The U.S. Office of the Comptroller of the Currency (OCC) issued its first supervisory framework for artificial intelligence in banking on November 4, directing examiners to evaluate AI systems by the damage they could cause rather than by their technical sophistication2.
The framework is nonbinding and does not create new regulatory requirements or enforceable standards for banks. Instead, it gives examiners a structured way to assess AI within existing operational, compliance, and cybersecurity risk categories.
Consequence over capability
Under the 22-page document, examiners can weigh the consequences of failure, whether an action can be reversed, and how much human control remains over a system. A simple agent authorized to initiate financial transactions may present greater risk than a more advanced model limited to writing internal documents.
The agency outlines four illustrative risk tiers. Fully autonomous payment agents and real-time credit decision systems fall into the highest category, regardless of how well they perform in testing. Higher-risk systems may warrant tighter restrictions on autonomy, independent testing, and human approval before consequential actions can proceed.
Suggested safeguards include circuit breakers, rate limits, restricted permissions, and emergency shutdown controls. The framework also addresses AI systems that continue operating while making harmful decisions.
Outside agents in the crosshairs
The guidance explicitly addresses external AI agents connecting through bank channels. In a section on operational resilience, the OCC warned that agents operated by customers, fintechs, or other businesses could create risks for banks even when the banks do not control those systems. Examiners are told to consider identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access.
The framework arrives less than two weeks after reports that major banks were discovering unauthorized third-party AI agents operating inside customer accounts. JPMorgan, Bank of America, and Citi were reportedly restricting access, while Morgan Stanley was blocking outside agents.
The OCC said it intends to update the guidance as the technology develops.
ANALYSIS By anchoring examiner scrutiny to real-world consequences rather than model complexity, the OCC framework sidesteps the fast-moving definitional debates around AI capability tiers and instead ties regulatory attention to the operational risks banks already manage — a design that could remain relevant even as underlying models change rapidly.