Banking regulators in the United States and Europe are increasing scrutiny of how banks use advanced artificial intelligence, amid concerns that cyberattacks or poorly controlled AI agents could disrupt financial institutions and, in extreme cases, threaten wider financial stability.
Regulators are asking banks how they use powerful AI models, whether autonomous systems can be stopped quickly and how dependent they are on outside technology providers.
The new scrutiny comes as banks move beyond traditional machine-learning tools and begin experimenting with generative and agentic AI for cybersecurity, customer service, compliance and internal operations.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
US regulators are asking banks how AI agents are controlled
Three major US banking regulators, including the Federal Reserve, are questioning banks about their use of advanced AI systems.
Their questions include whether institutions use Chinese-developed AI technology, whether AI agents are deployed in cyber defence and how much freedom those systems are given to act without human approval.
Regulators are also asking whether banks can shut down autonomous systems if they start behaving unexpectedly.
That issue matters because an AI agent is different from a normal chatbot.
A chatbot mainly responds to a user. An AI agent can be given access to tools and systems, allowing it to perform tasks, make decisions and take multiple actions with less direct human supervision.
Inside a bank, such systems could potentially monitor cyber threats, analyse transactions or help manage operational processes.
The concern is what happens if an agent makes a serious mistake, is manipulated by an attacker or takes an action that nobody intended.
US regulators have not yet announced new binding rules specifically covering these systems. The current focus appears to be on understanding how banks are deploying them and whether existing controls are strong enough.
Europe focuses on recovery and dependence on outside providers
European regulators are examining the same problem from another angle.
Supervisors including the Bank of England and European Central Bank are pressing institutions to strengthen recovery plans in case AI systems fail or contribute to cyber disruption.
Banks increasingly rely on a small number of technology companies for cloud infrastructure, AI models and other critical services.
That creates concentration risk.
If many major banks depend on the same AI provider and that system experiences a serious failure, the problem may not remain limited to one institution.
A disruption could potentially affect several banks at once.
Regulators therefore want lenders to understand where their most important AI systems come from, what happens if those services become unavailable and whether they can continue operating without them.
The problem is similar to relying on a single supplier for an essential component. If that supplier fails, every customer depending on it can face trouble at the same time.
Existing US guidance leaves agentic AI outside its main model rules
The regulatory challenge is partly caused by how quickly the technology is changing.
In April, the Federal Reserve, Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation issued revised guidance on model risk management.
The framework covers traditional quantitative models and certain forms of non-generative AI.
But it specifically leaves generative AI and agentic AI outside its main scope because regulators described those technologies as novel and rapidly evolving.
That does not mean banks can use them without controls.
Instead, institutions are expected to manage the risks through other governance, cybersecurity and operational-risk systems while regulators decide whether more specific rules are needed.
The gap is significant because these are exactly the technologies now attracting the most attention from supervisors.
Traditional banking models might calculate credit risk or forecast losses.
Generative AI can produce new text or code, while agentic systems may interact directly with software and take actions.
That creates risks that older banking rules were never designed to address.
Cyberattacks are driving financial stability concerns
Banks are attractive targets for cybercriminals because they hold money, payment data and sensitive customer information.
AI could make that threat more serious.
Attackers can use AI to write malicious code, automate phishing campaigns and search more quickly for vulnerabilities.
Banks can also use the same technology defensively, for example to detect suspicious behaviour or respond faster to attacks.
The problem is that putting greater decision-making power into autonomous systems introduces a new type of operational risk.
A poorly configured defence agent could block legitimate systems, take the wrong action during an attack or interact unpredictably with other technology.
Regulators are therefore looking beyond the question of whether AI improves productivity.
They increasingly want to know whether banks can recover when an AI system fails and whether one failure could spread across institutions.
This follows a broader shift in financial regulation.
Cybersecurity was once treated mainly as an internal technology problem. Regulators increasingly see it as a financial stability issue because the same digital infrastructure is shared across banks, payment companies and markets.
What this means for you:
Banks may face stricter controls before using autonomous AI for sensitive financial or cybersecurity tasks. Customers may not notice those controls directly, but they are designed to reduce the risk that one AI failure disrupts banking services or exposes financial data.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
