US bank regulator releases first AI framework for examiners
The OCC releases its first AI framework for bank examiners
The U.S. Office of the Comptroller of the Currency (OCC) issued its first supervisory framework for artificial intelligence in banking. The framework tells examiners to focus less on how powerful an AI system is and more on what happens when it makes a mistake.
The framework also addresses outside AI agents. It says external agents operated by customers, fintechs, or other businesses could create risks for banks even when banks do not control those systems.
Main points at a glance
- The guidance is nonbinding and does not create new regulatory requirements.
- Examiners should consider consequences, reversibility, and human control.
- Fully autonomous payment agents are placed in the highest risk tier.
- The guidance covers AI in payments, fraud detection, customer service, and other banking operations.
- The OCC plans to update the guidance as the technology develops.
What the OCC guidance covers
The OCC stressed that the document does not create new regulatory requirements or enforceable standards for banks. Instead, it gives examiners a way to evaluate AI within existing operational, compliance, and cybersecurity risk categories. Banks are not required to establish a separate AI risk category.
The framework makes a distinction between technical sophistication and possible damage. The OCC said a simple agent allowed to initiate financial transactions may present greater risk than a more advanced model limited to writing internal documents.
Under the 22-page framework, examiners can consider the consequences of failure, whether an action can be reversed, and how much control humans retain. The agency outlines four illustrative risk tiers. Fully autonomous payment agents and real-time credit decision systems fall into the highest category, while basic internal productivity tools occupy the lowest.
Higher-risk systems may warrant tighter restrictions on autonomy, independent testing, and human approval before consequential actions proceed. Suggested safeguards include identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access. The framework also suggests circuit breakers, rate limits, restricted permissions, and emergency shutdown controls for systems that continue operating while making harmful decisions.
The document uses the term Super Intelligence. Its scope includes conventional AI and autonomous agents, not only hypothetical systems with intelligence beyond human capabilities. It also extends its risk considerations to external AI agents connecting through bank channels.
What Axios reported about outside agents
Axios reported on October 22 that major banks were discovering unauthorized third-party AI agents operating inside customer accounts. The report said some agents appeared to take actions beyond users' instructions.
According to Axios, Morgan Stanley was blocking outside agents. JPMorgan, Bank of America, and Citi were restricting access. The report said bank executives described the situation as horrifying.
Facts confirmed by the framework
The OCC has issued its first supervisory framework for AI in banking. The framework is nonbinding. It is intended to help examiners assess AI within existing risk categories. It places autonomous payment agents in the highest-risk category. The OCC said it intends to update the guidance as the technology develops.
What the OCC has not linked to the incidents
The OCC has not linked its issuance of the framework to the specific incidents reported by Axios. The material does not confirm that the reported incidents caused the framework to be issued.
Why the focus on consequences matters
The framework aims to address how customers can use AI assistants to manage finances without giving autonomous software unrestricted access to accounts. Its safeguards are intended to help banks and examiners assess outside agents that may connect through bank channels and act with delegated permissions.
Planned updates to the guidance
The OCC said it intends to update the guidance as the technology develops. No specific date for an update is given in the supplied material.
Where this information comes from
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Stellar CEO Proposes New Framework for Measuring Tokenized Assets
