Lyzr Research · October 2026 · A 20 minute read

The Agentic GRC Playbook
for Banks and Credit Unions.

Why GRC work at $1B–$50B institutions takes months, weeks and hundreds of items, and how AI agents change that: six workflows, how to build and govern them, and a 90-day plan you can run.

Scroll to read

For the CCO, CRO, chief audit executive and BSA officer

Compliance work is done by hand. Agents can now do the groundwork.

ONE CONTROL TEST, SIX STEPSAGENT DRAFTSYOUR TEAMSCOPESAMPLEEVIDENCETESTWORKPAPERSIGNFIVE STEPS DRAFTED.ONE DECISION, SIGNED.
01

Rule changes take months.

A change is public on day one. Reaching your policies, procedures, systems and tests takes months of handoffs.

02

Tests take weeks. Exam requests run to hundreds of items.

Most of a control test sits on one analyst. One state regulator’s request list runs past 240 items.

03

Agents can draft the groundwork. Your people still decide.

This playbook shows where the time goes, six workflows agents can take on, how to build and govern them, and a 90-day plan you can run without us.

Written for banks and credit unions from $1B to $50B

Where this playbook describes Madison, Lyzr’s GRC product, it says so.

Lyzr Research, October 2026

What this covers

Seven parts, start to finish.

01

Done by hand

The cost

Months for a rule change, weeks for a test, hundreds of exam items.

02

Groundwork and judgment

What agents change

Code checks, models draft, people decide.

03

What agents do

Six workflows

Each workflow, one real rule change end to end, and each seat.

04

The linked record

How to build it

The layers, how Madison is built, and build or buy.

05

What examiners ask

Governing the agents

SR 26-2, third-party guidance and six controls.

06

Three gates

The first 90 days

From a rule map to one workflow live.

07

Run it with us

Charter

Everything in this playbook at 50% of standard price.

01

The cost of doing it by hand.

Rule changes take months, control tests take weeks and exam requests run to hundreds of items.

This part walks through each of the three, then names the reason they are slow.

RULE CHANGEMONTHSCONTROL TESTWEEKSEXAM REQUEST240+ ITEMSDONE BY HAND.

The rule change

A rule change takes months to reach the controls that prove it.

The rule is public on day one. Then it is spotted, read, judged for applicability, interpreted, mapped to policies, written into procedures, set in systems, trained and finally tested. Each step waits on the last owner. For the 2025 Regulation CC change, the agencies gave banks more than a year.

RULE PUBLISHEDCONTROL TESTEDCOMPLIANCELEGALOPERATIONSTECHNOLOGYTRAININGTESTINGSPOTTEDREADDOES IT APPLYINTERPRETWHICH POLICIESPROCEDURESSYSTEM SETTINGSTRAININGFIRST TESTDAY ONEMONTHS LATERNINE STEPS, SIX OWNERS, EACH WAITING ON THE LAST.ILLUSTRATIVE

The control test

A control test takes weeks, and 16 of its 23 steps sit on one analyst.

Plan it, scope it, pull the population, size and pick the sample, request the evidence, test each item, conclude. Most steps land on one person. The evidence step waits on control owners who have day jobs. Then the next control starts.

ONE CONTROL TEST, STEP BY STEPPLAN123SCOPE456POPULATION789SAMPLE101112EVIDENCE13141516TEST17181920CONCLUDE212223WAITING ON CONTROL OWNERSON ONE TESTING ANALYST: 16OWNERS, REVIEWERS, APPROVERS: 723 STEPS. MOST OF THEM ON ONE PERSON’S DESK.FROM LYZR’S MAP OF THE CONTROL TESTING WORKFLOW.

The exam request

One state’s exam request list runs past 240 items, each gathered by hand.

The Texas Department of Banking’s request list has more than 240 lettered items in 26 sections, from board minutes to SAR filings, and examiners mark the ones they need. The FDIC has heard bankers say request lists are too long. 15 of the 22 steps in answering one sit on a single person.

REQUEST LIST240+ITEMSONECOORDINATORBOARDFINANCELENDINGDEPOSITSBSA AND AMLTECHNOLOGYVENDORSPEOPLETHE RESPONSE15OF 22 STEPSON ONE PERSONEVERY ITEM HAS AN OWNER, A FOLDER AND A DEADLINE.

Texas Department of Banking, examination request list (5/31/22), our count. FDIC ePREP presentation, 2012. Step counts from Lyzr’s workflow mapping.

Why it is slow

Every bank has its rules, its policies and its controls. Few have the recorded links between them. So every rule change, every test and every exam request starts with someone rebuilding those links by hand, and starts again the next time.

RULESPOLICIESCONTROLSEVIDENCE?????THE LINKS LIVE IN PEOPLE’S HEADS.REBUILT BY HAND, EVERY TIME.
02

What agents change.

Agents do the groundwork. Your people decide.

The same work, split differently: code checks what can be checked, models draft what needs reading, and a named person decides.

1SCOPE2SAMPLE3EVIDENCE4TEST5WORKPAPER6SIGNFIVE DRAFTED. ONE SIGNED.

The same control test, with an agent

An agent can draft the groundwork. Your team keeps the conclusion.

Scoping, sampling, pulling evidence, running the steps and writing the workpaper can all be drafted, with every source attached. The conclusion and the signature stay with a named person. What changed is that models can now read rules, policies and records well enough to do the drafting.

ONE CONTROL TESTTHE AGENT DRAFTSYOUR TEAM01SCOPETHE CONTROL AND RULEAGENT02SAMPLEWHICH ITEMS TO TESTAGENT03EVIDENCEPULLED READ-ONLYAGENT04TEST STEPSRUN ON EACH ITEMAGENT05WORKPAPEREXCEPTIONS MARKEDAGENT06CONCLUDEREVIEW AND SIGNNAMED PERSONTHE AGENT DRAFTS FIVE STEPS. YOUR TEAM MAKES THE CALL.EVERY DRAFT CARRIES ITS SOURCES. NOTHING TAKES EFFECT UNTIL IT IS SIGNED.

Who does what

Code checks. Models draft. People decide.

Anything that can be checked is checked by code: the quoted sentence exists, the rule applies to a bank of this charter and size, the deadline falls on a business day. Models handle what needs reading: what a sentence obliges, which policy carries it. People decide everything that goes on the record.

CODE CHECKSTHE QUOTE EXISTSTHE RULE APPLIESTHE DEADLINEMODELS DRAFTWHAT IT OBLIGESWHICH POLICYWHICH CONTROLPEOPLE DECIDEACCEPT OR AMENDAPPROVE LINKSSIGN OFFEACH DOES WHAT IT IS GOOD AT.NOTHING REACHES THE RECORD UNSIGNED.
03

Six workflows.

Where agents do the groundwork and your team decides.

For each one: today, what the agent does, what your team keeps and what an examiner sees. Then one real rule change, end to end, and what changes for each seat.

WHICH RULESREG CHANGEPOLICIESTESTINGISSUESEXAMSSIX WORKFLOWS, ONE RECORD.

Start with the first

Six workflows. Every other one needs the first.

01

Which rules apply

Every rule and duty that applies to you, with the reason for each.

02

Regulatory change

What changed, whether it applies, and which policies and controls it touches.

03

Policies and procedures

Each policy checked against the rules it carries, with redlines drafted.

04

Control testing

Scope, sample, evidence and workpaper, drafted for sign-off.

05

Issues and remediation

Each finding tied to its rule and control, and tracked to validated closure.

06

Exam preparation

Request lists answered item by item from evidence already on file.

Workflow 1, the foundation

Keep uncertain duties and flag them. Never drop one silently.

The rule map lists every duty that applies to your charter, size, states and products, with the condition on each. A duty wrongly excluded is invisible: no policy, no control, no test, and no one notices until an examiner does. So uncertain duties stay on the list, flagged, and every exclusion carries a reason.

THE RULE MAP, DUTY BY DUTYDUTY 01APPLIESDUTY 02APPLIESDUTY 03UNSURE: KEPT AND FLAGGEDDUTY 04EXCLUDED: REASON RECORDEDDUTY 05APPLIESAN EXCLUDED DUTY IS INVISIBLE.NONE IS DROPPED WITHOUT A REASON.

Which rules apply, and what changed.

1. Which rules apply2. Regulatory change
Today
An obligation inventory built years ago, updated when someone has time.
Alerts from a feed, read by whoever has time, sorted out in a meeting.
The agent
Reads your charter, size, states and products, and lists every rule and duty that applies, with the reason.
Checks agency sources daily, keeps what applies to you, traces each change to the policies and controls it touches and drafts the edits.
Your team
Confirms the list and records why anything is out.
Decides the impact and assigns owners.
Your examiner sees
An inventory with a reason for every rule in or out.
A change log: each change, the decision, the owner and the close date.

Policies, and the controls that carry them.

3. Policies and procedures4. Control testing
Today
Reviewed once a year by calendar. Citations go stale in between.
Samples pulled by hand, evidence chased by email, workpapers typed up afterwards.
The agent
Checks each policy against the rules it carries, flags gaps and stale citations, and drafts redlines.
Proposes scope and sample, pulls evidence read-only, runs the test steps and drafts the workpaper with exceptions marked.
Your team
Approves the edits. The board approves the policies.
Reviews exceptions, concludes and signs.
Your examiner sees
Every policy linked to its rules, with its review history.
A workpaper with sample, evidence, steps and sign-off.

Findings to closure, and the exam itself.

5. Issues and remediation6. Exam preparation
Today
Findings in a tracker. Due dates slip. Closure is confirmed by email.
The request letter arrives and the team spends weeks collecting items from many owners.
The agent
Links each finding to its rule and control, tracks due dates, collects proof of the fix and flags repeats.
Splits the request list into items, matches each to evidence on file, drafts responses and flags gaps early.
Your team
Owns the fix and validates it.
Reviews the package and leads every conversation with examiners.
Your examiner sees
Each finding traced from cause to validated closure.
A request list answered item by item, each with its source.

One real change, end to end

A few dollar figures changed. At the bank, seven things had to.

In May 2024 the Fed and the CFPB raised Regulation CC’s funds availability amounts, effective July 1, 2025. The rule text barely moved. At a bank it reaches the policy, the disclosures, branch procedures, core settings, training and the controls that test holds. The agent finds each one and drafts the change. Each owner signs.

REGULATION CC, 12 CFR 229EFFECTIVE JULY 1, 2025NEXT-DAY AMOUNT$225 → $275CASH WITHDRAWAL$450 → $550NEW ACCOUNT$5,525 → $6,725LARGE DEPOSIT$5,525 → $6,725REPEATED OVERDRAFT$5,525 → $6,725AND THE CIVIL LIABILITY LIMITSAT THEBANKWHAT THE AGENT DRAFTSWHERE IT LANDSFUNDS AVAILABILITY POLICYREDLINE DRAFTEDCUSTOMER DISCLOSURE AND HOLD NOTICESNEW AMOUNTS DRAFTEDBRANCH HOLD PROCEDURESSTEPS UPDATEDCORE SYSTEM HOLD SETTINGSCHANGE REQUEST DRAFTEDSTAFF TRAININGTALKING POINTS DRAFTEDCONTROLS THAT TEST HOLDSTEST STEPS UPDATEDEVIDENCE FOR THE EXAMINERLINKED AS PRODUCEDTHE RULE CHANGED A FEW NUMBERS. THE BANK CHANGES IN SEVEN PLACES.ILLUSTRATIVE MAPPING

Federal Reserve and CFPB final rule, Federal Register, May 20, 2024. The mapping at the bank is illustrative.

What changes for each seat.

SeatWhat changesThe question you can now answer
Chief compliance officer
A compliance position built from recorded links: four counts, never a percentage.
Which duties are covered, partly covered, not covered or not yet reviewed?
Chief risk officer
Rule changes traced to the policies, controls and processes they touch.
Which risks moved this month, and where do they land?
Chief audit executive
An audit plan ranked by what has never been looked at, with scoping drafted from the same links.
What haven’t we audited, and why should it be next?
BSA officer
BSA and AML duties mapped to the controls and tests that cover them.
Can we show the test behind every duty an examiner names?
04

How to build it.

Agents need a map to work on. Build the map first.

How the pieces fit, how Madison is built as one example, how agents check their own work and learn from your reviewers, and whether to build, buy or extend.

YOUR PEOPLEAGENTSLINKED RECORDYOUR SOURCESBUILD THE MAP FIRST.

How it fits together

Agents work on a linked record. Your people sign on top.

An agent that reads a new rule is only useful if it knows which of your policies, controls and records the rule touches. That linked record is the part to build first. The agents are only as good as the links they work on.

YOUR PEOPLEAGENTSLINKED RECORDYOUR SOURCESREVIEW, DECIDE AND SIGN. NOTHING TAKES EFFECT WITHOUT THEM.APPLICABILITYREG CHANGEPOLICIESTESTINGISSUESEXAM PREPRULEDUTYPOLICYCONTROLTESTFINDINGEVIDENCEAGENCY RULESPOLICIES AND PROCEDURESCORE, LENDING, DOCUMENTSGRC PLATFORMBUILD THE LINKED RECORD FIRST. THE AGENTS ARE ONLY AS GOOD AS THE LINKS THEY WORK ON.

How Madison is built

Seven layers, and the model is only one of them.

Sources come in through code that checks every quote and applies every rule condition. Eight agents do the reading. People decide at five points. Every proposal, decision and correction is kept in an append-only record, and the agents learn from your reviewers’ changes.

1SOURCESAGENCY FEEDSBANK REGISTERSYOUR POLICIES AND CONTROLSSOURCE2CODE SERVICESFEED MONITORQUOTE CHECKAPPLICABILITYDEADLINESDRIFT CHECKSIGN-OFF GUARDCODE3ORCHESTRATIONEVENT OUTBOXJOB RUNNERCOST LIMITSMEMORY GATEWAYCODE4AGENTSREAD THE RULE: 4 AGENTSDOES IT APPLY: 2 AGENTSARE WE COVERED: 2 AGENTSMODEL5PEOPLEACCEPT THE DUTYAPPROVE THE RULESCREENACCEPT LINKSSIGN OFFPERSON6MEMORYPRIVATE, ONE PER AGENTSHARED: REGULATORYSHARED: YOUR BANK, ISOLATEDMEMORY7RECORDAPPEND-ONLY AUDIT TRAILBOARD PACK AND EXAM EXPORTRECORDCODE CHECKS. MODELS DRAFT. PEOPLE DECIDE. EVERYTHING IS KEPT.

Checking the work

Every drafted duty passes three checks before a person sees it.

A separate critic agent asks three questions: is it supported by the text, is it actually a duty, is it one duty or three. Code then confirms the quoted sentence exists in the rule. Anything that fails goes back, not forward. Your reviewers see fewer drafts, and better ones.

BEFORE A PERSON SEES A DUTYCRITIC AGENTCODEYOUIN THE TEXT?A DUTY?ONE DUTY?QUOTE FOUNDFAILS A CHECK: GOES BACKTHREE QUESTIONS FROM A CRITIC,ONE CHECK BY CODE, THEN A PERSON.

Memory

Agents learn from your reviewers’ corrections.

Each agent keeps a private memory of past corrections, so a reviewer’s amendment today shapes tomorrow’s draft. Shared memory holds what every agent needs: regulatory readings that carry no bank data, and each bank’s facts, held separately for each bank.

PRIVATE, ONE PER AGENTSHAREDSEGMENTERITS OWNCORRECTIONSEXTRACTORITS OWNCORRECTIONSCRITICITS OWNCORRECTIONSMAPPERITS OWNCORRECTIONSREGULATORY READINGSNO BANK DATAEACH BANK’S FACTSHELD SEPARATELY PER BANKA REVIEWER’S AMENDMENT TODAYSHAPES TOMORROW’S DRAFT.REGULATORY READINGS CARRY NO BANK DATA.

The build

Six rules for the build.

01

Map first

Build the list of rules that apply to you before any agent goes live.

02

Read-only

Agents read your systems and never write to them.

03

People decide

Agents propose. Nothing that changes a customer outcome or a filing happens without a person.

04

Cite every source

Every output points to the text it came from. A draft without a citation goes back.

05

Keep your GRC platform

It stays the system of record. Agents feed it the signed results.

06

Respect your data rules

Run in your own cloud or a vendor’s secure cloud, read-only either way.

Where your GRC platform fits

Your GRC platform stays the system of record. Agents do the work that feeds it.

GRC platforms hold obligations, policies and controls and track their status. Keep yours. Agents add the links between those records, do the groundwork on them and send the signed results back in.

SYSTEM OF RECORDOBLIGATIONSPOLICIESCONTROLSSTATUS+ LINKSTHE LINKSKEEP THE SYSTEM OF RECORD.ADD THE LINKS.

Build it, buy it or extend what you have.

Build in-houseBuy a platformExtend your GRC tool
Strength
Fits your stack exactly
Fast: the map and the agents come built
Reuses what your team already knows
Weak spot
The map is the hard part, and its regulatory content needs constant upkeep
Another vendor to review and connect
Tracks status well, but may not have agents that do the work
First live workflow, our estimate
Many months
Weeks
Months
Best when
You have a platform team and people who can encode regulation
You want results this budget year
Your GRC vendor ships agents you trust
05

Governing the agents.

Your examiner will ask how you govern the agents doing compliance work.

The rules for those agents are yours to write. This part sets out why, and six controls that answer the questions.

SR 26-2APRIL 17, 20263ONE FOOTNOTE LEAVES AGENTS OUT.

April 17, 2026

SR 26-2 puts agentic AI outside its scope. Your own governance decides.

The Fed’s SR 26-2 replaced SR 11-7. Footnote 3 leaves generative and agentic AI to each bank’s own risk management. If you buy agents, the interagency third-party guidance, SR 23-4, covers the vendor. For credit unions, GAO found in 2025 that NCUA’s model risk guidance is limited in scope and detail.

SR 26-2TRADITIONAL MODELSAGENTS, OUTSIDETHE GUIDANCEINSIDE THEGUIDANCEYOUR OWNGOVERNANCE DECIDESFOOTNOTE 3 DRAWS THE LINE.

Federal Reserve SR 26-2, April 17, 2026. SR 23-4, June 7, 2023. GAO-25-107197, May 2025.

Six controls cover what an examiner is likely to ask.

ControlWhat an examiner may askGood looks like
A register
Which agents do you run in compliance, and who owns each?
Every agent listed with an owner, a purpose and what it can read.
Written limits
What can each agent do without a person?
Limits written per agent. Anything that changes an outcome needs a sign-off.
Named sign-off
Who approved this conclusion?
A named person on every conclusion, with rejections recorded. A rejection rate of zero is worth a question.
A full record
Show me how this workpaper was produced.
Each draft keeps its sources, the agent’s steps and the reviewer’s edits.
Testing and a stop
How do you know the agent is right, and how do you turn it off?
The second line samples agent output, and there is a tested way to switch an agent off and go manual.
Vendor review
What did you check before you bought it?
The review covers the agents: data access, where records live and certifications.
06

The first 90 days.

From a rule map to one workflow live, with your team signing.

Start with one workflow, usually control testing or regulatory change. Each phase ends at a gate with a named sign-off.

DAY 30DAY 60DAY 90THREE GATES.NINETY DAYS.

The plan

Ninety days from a rule map to a live workflow.

Don’t move on until each gate is signed. At day 90 you can show the board one workflow running, what it found and the controls around it. Then add the next workflow on the same record.

DAYS 1 TO 30MAPBUILD THE RULE MAPPICK THE FIRST WORKFLOWWRITE THE AGENT REGISTERDAYS 31 TO 60SIDE BY SIDEAGENT WORKS BESIDE YOUR TEAMCOMPARE ITS DRAFTS WITH THEIRSSECOND LINE SAMPLES OUTPUTDAYS 61 TO 90LIVEAGENT DRAFTS, TEAM SIGNSMOCK EXAM REQUEST ON ITS WORKBRIEF THE BOARDDAY 30GATE 1: CCO SIGNS OFF THE RULE MAPDAY 60GATE 2: REVIEWERS ACCEPT ITS DRAFTSDAY 90GATE 3: THE BOARD IS BRIEFEDDAY 0DON’T MOVE ON UNTIL THE GATE IS SIGNED.

Sources and notes

Every fact, and where it came from.

  1. Federal Reserve, SR 26-2, Revised Guidance on Model Risk Management, April 17, 2026. Footnote 3 on generative and agentic AI.
  2. Federal Reserve, SR 23-4, Interagency Guidance on Third-Party Relationships: Risk Management, June 7, 2023. Issued with the FDIC and OCC.
  3. GAO-25-107197, May 2025, on NCUA’s model risk management guidance, as reported by America’s Credit Unions, May 23, 2025.
  4. Federal Reserve and CFPB, Regulation CC final rule adjusting dollar amounts, effective July 1, 2025.
  5. Consumer Compliance Outlook, Third Issue 2024: the Regulation CC rule was published in the Federal Register on May 20, 2024.
  6. Texas Department of Banking, examination document request list (5/31/22). Item count is our own: 243 lettered items in 26 sections.
  7. FDIC, An Online Tool to Assist in Tailoring Pre-Exam Information Requests (ePREP), November 8, 2012.
  8. Lyzr’s mapping of the control testing workflow (23 steps) and the examination request workflow (22 steps). Our own analysis.

Timelines for rule changes and control tests are our judgment, drawn from mapping these workflows. The workflows, build rules, controls and the 90-day plan are our own, offered to be argued with. Spot an error? Tell us and we will fix it.

The charter program

You’ve read the playbook. We can run it with you.

01

Your rule map

Every rule and duty that applies to you, with the reason for each.

02

Regulatory change

Watched daily, filtered to you, and traced to your policies and controls.

03

Policies

Each policy checked against the rules it carries, with redlines drafted.

04

Control testing

Scope, sample, evidence and workpaper, drafted for your sign-off.

05

Issues and exams

Findings tracked to closure. Exam requests answered from evidence on file.

06

The governance pack

Agent register, written limits, sign-off and record, ready for your examiner.

Your next step

Become a charter member.

Everything in this playbook, run with your team in a three-month co-build, at 50% of our standard price. Open to every bank and credit union, in your cloud or ours.

01

Apply

Tell us about your institution. We reply within one business day.

02

Map

We start with your rule map, so every workflow after it knows which rules apply.

03

Build

Three months side by side, one workflow at a time, your team signing every step.

Apply for the charter program Not ready yet? Ask for a free rule map.