Open finance connectivity platform provider Ninth Wave has launched its Agentic Control Layer™ technology, which is designed to enable banks, credit unions, and other financial institutions to have control over how their autonomous AI agents will access customer permissioned account data.
This technology was complemented by the company’s development of the Model Context Protocol (MCP) server, through which the governing access route is created and financial institutions can provide access to the account data only to approved AI agents while maintaining institution-defined policy guardrails.
Managing Risks Associated with Financial AI as the Transition Moves from Chatbots to Autonomous Agents
As the use of generative AI shifts from being used in static conversational interfaces that perform simple functions to being goal-oriented autonomous agents that can carry out complex operations including transfers, treasury processes, and financial analysis, banks and credit unions face increased risks associated with compliance, security, and data governance.
Also Read: MEDITECH and Lifemed AI Form Strategic Alliance to Bring Deep Learning Revenue Cycle Automation to Enterprise Health Systems
Ninth Wave’s Agentic Control Layer resolves these regulatory and operational challenges by embedding real-time policy checks directly into the financial data path. Built upon Ninth Wave’s established Open Finance platform, the architecture leverages existing bank connections, identity verification protocols, and canonical financial data models, eliminating the need for institutions to perform complex core banking integrations.
Key operational capabilities and governance features delivered through the Agentic Control Layer include:
Operator Accountability (“Know Your Agent”): Requires every AI agent to be registered and authenticated to a verified, accountable operator before access to financial systems is granted.
Per-Request Consent Enforcement: Verifies customer consent continuously on every single API request rather than once per session enabling immediate access revocation on subsequent calls.
Granular Task & Scope Boundaries: Restricts AI agent execution to explicitly consented accounts, specific data fields, date ranges, and defined task parameters.
Data Minimization & Number Masking: Returns only the minimum data fields necessary to complete an authorized task, automatically masking sensitive account numbers before telemetry reaches external AI models.
Real-Time Intervention Controls: Allows financial institutions or Ninth Wave administrators to pause or restrict specific agents, operators, or system capabilities instantly if anomalies are detected.
Complete Audit Trail Logging: Records every approved and rejected request in Ninth Wave’s Open Finance Console to support internal risk reviews and regulatory audits.
“Banks need a practical way to let AI serve their customers while keeping control over access to financial information,” said George Anderson, Founder and CEO of Ninth Wave. “The questions are straightforward: Who does the agent represent? What is it allowed to see? Does that permission still apply? Our Agentic Control Layer is designed to make those checks part of how financial data is accessed.
Pilot Program Availability and Enterprise Adoption
The Agentic Control Layer and its native MCP server are available now to qualifying early-access participants. Ninth Wave is currently inviting financial institutions to join a read-only pilot program to test agent governance workflows within their existing environments.
By establishing a secure framework for permissioned AI access, Ninth Wave provides financial institutions with the infrastructure required to accelerate digital transformation, reduce exposure to unmonitored data scraping, and maintain regulatory compliance.
