A new paper argues that banks stacking multiple 'compliant' AI agents can still end up breaking the law together.
The paper proposes ARIA, a governance framework for banks running fleets of AI agents across credit, fraud, collections and compliance. Its central claim: current oversight checks agents one at a time, but a group of individually-approved agents can still add up to an outcome none of them alone would trigger - such as quietly excluding applicants with thin credit files who happen to share subtle data patterns. ARIA lays out six controls, including a population-level monitor that flags when a whole fleet's outcomes drift from what's expected, caps on how much any single agent can decide alone, and a mechanism to contain misbehaving agents in real time. Two simulations back the argument: one shows locally-compliant agents collectively locking out thin-file applicants, the other shows the fleet-level monitor catching a bias drift earlier than agent-by-agent checks would.
This matters because fair-lending law, the EU AI Act, and bank model-risk rules were mostly written with a single model in mind, not a swarm of interacting ones. If regulators keep auditing agents individually, a bank could pass every component-level test and still run a lending system that discriminates in aggregate - a compliance gap with no clear owner. That is a genuinely new failure mode as banks shift from single scoring models to agentic workflows that negotiate, escalate, and hand decisions off to each other.
For now this is a research proposal, not a shipped product - the authors are explicit that they are offering a validation agenda, not proof it works in a live bank.