The supervision and evidence layer for regulated institutions deploying AI agents that move money.

The guidance stepped back. The liability did not move.

In April 2026 the banking agencies revised the model risk framework US institutions have run on since SR 11-7 — and placed generative and agentic AI outside its scope. A separate request for information on AI was promised. It has not been published.

Examiners are not waiting for it. Since June 2026, AI has been a standing topic in routine examinations: how agents are governed, which vendors sit in the chain, and who is authorised to shut one off.

So an agent that can initiate a payment now sits between a framework that excludes it and an examination that asks about it anyway.

The weakest control is the one an examiner asks about first.

Asked where their institution is least prepared for AI, 72% of 230 US banking respondents named the same two capabilities: reporting an AI failure to a regulator (37.8%) and having a model kill-switch protocol at all (34.4%).

Both questions get harder, not easier, the moment the model in question can move money on its own authority.

Model risk management, rebuilt for agents that move money.

Custogent is the institution’s own seat — not the card network’s, not the processor’s, not the identity vendor’s. One system of record, six parts.

Agent registry

Every agent, owner, model version, credential and rail enrolment in one inventory, so the population is a list rather than an estimate.

Mandate governance

Spend ceilings, categories and counterparty limits authored once, versioned, and reconciled against what is actually configured downstream on card, ACH, RTP and stablecoin rails.

Evidence vault

Immutable, bitemporal records of agent actions, consents and mandates — what was known, under which rules, at what time.

Continuous monitoring

Deviation from an approved mandate surfaces when it happens, not at quarter end.

Regulatory reporting

Examination and incident reporting produced as a document, not as a project.

Regulatory intelligence

Frameworks held as versioned data, so a change in guidance arrives as a difference against your control set.

Pre-launch, and saying so.

Custogent is being built now, with a small number of design partners: regulated institutions willing to argue the control set out against their own examinations rather than inherit someone else’s.

There is no product to sell you yet. That is the reason to talk early rather than a reason to wait — the controls that end up in the system are the ones design partners insist on.

Who to write to.

Custogent is founded by Sheo Jha. He spent twelve years as a Risk Officer in the U.S. Securities and Exchange Commission’s Enforcement Division, where he built and led its Governance, Risk and Compliance program, leaving in March 2026. He is Chief Innovation Officer at Ankore Consulting, a risk and technology advisory firm he co-founded in 2010.

He holds a BS in Electrical Engineering from IIT Kanpur and an MBA from The George Washington University, and is CISSP, CISM and CRISC certified.

Custogent exists because the questions that need answering — who knew what, under which rules, at what time — have no answer yet for an agent that can move money.

• General — sheo@custogent.com
• Security reports — security@custogent.com, or /.well-known/security.txt