboarding screening does nothing when the agent routes through a pool whose contract nobody has screened.
- Over-Permissioned Keys. An unrestricted hot wallet turns a poisoned price feed into an exfiltration route.
- Provider Concentration. One vendor, one endpoint, and a fallback nobody has tested under load.
- Silent Strategy Drift. Nobody can say which model version placed last month’s worst trade.
Most of these appear in any multi-step deployment, not just in trading, and deploying multi-step AI systems safely involves containment patterns that extend beyond a market context.
A Reference Architecture for Governed AI Trading Agents
Separate Intent From Execution Authority. The research and strategy components hold no keys. They emit a trade intent, and a separate policy service approves or rejects it against explicit rules. Only an approved intent reaches the signer. Retrofitting that boundary onto a live agent means re-testing every strategy running through it, which is why agentic AI development should start at the policy boundary rather than the model.
Enforce Policy at the Signer. Use threshold signing or MPC with scoped session keys. Apply contract and asset allowlists, per-transaction and rolling spend caps, slippage and notional bounds, and mandatory simulation before submission. This is the same discipline that DevSecOps teams apply to secrets and pipeline policy. Controls in a prompt can be talked around. Controls in the signing path cannot.
Treat the Evidence Layer as a Product Feature. Persist the model and prompt version, the tool call sequence, the market snapshot the decision consumed, the policy decision and its inputs, the signed payload and the on-chain result. Make it tamper-evident. Make it queryable by a compliance officer with no engineer in the loop. A reconstruction should answer four questions from stored data alone: which strategy version ran, what the agent saw, which rule approved it, and what was signed.
Design Oversight That Survives Machine Speed. Tier autonomy by notional value, novelty and venue. Auto-approve small trades on allowlisted venues, require dual control above a threshold, and hold anything touching a new asset or venue for human sign-off. Oversight that requires approving every order is theatre, and someone will switch it off within a fortnight.
Test the Kill Switch Like a Disaster Recovery Drill. Stopping a container does not stop a live approval. Revocation means rotating session keys, cancelling standing approvals and following a rehearsed drain path. Rehearse it quarterly. A revocation path nobody has run is not a control but a diagram.
Getting AI Trading Agents Audit-Ready in Three Steps
Each step produces an artefact because a supervisor cannot read intentions.
- Inventory. Build an agent register: every key each agent holds, every contract it may call, every data source it consumes, every credential it inherits, and one named owner per agent.
- Interrupt. Put the policy service in the path and cut the direct route from model to key. The artefact is a written rule set plus a rejection log, which proves the control fires rather than merely existing.
- Rehearse. Pick a trade from last week at random and reconstruct it end to end. Record how long it took.
That number is the one to take to your board. Until any trade can be reconstructed quickly, every argument about widening autonomy is an argument about how much you are willing to be unable to explain.
Terraform, Pipelines, and 200% More Transaction Capacity
A leading cryptocurrency exchange came to Deployflow with a Google Cloud platform that would not scale and could not be changed safely. The rebuild moved every environment into Terraform and every change through a reviewed pipeline.
- 35% faster deployments
- 40% fewer manual tasks
- 200% more transaction capacity
- Delivered under production trading load, on a platform holding customer funds
Deployflow is ISO 27001 and Cyber Essentials certified, which is the control baseline an authorisation reviewer already recognises.
Why that matters for agents: infrastructure as code and reviewed pipelines are what make an agent’s permissions provable rather than remembered. A policy service you cannot version will not survive an authorisation review, no matter how good the model is.
Find Out What Your Agents Can Actually Reach
The FCA gateway opens on 30 September 2026. Applying with an agent stack you cannot document means answering those questions in front of a supervisor instead of your own team.
Start with a free consult. Discovery and workflow analysis run for two to three weeks and map where execution actually happens across your pipelines and infrastructure, which is the same map an authorisation review asks for.
Most teams find that the map alone changes the conversation. It is hard to argue about how much autonomy to grant once everyone can see what has already been granted.
Governed AI Agents in DeFi: Frequently Asked Questions
What is the difference between an MEV bot and an AI trading agent?
An MEV bot executes a fixed strategy at speed while an AI agent decides what the strategy should be.
MEV bots scan the mempool for a known pattern, such as a sandwich or a liquidation, and race to capture it. The logic is deterministic and readable, so you can audit it line by line.
An AI agent forms a view from unstructured inputs and chooses its own actions, which means its behaviour cannot be read off the code. That difference is why agents need a policy layer and an evidence trail, and bots usually do not.
How much does it cost to build a governed AI trading agent?
Cost is driven by the control surface. Inference is not the expensive part. The budget goes on the policy service, the signing infrastructure, the evidence store and the testing harness that proves a strategy behaves as documented.
Two factors move the number most: whether you already hold an authorisation that sets a control standard, and whether custody is self-managed or delegated to a provider. Retrofitting controls onto a running agent typically costs several times as much as building them alongside it, because you also pay for migration and downtime.
Does ISO/IEC 42001 certification help with AI agent compliance?
Yes, as evidence rather than as a substitute for legal compliance.
ISO/IEC 42001 is the management system standard for AI, and it is certifiable, which makes it useful in supplier due diligence and authorisation conversations. Alongside the NIST AI Risk Management Framework, it gives you a documented structure for risk assessment, roles, monitoring and continual improvement. It does not discharge any statutory duty under the AI Act, MiFID II or an FCA permission. Treat it as scaffolding that makes those duties easier to meet and easier to demonstrate.
Can regulators detect market manipulation carried out by AI trading agents?
Increasingly, yes. Public chains give supervisors and analytics firms a permanent transaction record, which provides more visibility than they have in many traditional venues.
The FCA finalised a market abuse regime for cryptoassets in June 2026, and trading venues run their own surveillance. Detection tends to start with on-chain pattern analysis and end with attribution to a wallet, then to an operator. Because prohibited behaviours are defined by effect rather than by who executed them, “the model decided” is not a defence. Your own surveillance should find these patterns first.
What team do you need to run autonomous trading agents in production?
Four capabilities, which can sit across fewer people. You need platform engineering for the pipeline and the signing infrastructure, security engineering for key management and prompt injection defence, a quantitative or strategy owner accountable for what the agent trades, and a compliance contact who can read the evidence trail unaided.
The failure pattern is a strong model team with nobody owning the signing path. Name a single accountable person for agent behaviour early, because your regulator will ask who that is.
Who is liable when an autonomous agent breaches a rule?
The operating firm, without exception.
An agent has no legal personality, so it cannot hold an obligation or be sanctioned.
Liability attaches to the authorised entity and, under the Senior Managers regime, to a named individual within it. Contractual terms with a model vendor may shift some commercial costs, but they do not move regulatory responsibility. Name that individual before the agent goes live, not during the incident.
Explore our BLOG
Recent articles
Governed AI Agents in DeFi: How to Trade Autonomously Without Betting the Firm
Your trading agent’s biggest risk is the wallet you gave it. An agent that signs...
read full article
Best AI Agent for Business Efficiency: A CTO’s Guide to Real ROI
Operational efficiency is under pressure from every angle. Costs remain high, delivery expectations keep rising,...
read full article
Is Claude Down? Anthropic Outage: Protect Your Cloud Infrastructure
Claude.ai has spent 2026 fighting its own success. Twenty-one incidents landed between 12 August and...
read full article