Agentic AI Inherits the BCBS 239 Bill: Budget for Plumbing, Not Models

Barney Krishnan, a data executive at UniCredit, argues in a Forbes Tech Council post that beneath the agent interface sits a plain constraint: AI agents are only as reliable as the data foundations they reason over ^[1][18][2]. He frames it as deja vu, because after the 2008 financial crisis global banks were pushed into the same structural problem by BCBS 239 for risk data aggregation and CCAR for capital stress testing, mandates that established you cannot calculate capital adequacy or report systemic risk on fragmented, untraceable pipelines ^[3][4].

That analogy is the useful part of the piece, and it lands on the budget rather than the architecture diagram. Krishnan's account of the history is that governance began in the early 1990s as administrative control and schema management, was pushed into the executive spotlight by the mid- to late 2000s, and then consumed large amounts of capital mapping technical metadata, business glossaries, taxonomies, ontologies and lineage ^[5][6]. The result he reports is the awkward one: despite decades of effort and millions in capital expenditure, true end-to-end lineage across a mosaic of custom builds and commercial off-the-shelf products stayed out of reach, working well only inside a single vendor's ecosystem ^[7].

Read that against the agent pitch. The capability claim is that advanced agents can scan legacy solutions, analyse code footprints, parse partially written requirements and profile underlying data to reconstruct enterprise logic ^[15]. The reconstruction is drawn from the same fragmented sources that defeated lineage projects, so the ceiling on agent output is set where the last programme stopped. Krishnan's own framing concedes the point: the objective is identical to the compliance era and only the consumer has changed, from regulators to what he calls deterministic AI ^[8].

What he proposes is two pillars. The schematic layer covers tables, columns, data types and API definitions, increasingly standardised through the Model Context Protocol so agents can discover schemas, understand tool exposures and connect to diverse sources ^[9][10]. The semantic layer interprets business context, profiles legacy code and watches data in motion, and he insists it cannot be a static catalogue ^[11]. His mechanism for keeping it live, which he calls Interaction Certification, is a continuous loop that monitors, verifies and logs every discrete interaction between an agent and a dataset ^[12]. The security half is the same shift: broad role-based access control, where a human analyst with read access could query any table in a database, does not survive contact with autonomous agents, and unmonitored breadth invites security exposure ^[13][14].

Strip the coinages and this is a metering, logging and access-mediation build with a permanent operating cost, and the column supplies no figures for it beyond the historical "millions" ^[17]. It is one practitioner's argument, not measured evidence.

Watch three things. Whether firms can produce lineage across COTS boundaries where earlier, better-funded attempts failed ^[7]. Whether MCP tool exposures get inventoried and revoked with the discipline of a permissions regime rather than a discovery convenience ^[10]. And whether any agent programme discloses the split between model and inference spend and spend on metadata, lineage and runtime authorisation, because that ratio is the honest cost of the programme.