The U.S. Office of the Comptroller of the Currency (OCC) has issued its first supervisory framework for artificial intelligence in banking. The guidance directs federal examiners to evaluate banks based on the consequences of AI errors rather than the technical sophistication of the underlying models.
The document is nonbinding and does not establish new regulatory requirements or enforceable standards for financial institutions. Instead, it provides a risk-based approach for supervisors to assess how banks manage AI-related exposures.
Focus on External Agents
A central component of the framework addresses risks stemming from external AI agents operated by customers, fintechs, or other third parties. The OCC warns that these systems can create significant risks for banks even when the institutions do not control them directly.
To mitigate these threats, the agency suggests examiners consider whether banks have implemented safeguards such as identity verification, delegated permissions, transaction limits, continuous monitoring, and the ability to suspend or revoke access. Fully autonomous payment agents and real-time credit decision systems are categorized as highest-risk activities under the new guidance.
Industry Context
The release of the framework follows reports that major banks recently discovered unauthorized third-party AI agents operating within customer accounts. According to an Axios report published on October 22, Morgan Stanley was blocking outside agents, while JPMorgan, Bank of America, and Citigroup were restricting access. Bank executives described the situation as "horrifying," citing concerns over control once an autonomous agent accesses financial resources.
The OCC document uses the term "Super Intelligence" in place of "artificial intelligence," aligning with terminology mandates from the Donald Trump administration.
