Last Updated: 22 May 2026
Most businesses moving money across borders juggle three or four providers at once. One for card processing, another for banking access, a third for cross-border transfers. The result is a tangle of integrations and compliance obligations that compound fast. xpate gives businesses a single platform for payments, card processing, banking access, and cross-border money movement, reducing the complexity that comes with managing multiple providers.
As autonomous AI systems begin making real-time decisions within financial workflows, a harder question emerges. It is no longer about whether a system followed the rules a human set. It is about who stays responsible when the system starts deciding on its own.
Sofia Khatsernova, Legal Function Owner at xpate, has been working through exactly that. With a background spanning private practice and in-house counsel, she sits where disruptive technology meets strict regulatory requirements. We interviewed her because while most of the industry focuses on what autonomous AI can do, she is focused on what it changes legally.
She explains why accountability does not disappear when decision-making is delegated to AI, what the EU AI Act and UK SMCR actually demand from institutions deploying these systems, and why concepts like meaningful control and traceability are becoming the real test of readiness for agentic finance.
1. For readers who may not be familiar with xpate, can you start by explaining what the company does and your role within the business?
xpate provides businesses with a unified platform for payments, card processing, banking access, and cross-border money movement. The goal is to reduce the operational complexity that often comes with managing multiple providers, integrations, and fragmented financial workflows, particularly for businesses operating internationally or in more heavily regulated sectors.
As the Legal Function Owner, my role focuses on the legal and regulatory side of that infrastructure. That includes everything from compliance and licensing to helping navigate how evolving technologies, including AI systems, intersect with financial regulation, governance, and risk management. More broadly, I’m focused on helping businesses scale safely and efficiently in an increasingly global and digital financial environment.
2. Financial systems have long relied on automation, but agentic AI introduces autonomy. What fundamentally changes from a legal and governance perspective when systems move from automation to autonomy?
This shift changes where decisions are made, and therefore where responsibility sits. In traditional systems, a human sets the rules and the system follows them, so it’s relatively easy to trace intent and assign responsibility. Most financial regulation is built around that assumption: even if technology supports the process, there is ultimately a person responsible for understanding, supervising, and approving what the system is doing.
Once decision-making is delegated to autonomous systems, that model starts to strain. The technology can now act independently, but the legal responsibility does not move with it. This is why regulators are increasingly focusing less on the technology itself and more on oversight and governance. Under frameworks such as the UK’s SMCR or the upcoming requirements in the EU AI Act, firms are still expected to demonstrate meaningful control over systems that may operate at speeds or levels of complexity that no human can realistically follow in real time. In practice, that means accountability shifts toward how the system was designed, monitored, constrained, and whether executives took reasonable steps to ensure it operated safely within defined boundaries.
3. As regulators place more emphasis on governance and accountability, how is the EU AI Act changing what financial institutions are expected to do in practice?
What’s changing is not the idea of accountability itself but the level of autonomy these systems are now able to operate with and the expectations regulators place on firms to remain in control of them. Under the EU AI Act, particularly for high-risk systems such as credit scoring or insurance assessments, institutions must be able to understand how decisions are made, intervene when necessary, and maintain clear records around system behaviour and decision-making.
The regulation explicitly rejects “autopilot” deployment for high-risk systems. If a financial institution cannot explain or oversee how a system reaches decisions, regulators increasingly view that as a governance issue rather than a technical limitation. In practice, this puts greater emphasis on traceability, monitoring, and the ability to override systems when something goes wrong.
4. What does “meaningful control” actually look like once systems operate faster than humans can realistically follow?
At a certain point, meaningful control stops being about watching every individual decision the system makes in real time. These systems can operate too quickly and across too many variables for that to be realistic. The focus instead shifts toward whether the institution built the right boundaries and safeguards around the system before it was deployed.
The technology may be capable of independent action, but legal and regulatory frameworks are still grounded in individual accountability. Institutions are therefore still expected to understand how these systems operate and remain capable of controlling them as autonomy increases.
5. Do you think financial institutions are underestimating how much accountability they will still retain when AI systems begin acting more independently?
I think some institutions still approach AI primarily as a tool that supports decision-making, while regulators are increasingly looking at autonomous systems as something that still requires clear governance, supervision, and documented responsibility around it.
What’s becoming clearer across both the EU and UK approaches is that responsibility does not disappear when decision-making is delegated to AI.
6. As AI systems start acting on behalf of the business, where does executive responsibility begin and end?
What’s changing is that responsibility is becoming tied less to individual decisions and more to the overall governance of the system. Regulators increasingly expect executives to understand the risks surrounding autonomous systems, how decisions are monitored, what safeguards exist, and how intervention would happen if something goes wrong.
Under frameworks like the UK’s SMCR, accountability is not limited to the people directly managing the technical systems. Regulators are increasingly focusing on whether leadership has put the right governance and oversight structures in place around these technologies.
7. If control shifts from real-time decision-making to predefined rules and permissions, what new risks does that introduce for users?
One of the biggest shifts is that users are no longer deciding on every transaction individually. Instead, they define preferences, limits, goals, and permissions upfront, while the system interprets those rules and acts on them continuously. Over time, the habit of actively managing transactions can give way to simply reviewing how the system is operating.
That changes the relationship users have with control and trust. Users may not fully understand how much authority they have delegated or how the system interprets their intent over time. Because of this, concepts like dynamic consent, micro-permissions, spending thresholds, and clear audit trails are becoming increasingly important in discussions around agentic finance.
8. What has surprised you most about how quickly these questions around AI and responsibility have moved from theory into practice?
The speed at which these questions moved from theory into day-to-day operational reality has been striking. Not long ago, most discussions around AI in finance were still centred around efficiency and automation. Now, firms are already starting to deal with practical questions around accountability and explainability.
I also think many institutions are realising that the hardest part is not necessarily the technology itself. The bigger challenge is that legal and regulatory frameworks are still built around ideas like individual responsibility and human oversight, while the systems themselves are becoming increasingly autonomous.
