1. The FINOS AI Fund Creates a Clearer Operating Model

Announced during OSFF London, the FINOS AI Fund is a member-led fund designed to mutualize investment in shared AI challenges across financial services. It provides dedicated funding, strategic direction and project prioritization, supported by a team of subject-matter experts and developers.

The Fund’s founding members—DTCC, Morgan Stanley, NatWest and RBC—serve on its Governing Board, which sets strategic priorities, directs investment and oversees the Fund’s work. Its purpose is not to replace FINOS’s existing AI projects or communities, but to give them a shared direction and a mechanism through which industry priorities can be translated into coordinated technical work.

The current strategy can be summarized through three objectives:

• Harmonize FSI industry AI governance through concrete technical standards
• Build the industry-wide specs needed to enable intra- and inter-firm Agentic workflows
• Catalyze community contributions & drive adoption by bringing together a critical mass of financial services AI leaders

The wider FINOS community helps support these objectives through a number of activities: the AI Readiness Special Interest Group, working groups, training programs, roundtables, meetups and industry events. Hackathons, including the FINOS-supported Innovate.DTCC AI Hackathon, provide an additional environment in which institutions can test ideas, identify common problems and develop early prototypes

Underpinning this community and engagement is the technology itself:

• Open specifications and standards, including the AI Governance Framework
• Open source projects and standards such as CALM, CCC and Fluxnova
• Open datasets and common data models, where we expect a significant increase in activity

The AI Fund does not replace these projects or communities; it supports them by providing a common direction and a mechanism for translating industry priorities into coordinated technical work.

 2. Why Harmonizing AI Governance Is So Difficult

Financial institutions do not lack AI principles, but they do face the challenge of navigating and reconciling a complex web of obligations across their global operations.

In the UK, for example, they are likely faced with addressing the EU AI Act, FCA expectations, PRA guidance, model risk management frameworks, operational resilience requirements, data-protection obligations, cybersecurity standards and extensive internal policies.

The problem is that these requirements frequently overlap without providing concrete and consistent implementation guidance.

Determining which rules apply to a particular institution or AI system is only the starting point. The more difficult questions are operational:

• Which risks apply to this specific use case?
• Which controls should be implemented?
• Where should those controls sit within the architecture?
• How can they be tested during development?
• How can their operation be monitored in production?
• What evidence must be retained for risk, compliance, audit and regulators?

The industry therefore faces a significant “last-mile” problem.

High-level policies must be translated into technical requirements. Technical requirements must be mapped to architectures. Architectures must be connected to controls, workflows, evaluations and runtime evidence.

Without a shared implementation model, every institution is forced to perform this translation independently. The result is duplicated investment, inconsistent interpretations and governance processes that struggle to keep pace with the speed of AI development.

The FINOS AI Governance Framework is intended to provide a common language for this work, connecting AI use cases with risks, mitigations, regulations, reference architectures and operational practices. Its catalog already includes mappings to frameworks such as the EU AI Act, NIST, OWASP and ISO 42001.

Publishing a framework, however, is just the beginning. Governance must also become executable.

3. Delivering a Governance As Code Pipeline

As a member of the FINOS AI Fund Governing Board, NatWest brought forward one of the industry's most pressing challenges: how to provide enterprise-grade governance and observability for increasingly complex agentic systems.

To illustrate how the industry can achieve this, we produced a Steel Thread demo: a live, end-to-end proof of concept showing how open-source standards chain together into a complete Governance as Code pipeline.

Part 1: Designing the Architecture & Framework

Rather than using a basic "Hello World" example, the team modeled a real-world financial-services use case: automated loan approval. They mapped industry design patterns from the Agentic AI Foundation (AAIF) and AI Governance Framework controls directly into a solution architecture, demonstrating:

• Use Case & Framework Mapping: AI risks (such as model hallucination) are paired with concrete mitigations and controls.
• Architecture as Code (CALM): Architecture definitions are codified into machine-readable specs for automated policy checking.
• Cloud Controls (CCC): Infrastructure services—such as secure document storage for IDs and bank statements—are validated against FINOS Common Cloud Controls.
• Process Orchestration (Fluxnova): Agentic tasks and business logic are structured into executable workflows.
• Observability (Grafana): Operational data, token usage and cost information can be collected to help answer questions such as how much an agent costs per decision.

In this video clip, Olivier Poupeney (Field CTO, FINOS) outlines how the Steel Thread was designed—moving from a standard loan approval use case to mapping risk controls, codifying architectures with CALM and CCC, and preparing the toolset for orchestration.

 

Part 2: LIVE EXECUTION & REAL-TIME OBSERVABILITY