SigillorAgent gate Join the design partner programDesign partners
For Swiss private banks and wealth managers

Check every AI-agent action before your bank executes it. Seal the proof.

Sigillor Gate sits in front of execution. Each action proposed by an AI agent (your RM copilots and operations agents today, your clients' agents tomorrow) is tested against the client mandate and your policy: pass, block or escalate. Every decision is sealed in an independently verifiable record, ready for disputes, AML investigations and audits. Hosted in Switzerland. Keys held by the bank.

Join the design partner program See how it works
In design. We are looking for a small group of Swiss institutions to shape it. Not yet generally available.
Illustrative. No real data.
The problem

AI agents are already acting inside banks. Controls still run after the fact.

Banks are rolling out RM copilots and operations agents that draft and prepare payments, orders and client communications. FINMA Guidance 08/2024 expects an inventory, controls, documentation and independent review for them. Most controls today are reviews after execution. Next, clients will start delegating payments, transfers and orders to AI agents of their own. Open protocols such as Google's Agent Payments Protocol (AP2) give those agents signed, verifiable mandates. But the evidence ends up spread across the client's agent platform, the credential provider and the bank's own systems, and nobody is responsible for keeping it together.

When a client contests an instruction, an AML investigator asks for the chain of events, or an auditor asks how an AI-initiated execution was controlled, the bank has to rebuild the story from fragments.

"Specific details of how this is used for dispute resolution, retention, and retrieval requirements are outside the scope of this specification."AP2 specification, on mandate evidence

Three questions a bank should be able to answer in minutes, not weeks:

  1. Was this instruction within the client's mandate?Which mandate, which limits, signed when and by whom.
  2. Which agent acted, and on whose behalf?Agent identity, platform and delegation chain.
  3. What did the bank check, and what did it execute?Sanctions, limit and authentication outcomes, then the booking reference.
How it works

Check, decide, seal.

Every action an agent proposes passes the Gate before it reaches execution. The decision, and the reasons for it, become a sealed record that links what was authorised to what the bank did.

Pass

Within the mandate and policy: the action proceeds and the decision is sealed.

Block

Outside the mandate (unknown beneficiary, over the limit, unregistered agent): stopped before execution, with the failing clause shown.

Escalate

Within the mandate but policy-sensitive (four-eyes, high-risk jurisdiction): routed to a reviewer queue.

1

Mandate & policy

The client mandate (scope, limits, approved beneficiaries; later signed AP2 mandates) and your bank policy rules are versioned and registered.

2

Agent & action

The agent is checked against your agent register, and the proposed action is captured before it executes.

3

Gate decision

Pass, block or escalate, with the rules that fired. Any human review is added as an event.

4

Execution

The execution in your core banking system is linked by booking reference and timestamp.

✓

Sealed record

Each entry is appended to a hash-chained, append-only log, time-stamped by a Swiss timestamping authority and periodically anchored.

Retrieve by transaction

Any instruction can be pulled up by its transaction identifier, and the whole chain exported as an audit pack: a readable report plus a signed, machine-verifiable bundle.

Neutral by design

Sigillor is not the client's agent platform, not the bank's core system and not a payment network. It holds the record between them, so every party can rely on the same evidence.

What an audit pack contains

  • The original signed mandate(s) and receipts, with their verification results
  • Agent identity and delegation chain
  • The bank's check events and their outcomes
  • Execution reference and timestamps
  • Integrity proofs (hash chain, timestamps, anchors) that anyone can verify independently
  • A control mapping to FINMA 08/2024, the EU AI Act logging articles and DORA, for your auditor to assess
Use cases

Where the record pays for itself.

Five situations a Swiss private bank can expect as AI agents (the bank's own first, then clients') start preparing and sending instructions, and what Sigillor puts on the table in each one.

01

Client dispute

“I never authorised that.”

Illustrative scenario

What happens

A client's AI agent, acting under a standing mandate, instructs the bank to sell an equity position and wire CHF 2 million to an external account. The bank executes.

What goes wrong

Two days later the client says they never authorised it. The evidence sits in the agent platform's logs, the order system, the screening tool and the core banking system, owned by different teams in different formats. Piecing it together takes weeks of emails, and the relationship suffers in the meantime.

What Sigillor produces

One sealed record for the transaction: the client's signed mandate and its limits, the agent's instruction, the bank's checks and their outcomes, and the booking reference, all time-stamped and tamper-evident. It can be retrieved by transaction ID, so the facts can be established in hours rather than weeks.

Who uses it

The relationship manager, Legal and Compliance and, where needed, the client and their counsel.

02

AML investigation

“Who actually gave this instruction?”

Illustrative scenario

What happens

Transaction monitoring flags an unusual outgoing transfer. Instructions on this account can come from the client, from the client's AI agent and, occasionally, from the relationship manager.

What goes wrong

Before deciding whether to file a suspicious activity report with MROS, the MLRO has to establish who initiated the transfer, under what authority and what was checked. Partial or inconsistent records weaken both the analysis and the file.

What Sigillor produces

The chain of origin for the instruction: whether it came from the agent under a client mandate, what that mandate permitted, which delegation applied, which checks ran and who approved any override. The record is sealed, so the file holds up when it is reviewed later.

Who uses it

The MLRO and the AML investigations team, for the internal case file behind a MROS report, and later the auditor. Sigillor holds only pseudonymised references; client identities stay at the bank.

03

FINMA or external audit

“Show us you control client AI agents.”

Illustrative scenario

What happens

During the regulatory audit, the audit firm asks how the bank governs instructions from clients' AI agents, in line with FINMA Guidance 08/2024 on documentation, controls and explainability.

What goes wrong

The bank can describe its policy but struggles to evidence it for a sample of transactions. Each sampled item means pulling data from several systems by hand, and the gaps show.

What Sigillor produces

A ready-to-share audit pack for any sample or period: per-transaction evidence chains, signature verification reports, integrity proofs and a mapping to the relevant FINMA 08/2024 expectations, for the auditor to assess.

Who uses it

Compliance, Internal Audit and the external regulatory auditor, and FINMA if it asks.

04

Mandate overreach

“The control worked. Can you prove it?”

Illustrative scenario

What happens

A client's mandate allows the agent to rebalance up to CHF 250,000 a day, in a defined list of instruments. The agent sends a larger order for an instrument that is not on the list.

What goes wrong

At first, nothing: the bank's limit check blocks the order. But when the client asks why the order failed, or the auditor asks whether limit controls actually work for agent instructions, a refused order often leaves little usable trace.

What Sigillor produces

A sealed record of the refused instruction: the mandate's limits, the agent's request, the check that blocked it and the reason, and the notification to the client. It shows that the control worked, not just that it exists.

Who uses it

Operations and Risk, Compliance for its control-testing file, and the relationship manager when explaining the refusal to the client.

05

Counterparty dispute

“Who is liable?”

Illustrative scenario

What happens

A payment initiated by a client's AI agent reaches the wrong beneficiary. The agent platform says the bank acted outside the mandate, the payment provider says it passed on what it received, and the bank says it followed the instruction.

What goes wrong

Each party has its own logs, and none of them trusts the others'. Without a shared reference, the dispute turns on whose systems are believed, and it can drag on.

What Sigillor produces

One neutral record of the signed mandate, the instruction as received and the bank's checks and execution. Its integrity proofs are designed so any party can verify them independently, without having to trust Sigillor or one another.

Who uses it

The bank's legal team, the agent platform and the payment provider, their counsel and, if it comes to that, a mediator or court.

All scenarios are illustrative. They describe how Sigillor is designed to work and do not refer to real clients, institutions or incidents. Amounts are examples only.

How it works for the bank

The Gate starts in shadow mode, evaluating alongside your agents without blocking anything. Enforcement comes only when you decide.

01 · CONNECT

Connects to your core

A read-only connector inside your bank links agent actions to executions in core banking systems such as Avaloq or Temenos.

02 · CHECK

Gates every action

Each proposed agent action is checked against the mandate and policy: pass, block or escalate. Signed client-agent mandates (such as AP2) can be added later.

03 · SEAL

Seals every step

Mandate, action, decision, review and execution are appended to a hash-chained, co-signed, time-stamped log that anyone can check with an open-source verifier.

04 · RETRIEVE

Retrieval in seconds

Any record can be pulled up by transaction ID and exported as an audit pack.

Avaloq and Temenos are trademarks of their respective owners and are named only as examples of core banking systems. They are not partners, and no integration with them is in production.

Regulation

Built around what supervisors and auditors already ask for.

FINMA · Guidance 08/2024

Documented, explainable AI use

FINMA expects governance, documentation, explainability of material decisions and independent review for AI use, including AI provided by third parties. Sigillor produces the documentation trail for agent-initiated instructions.

EU AI Act · Art. 12, 19, 26

Logging and retention

Logging, log retention and deployer obligations for high-risk AI systems apply from 2 December 2027 (as amended by Regulation (EU) 2026/1744). Whether a given agent use case is high-risk depends on the case. Sigillor gives you the log either way.

DORA · ICT risk

Tamper-protected logs, third-party control

For EU entities: ICT logging with retention, tamper protection and synchronised time, plus third-party audit and exit rights. Sigillor is designed to fit into your DORA third-party register and contracts.

Sigillor supports your compliance work. It does not replace your own assessment, legal advice or your auditor's judgement, and it has not been reviewed or endorsed by FINMA or any other authority.

Swiss residency

Swiss hosting. Bank-held keys. No client names.

Designed from the start for Swiss banking secrecy and outsourcing rules.

Hosted in Switzerland

Records are stored and processed in Swiss data centres.

Bank-held keys

Encryption keys stay in your HSM or key management service. Revoke them and the data becomes unreadable.

Pseudonymised

Sigillor sees pseudonymous client references, never names or plaintext client identifiers.

Outsourcing-ready

Designed to meet the safeguards expected under Art. 47 BankG and FINMA Circ. 2018/3, including audit and inspection rights for the bank, its auditor and FINMA.

Write once

Object-lock storage. Records can be added, never altered.

Design partner program

Shape it with us.

We are looking for a small number of Swiss private banks, wealth managers and their auditors to run a 3-month Gate pilot on one to three of their own AI agents, in shadow mode first, and to shape the audit pack and core-banking integration before general availability.

  • Direct input into the evidence format and audit-pack structure
  • A 3-month paid pilot on test or pseudonymised data in a Swiss environment, credited against year one
  • An early review of the outsourcing and secrecy documentation
  • Preferential terms at launch

What we ask: 30–45 minutes to start, then a short working session each month.

Join the design partner program

Write to us with your name, institution and role, and a line on what you would like to discuss. We reply personally.

Email hello@sigillor.com

or write directly to hello@sigillor.com

No forms, no cookies, no tracking. Your email is used only to reply to you. See our privacy notice.