Agentic Finance: When Your AI Runs the Treasury

In 2012, Knight Capital deployed new trading software and, within 45 minutes, lost more than $440m. The episode is still taught as a market-structure failure, but it also now reads like an early warning for the age of agentic finance: when software can act directly on money, operational error becomes balance-sheet reality at machine speed.

That is the threshold corporate treasury is crossing in 2026. Two years ago, the frontier of AI in finance was generating a variance commentary or drafting an investor update. Now autonomous agents are beginning to move money. Cash-flow forecasting, account reconciliation, invoice matching, collections outreach, FX execution workflows, vendor onboarding checks and routine payment runs are increasingly handled by systems that can plan, act and report with minimal human touch.

For a fractional CFO or a lean finance team, the productivity case is close to overwhelming. Work that consumed days of skilled human attention collapses into minutes of oversight. Month-end becomes less of a ritual; liquidity visibility becomes nearer to continuous; exceptions are surfaced earlier. But the same collapse in friction is exactly what makes the agentic treasury dangerous. The real work of 2026 is not merely adopting the agents but governing them.

From copilot to counterparty

The shift under way is subtle but profound. Generative AI first entered finance as a linguistic tool: draft the board memo, summarise the covenant package, explain the variance in receivables. Useful, certainly, but essentially advisory. Agentic finance is different because it closes the loop between analysis and execution.

An agent connected to an ERP, bank portals, procurement systems and accounting data can do more than observe. It can:

• reconcile transactions continuously rather than at month-end;
• match invoices to purchase orders and receipts;
• update a rolling 13-week cash forecast as bank data lands;
• route exceptions to the right approver;
• prepare and, within limits, execute payment batches;
• monitor exposure and recommend hedging actions;
• trigger collections nudges or dunning sequences;
• assemble audit evidence across systems without a human gathering screenshots.

None of this is speculative. The enterprise software market is already moving in this direction. SAP, Oracle, Microsoft, Workday and ServiceNow are all embedding AI agents or agent-like assistants into finance workflows. Stripe has deployed AI for fraud detection and payments operations at enormous scale. Fintech infrastructure firms such as Modern Treasury and Trovata have built real-time treasury tooling around bank connectivity and cash visibility. HighRadius has long pushed machine learning into order-to-cash and treasury. Kyriba, one of the most established treasury platforms, now positions AI across forecasting, fraud prevention and liquidity management. The components are not science fiction; they are arriving through ordinary enterprise software releases.

The practical appeal is obvious. Treasury and controllership work is full of structured repetition carried out under time pressure across fragmented systems. That is exactly where machines perform well. In finance, the most valuable automation is often not glamorous intelligence but relentless consistency.

What agents can genuinely do now

The mature use cases are, as the draft rightly notes, unglamorous and valuable. They create leverage not by replacing judgement wholesale but by industrialising vigilance.

Continuous reconciliation

Traditional reconciliation is periodic, labour-intensive and prone to bottlenecks around close. Agentic systems can watch bank statements, sub-ledgers and ERP entries continuously, flagging mismatches as they arise. The benefit is not merely fewer manual hours. It is a shorter error half-life. A duplicate payment caught in hours is recoverable; caught after quarter-end, it becomes a dispute.

Rolling cash visibility

The 13-week cash forecast has become the operating heartbeat of many finance teams, especially after the liquidity shocks of the pandemic and the interest-rate cycle that followed. Agents can update those forecasts whenever receivables, payroll liabilities, debt service or procurement commitments shift. Trovata and Kyriba, among others, have built businesses on the premise that treasury needs near-real-time visibility rather than retrospective reporting.

Accounts payable and invoice operations

Invoice capture, matching, coding and exception handling are natural terrain for automation. AP departments have long used rules engines and OCR; agentic systems add a layer of contextual reasoning. They can chase missing fields, compare historical vendor patterns and classify unusual submissions for review. When linked to policy and approval hierarchies, they can prepare payment runs at a fraction of the traditional effort.

Fraud and anomaly detection

Payments fraud is not a niche problem. Business email compromise, invoice redirection and vendor impersonation remain stubbornly effective because they exploit process weakness rather than technical novelty. The FBI's Internet Crime Complaint Center has repeatedly identified business email compromise among the costliest forms of cyber-enabled crime. An agent that spots a new beneficiary, a changed bank account, or a payment timing anomaly before release is commercially valuable in very plain terms.

The common feature across these use cases is that the agent is not being creative. It is being tireless, consistent and fast.

In treasury, a bad action is not a software bug; it is a balance-sheet event.

Why treasury is the sharp edge of enterprise AI

Treasury is where three conditions collide: permission, irreversibility and adversarial pressure.

First, treasury systems require privileged access. If an agent can release payments, alter beneficiary details, net intercompany balances or instruct a dealing platform, it holds the digital equivalent of a master key.

Secondly, many treasury actions are difficult to reverse. A hallucinated meeting summary can be corrected. A misrouted payment can leave the account, traverse multiple institutions and become a legal and operational mess.

Thirdly, the payments environment is adversarial. Criminals already exploit email compromise, supplier fraud and social engineering with professionalism and patience. They will not struggle to adapt their tactics to agent-mediated workflows. If a model can be prompted, poisoned, misled through corrupted source data, or induced to trust a spoofed instruction, finance becomes an attractive attack surface.

That combination makes treasury unlike many earlier enterprise AI deployments. A bad recommendation in marketing wastes spend. A bad action in treasury may create loss, breach policy, or trigger reporting and regulatory consequences.

Where it breaks

The failure modes are not the ones science fiction warns about. They are mundane, financial and therefore more dangerous because they look ordinary until the moment they are not.

An agent that misreads an ambiguous instruction can move a real balance. An agent granted broad credentials becomes a concentrated attack surface. An agent optimising a narrow objective can take a locally rational action with a globally damaging result. And an agent whose reasoning is opaque makes after-the-fact audit painful precisely when audit matters most.

Consider the concrete failure patterns already familiar to finance and risk professionals.

Ambiguity turned into action

Finance language is full of shorthand. “Pay the usual suppliers.” “Sweep surplus cash.” “Clear overdue items.” Humans resolve those phrases against context and tacit knowledge. Models do not possess tacit knowledge; they infer from patterns. In a workflow tied to execution, inference is not harmless.

Over-broad authority

Many corporate control failures begin with excessive access combined with insufficient segregation of duties. If a single agent can create a vendor, amend bank details, approve an invoice and release a payment, the organisation has recreated in software the control failure auditors have spent decades trying to eliminate in humans.

Objective mismatch

An agent optimised to minimise idle cash may become too aggressive in sweeping balances, increasing operational fragility. One optimised to maximise on-time supplier payment may release questionable invoices. One focused on FX cost reduction may overlook underlying commercial exposure or liquidity timing. Narrow optimisation in finance is often a polite route to wider damage.

Opaque evidence trails

External auditors, internal audit committees and regulators rarely accept “the model decided” as an explanation. Under the Sarbanes-Oxley regime in the United States, public companies are required to maintain effective internal control over financial reporting. In Europe and Britain, payment services and operational resilience expectations are becoming stricter, not looser. A treasury function that cannot reconstruct who did what, when, using which inputs, is not modern; it is weak.

Data poisoning and workflow compromise

If the underlying master data is wrong, the agent will act wrongly with conviction. A changed vendor bank account in the ERP, a spoofed email ingested into the workflow, an incorrectly classified transaction history, or stale counterparty limits can all contaminate downstream decisions. In agentic finance, bad data is not only a reporting problem. It is an execution problem.

The compliance climate is catching up, slowly

As software gains agency, the standard of control should rise, not relax.

The governance question is unresolved not because there are no relevant rules, but because the existing rules were written for humans and deterministic software rather than probabilistic agents.

In the European Union, the AI Act introduces a risk-based regime, though many treasury tools may sit outside its highest-risk categories unless they affect areas such as employment, creditworthiness or access to essential services. More directly relevant to finance operations are the Digital Operational Resilience Act, which raises the standard for ICT risk management in financial entities, and longstanding requirements around payments controls, outsourcing and auditability.

In the United States, banking regulators and the SEC have been sharpening scrutiny of model risk, cyber controls, books-and-records obligations and governance over automated systems, even if no single rule yet says “this is how your treasury agent must behave”. The Federal Reserve's SR 11-7 model risk-management guidance was written for a different era, but its central principles — inventory, validation, controls, monitoring and governance — still apply.

Britain's regulators have taken a similar path through operational resilience, outsourcing oversight and accountability frameworks rather than AI-specific treasury rules. The message from all sides is broadly consistent: if software participates in a controlled financial process, the firm remains accountable.

That matters because some executives still talk as if AI tooling sits in a lighter-governance category than traditional finance systems. In treasury the opposite is true. As software gains agency, the standard of control should rise.

The control architecture that actually works

The organisations deploying agentic treasury safely share a recognisable pattern. They scope authority tightly; they separate proposal from execution; they log every action immutably; and they treat agent credentials as the crown jewels.

Those principles deserve to be made operational.

Hard limits, not soft intentions

Authority should be explicit and externally enforced. An agent may be allowed to reconcile, classify and prepare. It may be allowed to release payments only below fixed thresholds, only to pre-approved beneficiaries, only from designated accounts, only in particular geographies, and only within time windows. Those guardrails should live in systems of record and payment controls, not merely in prompts.

This is where a more serious governance discipline is needed. In Society OS terms, the relevant technical standard is F-ACT — the Framework for Agent Conformance & Trust — whose core is ASDAR: Authority, Scope, Data, Audit, Revocation. The principle is simple and unusually apt for treasury: govern before execution — not after.

Applied to finance, that means:

• Authority: who empowered the agent to act;
• Scope: what actions, thresholds and systems it may touch;
• Data: which sources are authorised and sufficiently reliable;
• Audit: what evidence trail is captured for every recommendation and action;
• Revocation: how access and execution rights can be stopped immediately.

That may sound procedural. In treasury it is the difference between automation and recklessness.

Proposal and execution should be separable

A well-governed agentic treasury often uses agents first as preparers rather than final actors. The agent assembles the payment run, flags anomalies, attaches source evidence and suggests timing. A separate control — human approval, independent rules engine, bank-side approval, or dual control in the TMS — authorises release above thresholds.

This mirrors a lesson finance already knows. Segregation of duties is not bureaucratic clutter; it is civilisation for money movement.

Evidence must be reconstructable

Every action should carry provenance: source systems queried, data versions used, policy applied, approver invoked, exception flags raised, and final instruction sent. Immutable logs, ideally time-stamped and tamper-evident, matter because the key question after an incident is rarely abstract model quality. It is practical accountability.

Credentials are the crown jewels

If agent credentials are compromised, a company has effectively created a machine-speed insider threat. Access tokens, bank API keys, ERP roles and workflow permissions must be constrained, rotated and monitored with the same seriousness as privileged human access, and arguably more. Least privilege, just-in-time access, hardware-backed secrets management and independent transaction verification should become standard design choices rather than luxury features.

The winning posture is the disciplined middle: automate aggressively, but never faster than the control architecture can absorb.

What a sensible deployment path looks like

The temptation is to wait for governance frameworks to mature before adopting. That is the wrong lesson. The firms that delay entirely will cede cost, speed and visibility advantages to faster operators. But the firms that push agents straight into high-value, irreversible actions will eventually provide the case studies.

A disciplined path is available.

Stage one: high-volume, low-irreversibility tasks

Start with reconciliations, collections workflow, variance investigation, policy checks and payment preparation. Measure exception rates, false positives, time saved and audit completeness.

Stage two: bounded execution

Permit the agent to execute tightly constrained actions: internal transfers under low thresholds, routine supplier payments to whitelisted beneficiaries, or cash sweeps within a ring-fenced liquidity structure. Require dual controls above policy limits.

Stage three: adaptive optimisation under supervision

Only after strong evidence of control effectiveness should firms extend into more consequential domains such as dynamic liquidity allocation, hedge execution recommendations or working-capital optimisation that interacts with commercial decisions.

The point is not caution for its own sake. It is organisational learning. Finance teams need to build new muscles: prompt discipline, data lineage review, incident response for agent actions, model exception triage, and board-level understanding of where automation is genuinely acting rather than merely advising.

The new brief for the CFO

Agentic treasury changes the CFO's role less by replacing finance judgement than by forcing it upward. The modern finance leader is becoming less a reviewer of every transaction and more a designer of operating constraints.

That requires different questions in software selection and internal governance:

• Can this system prove what data it used?
• Can authority be expressed in machine-enforceable policy?
• Can permissions be revoked instantly across connected systems?
• Can the agent be prevented from creating and approving the same transaction chain?
• Is there an independent evidence trail suitable for audit and regulators?
• What happens when the model is uncertain, conflicted or unable to verify inputs?

These are not “AI questions” in the narrow sense. They are treasury questions in a new technical form.

Under the broader logic of The Sovereign Standard, finance sovereignty means preserving the institution's ability to know who is acting, on whose behalf, against which assets and under what limits. In practice, that pushes identity, trust and execution into the foreground. The 42 Protocols express this operationally through the Sovereign Trinity: Human-Twin-Agent identity for who acts, HEARTrank for what is trusted, and WISE Contracts for which execute law, not merely code. Treasury is one of the clearest corporate arenas in which those abstractions stop being philosophical and become operational necessities.

Finance will not go back to manual

There is a recurring mistake in technology transitions: to assume that visible risk will slow adoption more than visible productivity accelerates it. In finance, productivity usually wins, particularly when margins tighten and teams are expected to do more with less.

The evidence from earlier waves of digitisation is instructive. Once firms experienced straight-through processing, API-connected banking, automated AP, electronic invoicing and real-time payments visibility, they did not return to paper, portals and spreadsheets by preference. Agentic treasury will follow the same broad pattern. The question is not whether software will take on a larger share of treasury operations. It is whether firms will insist that authority, evidence and revocation mature at the same pace.

The winning posture, then, is the disciplined middle. Automate aggressively, but never faster than the control architecture can absorb. Use agents where errors are cheap and reversible; expand only when authority is explicit, data is reliable, and execution is bounded. Trust the productivity gains, but verify the power structure beneath them.

Because once an AI stops drafting the memo and starts releasing the payment, the system is no longer a clever assistant. It is part of the treasury itself. And treasury, unlike most software categories, cannot afford magical thinking.