Follow us on Google News
A major US banking regulator has issued its first framework for examining how banks use artificial intelligence, directing supervisors to focus on what automated systems are allowed to do and the damage they could cause if something goes wrong.
The Office of the Comptroller of the Currency (OCC) released the framework on November 4, 2026, as financial institutions increasingly experiment with AI tools capable of making decisions, processing information and carrying out tasks with limited human intervention.
The guidance covers advanced AI and autonomous systems, including AI agents that can execute actions rather than simply provide information.
However, the regulator has chosen not to treat artificial intelligence as an entirely separate category of banking risk.
Instead, examiners have been instructed to assess AI within existing frameworks covering technology, governance, compliance, operational security and risk management.
The regulator also clarified that the document does not introduce new legally enforceable requirements for financial institutions.
AI Agents Handling Money Could Face Greater Scrutiny
A central feature of the framework is its emphasis on the consequences of AI-related failures.
The OCC has instructed examiners to look beyond the technical sophistication of a particular AI system and consider what could happen if it makes a mistake or is misused.
For example, a relatively simple AI agent authorised to initiate financial transactions could present greater risk than a more advanced AI model used only to analyse internal documents.
The distinction matters because not every powerful AI system has direct access to sensitive banking functions.
An AI chatbot that summarises routine information may produce inaccurate responses, but an automated system authorised to move funds could potentially cause immediate financial losses.
The regulator wants supervisors to assess how much independent authority is given to an AI system and whether people can intervene before harmful actions occur.
Higher-risk applications may therefore require closer human oversight or tighter restrictions on what automated systems are permitted to do.
This approach focuses attention on the practical consequences of using AI rather than assuming that newer or larger models are automatically more dangerous.
No Separate AI Risk Category Required
The OCC has also clarified that banks do not need to establish a separate AI risk appetite under the new framework.
A risk appetite refers to the level of risk an institution is prepared to accept while conducting its business.
Banks already operate within supervisory requirements covering operational risks, information security, financial controls and regulatory compliance.
The new framework allows examiners to evaluate AI within those existing arrangements while considering additional challenges associated with automated technologies.
For example, a bank using AI to support an internal administrative function may require different controls from one allowing an AI agent to interact with customers or financial systems.
Supervisors must also consider the institution’s size, complexity and overall risk profile.
A smaller community bank experimenting with limited AI tools should not automatically face the same examination approach as a large financial institution operating autonomous systems across multiple business activities.
The OCC said its framework is intended to support consistent supervisory assessments without imposing a uniform technical standard on every institution.
Importantly, the document is directed at bank examiners.
It does not require banks to adopt specific AI systems, establish new departments or comply with a fresh set of AI-specific regulations.
Cybersecurity And Financial Stability Concerns Grow
The move comes as financial regulators internationally examine how artificial intelligence could affect banking security and operational stability.
Banks are exploring AI for functions ranging from customer service and fraud detection to internal research and software development.
More advanced systems can potentially carry out sequences of tasks without requiring a person to approve every individual step.
While these capabilities may improve efficiency, they also create questions about accountability when automated systems make errors.
An AI tool connected to sensitive financial infrastructure could produce incorrect instructions, mishandle confidential information or take actions beyond what its operators intended.
Cybersecurity risks may also increase if criminals exploit weaknesses in AI applications or compromise the systems through which automated agents operate.
Earlier investigations by regulators in the United States and Europe have examined whether banks understand the models they use, maintain adequate oversight and can stop automated processes when necessary.
Financial institutions are also increasingly dependent on external technology providers for computing infrastructure and AI services.
That dependence can complicate oversight when critical operations rely on systems developed or operated outside a bank’s direct control.
The OCC’s approach places responsibility on examiners to understand these practical risks within the existing banking supervision process.
Framework Will Evolve With AI Technology
The supervisory framework uses the term ‘Super Intelligence’ to describe technologies previously covered by the broader definition of artificial intelligence, as well as their advancing capabilities.
This terminology does not mean that the regulator has established the existence of human-level or beyond-human AI systems operating in banks.
Rather, it reflects the terminology used in the government’s current policy framework.
The OCC said the guidance will be updated as AI technology develops and supervisors gain a better understanding of emerging applications.
The document also emphasises that banks must continue to operate safely and comply with existing laws, regardless of whether their activities use traditional software or newer AI technologies.
For the financial sector, the development signals greater supervisory attention to the authority given to automated systems.
The key issue is no longer simply whether a bank uses artificial intelligence, but how much control it delegates and whether effective safeguards remain in place when financial consequences are possible.
What This Means For You:
Bank customers should not interpret the guidance as permission for AI systems to move money without safeguards. Financial institutions remain responsible for maintaining appropriate controls over automated services and protecting customers under existing banking requirements.
