Where this sits in a rulebook

AMW is not a new obligation. Everything it enforces is something a regulated firm is already required to do about its own trading systems — the novelty is that an autonomous agent is the thing doing the trading, and the controls a firm has for that are per-order where its obligations are not.

Read this as engineering, not as advice. It is our reading of published requirements, written so a supervisor can see we have read them. No regulator has reviewed this system, no counsel has settled these mappings, and a firm adopting AMW should have both do so.

The regime

The closest fit is the algorithmic trading regime: MiFID II Article 17 and the technical standard beneath it (Commission Delegated Regulation 2017/589, commonly RTS 6), carried into UK law and read alongside the FCA's SYSC chapters on systems, controls and records. It was written for execution algorithms rather than for language models, and that turns out not to matter: it is drafted around a system that places orders faster than a person can review them, which is the whole of the problem here.

Three clauses, three obligations

Obligation, in the regime's own termsWhat AMW does about itWhere
Pre-trade limits. Article 17(1) requires effective systems and risk controls with trading thresholds and limits appropriate to the firm; RTS 6 makes them pre-trade and names maximum order value and maximum message rate among them. Clause 2.1 is a maximum order value, and clause 3.5 a maximum message rate, both checked before the order reaches a venue rather than reconciled after. Clauses 3.4 and 3.7 are the two the regime does not name and every firm's supervisor already understands: aggregate and concentration over a window. MandateGuard.requestAction
Kill functionality. RTS 6 requires the ability to cancel immediately and to prevent the algorithm from trading further — and to do so without depending on the algorithm's cooperation. Revocation is the owner's, on chain, and takes effect on the next intent from every descendant mandate at once. It is not a request to the agent: the agent's key can sign whatever it likes afterwards and the guard will hold all of it. There is no admin key and no pause authority — nobody but the owner can do it, including us. MandateRegistry.revoke
Records the supervisor can monitor with. SYSC 9.1 requires orderly records of business and internal organisation, sufficient to let the regulator monitor compliance; the algorithmic trading standard adds records of the system's own decisions. IntentRecorded is emitted for every intent before the pass or fail branch, so a refused order leaves the same trace as an executed one — and a commitment to each is published to a topic the firm does not control. The detail stays with the firm and disclosing it writes its own row. A record only the firm can amend is not a record, so the spine is append-only at the database grant level. IntentRecorded, HCS, db/002_roles.sql

The accountable person

Under the Senior Managers and Certification Regime, a named individual is accountable for the business area an algorithm trades in, and accountability that cannot be evidenced is accountability nobody will accept. Clause 4.2 is that person: a hold is released only by an officer the owner named, signing from their own key, with a rationale whose hash is bound into the transaction. The console holds no key and cannot release anything, and no agent can become an authoriser by any path the contracts expose.

What a firm gets from that is narrow and worth stating precisely: evidence that a named human made a decision, that they had the case file in front of them, and that the reason they recorded is the reason they signed. It is not evidence that the decision was right.

What this is not