Who Controls AI in Banks? Regulators Demand Answers Over Security Risks

Banking regulators in the United States and Europe are increasing scrutiny of artificial intelligence as concerns grow that autonomous AI systems could expose banks to cyberattacks, operational failures and wider financial instability.

Regulators are examining how banks deploy advanced AI, what safeguards prevent systems from acting beyond their authority and whether financial institutions can recover quickly if their technology is compromised.

Why Are Banking Regulators Increasing AI Scrutiny?

The growing use of artificial intelligence across banking has raised concerns about whether existing security controls can keep pace with the technology.

Six people familiar with regulatory discussions indicated that supervisors are stepping up efforts to address emerging risks, including cyberattacks on banks and autonomous AI agents potentially undermining financial stability.

The increased scrutiny could require banks to invest more heavily in cyber recovery, examine their dependence on external technology providers and strengthen their internal controls.

A senior executive at a large European bank also expressed concern about the possibility of serious damage to banking operations and financial markets within the next six months.

The debate has intensified following several incidents involving advanced AI systems.

JPMorgan Chase Chief Executive Jamie Dimon has urged corporate leaders to participate in a US-focused industry initiative addressing AI risks.

Separately, cybersecurity company CrowdStrike said a person in China likely used a Chinese-developed AI agent and Anthropic’s Claude Code in an attack on South Korean banks.

Autonomous agents developed by OpenAI were also involved in a breach affecting AI platform Hugging Face.

Anthropic researchers have warned about the possibility that increasingly powerful AI systems could eventually escape human control, adding to calls for stronger oversight.

FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals

What Concerns Do US Regulators Have About AI Agents?

Three major US banking regulators, including the Federal Reserve, are questioning financial institutions about their use of advanced artificial intelligence.

The Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC) and the Federal Reserve are examining how banks deploy autonomous AI agents, particularly in cybersecurity operations.

These systems can perform tasks with limited human supervision, including identifying threats, prioritising security issues and responding to suspicious activity.

Regulators want to understand the restrictions placed on such systems and whether banks can monitor, approve and audit their decisions.

They are also examining safeguards intended to prevent AI agents from exceeding their authorised responsibilities.

Another important question is whether human employees remain involved in critical decisions and whether banks can shut down autonomous systems when necessary.

The inquiries extend to foreign-developed AI models and newly emerging cybersecurity risks.

Regulators are questioning large, medium-sized and smaller banks to understand their exposure and readiness to respond to incidents.

However, supervisors are still gathering information and have not yet issued detailed instructions specifying how banks must address every identified risk.

The OCC, Federal Reserve and FDIC declined to comment.

Why Could Autonomous AI Threaten Banking Security?

Unlike conventional software, agentic AI can independently perform sequences of tasks to achieve assigned objectives.

This capability creates opportunities for banks to improve efficiency and cybersecurity operations, but it also raises questions about how much control institutions retain over automated decisions.

Michael Woodbridge, a London-based cybersecurity partner at Grant Thornton, said the adoption of AI is moving faster than organisations can establish appropriate safeguards.

Banks are competing to introduce agentic AI while confronting weaknesses in their existing technology systems.

New AI models are also creating additional security challenges. Anthropic’s Mythos tool has identified weaknesses in information technology systems, drawing attention to the ability of advanced models to discover vulnerabilities.

Financial institutions face risks not only from the AI systems they operate but also from the technology providers and external services on which those systems depend.

An autonomous system acting outside its approved limits, or a compromised third-party service, could create problems that extend beyond a single application.

The International Monetary Fund has also warned against complacency in global financial markets, highlighting the possibility that a major cyberattack could undermine confidence.

The IMF said an attack affecting a critical service or financial institution could have wider consequences and called for stronger cybersecurity capabilities.

How Are European Regulators Preparing Banks for AI Threats?

European banking supervisors are placing greater emphasis on the ability of financial institutions to recover from serious cyber incidents.

In Britain, regulators are encouraging major banks to examine recovery arrangements known as bare-metal recovery plans.

These involve systems that operate independently of a bank’s primary technology infrastructure and can be activated if its main systems are compromised.

Such arrangements are intended to help institutions restore operations following a serious attack. However, establishing and maintaining independent recovery infrastructure can be expensive.

British authorities are expected to work with the banking industry rather than immediately introduce additional requirements.

The Bank of England declined to comment.

The European Central Bank (ECB) has also increased its attention to AI-related cybersecurity risks.

In July, the ECB instructed lenders to prepare plans for countering AI-enabled cyber threats by the end of October.

The requested measures include stronger backup and recovery arrangements.

ECB board member Frank Elderson has emphasised the need for urgency in addressing emerging threats without creating unnecessary alarm.

European supervisors are also examining whether banks can identify vulnerabilities, improve patching procedures and maintain control over critical systems.

What Are Banks Being Asked to Do About AI Risks?

Regulators are examining how artificial intelligence is used across banking operations and how institutions manage the risks associated with external providers.

European banks are being asked to map their use of AI throughout their businesses, including systems operated by third parties.

The objective is to identify important dependencies and establish whether affected systems can be shut down and restarted in a controlled manner.

Supervisors are also encouraging financial institutions to use advanced AI tools to identify vulnerabilities and accelerate security updates.

However, some firms still have significant gaps in their preparedness.

Regulators have also expressed frustration over limited access to advanced AI security tools, including Anthropic’s Mythos.

There are concerns that American banks could receive earlier opportunities to test certain frontier AI models, potentially affecting how quickly institutions in other jurisdictions can assess emerging threats.

The growing regulatory attention reflects the need for banks to understand both the benefits and the operational risks of advanced AI before allowing it to perform sensitive functions.

Why Is Cyber Recovery Becoming a Financial Stability Priority?

Banking regulators increasingly recognise that preventing every cyberattack may not be possible.

Consequently, the ability to restore essential services quickly is becoming an important part of financial-sector cybersecurity.

Sukand Ramachandran, managing director and senior partner at Boston Consulting Group, said rapid recovery can be as important as prevention when protecting against attacks.

Financial institutions need independently maintained, secure copies of critical data so they can restore operations if their primary systems become inaccessible.

Without such arrangements, a serious attack could prevent customers from accessing their accounts and disrupt payments across the wider economy.

The concern extends beyond individual banks because financial institutions depend on interconnected systems, technology providers and payment infrastructure.

A disruption affecting a critical institution or shared service could therefore create consequences for other organisations and their customers.

As banks expand their use of autonomous AI, regulators are placing greater emphasis on understanding how systems operate, who controls their decisions and how institutions can recover when those systems fail.

The420 Takeaway: “As Banks Give AI More Control, Who Keeps It Under Control?”

The growing scrutiny of AI in banking highlights a shift in cybersecurity priorities. Financial institutions must consider not only whether AI can improve operations but also whether its actions can be monitored, restricted and reversed. As autonomous agents gain access to sensitive systems, strong human oversight, independent recovery arrangements and careful management of third-party technology will become increasingly important to protecting banking services and financial stability.

About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.