Can an AI agent place your FX hedges? What to lock down first
AI agents can now read emails, call APIs and place orders. Technically, one could hedge your FX exposure. The four risks specific to an agent, what the company commits to with every trade, and the controls to put in place before entrusting it with anything.
An assistant answers questions. An agent acts: it reads a mailbox, queries an ERP, calls a platform's API and triggers transactions. Applied to treasury, the prospect is obvious: an agent that computes the exposure every morning, applies the hedging policy and places the necessary forwards.
It is technically feasible. The question is under what conditions it is reasonable — because a hedge is not a draft you review: it is a commitment.
What the company commits to with every trade
A hedge traded with a bank is concluded under a master agreement signed by the company — in France, most often the French Banking Federation's master agreement for forward financial instruments. Every confirmed trade binds the company, whoever — or whatever program — triggered it.
A bank does not check whether an order was thought through by a human or generated by an agent. It checks that it comes from an authorised access. An agent's error is therefore, legally, a decision of the company.
The four risks specific to an agent
- 1Acting on wrong data
An agent built on a language model can produce a plausible, wrong number. When an assistant is wrong, you read an error; when an agent is wrong, a trade is placed.
- 2Being manipulated
Prompt injection is the first risk listed by OWASP for language-model applications: malicious text slipped into an email, an attachment or a web page can hijack the agent's behaviour. An agent that reads suppliers' emails and can place orders is a target.
- 3Having too much power
OWASP also describes "excessive agency": an agent with too many functions, too many permissions or too much autonomy can cause damage from an unexpected, ambiguous or manipulated output.
- 4Repeating without stopping
Automation that goes wrong does so fast. In 2012, a defect in an automated order system led the US broker-dealer Knight Capital to send more than 4 million orders in 45 minutes, for a loss of more than 460 million dollars. It was not AI, but automation without sufficient safeguards — which is what the US market regulator found.
Controls to lock down before any autonomy
| Control | Implementation |
|---|---|
| A written mandate | The FX policy states what the agent may do: which instruments, currencies, horizons. Everything else is forbidden |
| Hard limits | Maximum amount per trade and per day, enforced by the platform or bank, not just by the agent |
| Human approval | Every trade proposed by the agent is approved by an authorised person before execution |
| Segregation of duties | The agent prepares, one person approves, another reconciles the bank's confirmations |
| Sourced market data | The agent only works with time-stamped rates from a market source, never with numbers it produces itself |
| Partitioned inputs | The agent that can propose orders does not read incoming email: a hidden instruction must not be able to reach an execution tool |
| A full audit trail | Every proposal, approval and execution is logged with its input data |
| An immediate stop | One person can cut off the agent's access in one action |
The right level of autonomy
| Level | What the agent does | For whom |
|---|---|---|
| 1 · Read | Computes exposure, summarises positions, prepares reporting | Any company, today |
| 2 · Propose | Applies the policy and proposes the hedges to place, with their rationale | Any company with a written FX policy |
| 3 · Prepare | Prepares the order and the quote request; an authorised person approves and executes | The reasonable level for a mid-sized company |
| 4 · Execute | Places trades alone within tight limits, checked afterwards | Organisations with a dealing room and dedicated risk control |
OWASP's recommendation points the same way: require a human to approve high-impact actions before they are taken. An FX hedge is one.
The AI Act will not settle the question for you
The EU AI Act requires human oversight of high-risk systems. An FX hedging agent is not on the Annex III list: nothing in the AI Act therefore obliges the company to keep a human in the loop. The obligation comes from its own governance — delegations, limits, segregation of duties — and that is what must be updated before entrusting anything to an agent.
Sources
- OWASP, "Top 10 for LLM Applications 2025": LLM01:2025 Prompt Injection; LLM06:2025 Excessive Agency (excessive functionality, permissions and autonomy; human approval of high-impact actions).
- U.S. Securities and Exchange Commission, order "In the Matter of Knight Capital Americas LLC", 16 October 2013, and press release 2013-222.
- French Banking Federation, master agreement for forward financial instruments, 2013 version adapted to EMIR.
- Regulation (EU) 2024/1689 on artificial intelligence: Article 14 (human oversight of high-risk systems) and Annex III.
Have your policy reviewed before automating
We audit FX and treasury policies, delegations included, and propose wording that stands up to an auditor — including the usage rules for the tools that prepare your decisions.
Request a reviewNot ready to open the pricer yet?
Get the one-page FX policy template — hedge ratios by horizon, tolerance band, delegation table. The one your auditor will ask for.
- One field only
- One-click unsubscribe
- No data resold
Frequently asked questions
The questions finance departments ask most often on this topic
Can an AI agent place FX orders for a company?
Technically, yes: an agent can compute an exposure, prepare a quote request and transmit an order through an API. But every confirmed trade binds the company under its agreement with the bank. The reasonable level for a mid-sized company is an agent that prepares the order, approved and executed by an authorised person.
What are the risks of an AI agent in treasury?
Acting on wrong data, being manipulated by an instruction hidden in an email or document, holding too many permissions, and repeating an error at high speed. The middle two feature in OWASP's 2025 ranking for language-model applications.
Does the AI Act require human approval for a hedging agent?
No. The AI Act's human oversight covers the high-risk systems of Annex III, which do not include an FX hedging agent. The approval requirement must therefore come from the company's treasury governance.
What controls should be in place before using an AI agent?
A written mandate in the FX policy, amount limits enforced by the bank or platform, human approval of every trade, segregation of duties, sourced market data, separation between reading emails and execution, a full audit trail and an immediate stop.
Read next
Treasury and FX governance: who decides what, and how to evidence it
12 min read
AI and currency risk: what it does well, what it does badly, and where it becomes dangerous
9 min read
International payment fraud in the age of deepfakes: the controls that still hold
7 min read
The AI Act: what really changes for finance and treasury departments
8 min read
Hedge ratio: what share of your exposure should you really hedge?
9 min read