US Bank Regulator Issues First AI Framework as Banks Battle Rogue Agents

The U.S. Office of the Comptroller of the Currency issued its first supervisory framework for AI in banking on October 22, 2026, directing examiners to weigh the consequences and reversibility of AI failures rather than model sophistication. The 22-page bulletin, which is nonbinding and creates no new regulatory requirements, outlines four risk tiers — placing fully autonomous payment agents and real-time credit decision systems in the highest category — and suggests safeguards such as identity verification, delegated permissions, transaction limits, circuit breakers and emergency shutdown controls for outside AI agents. The guidance follows Axios reporting that Morgan Stanley was blocking third-party agents while JPMorgan, Bank of America and Citi were restricting access after unauthorized agents were found operating inside customer accounts.

In brief - The OCC has issued its first framework for examiners assessing banks' use of AI, focusing on consequences and autonomy rather than model sophistication. - The guidance explicitly addresses outside AI agents, echoing concerns raised by major banks. - The framework is nonbinding, but provides examples of safeguards for autonomous payments, third-party access, and human oversight. The U.S. Office of the Comptroller of the Currency issued https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-54.html its first supervisory framework for artificial intelligence in banking today, telling examiners to focus less on how powerful an AI system is and more on what happens when it makes a mistake. The OCC's framework addresses that very concern, although the regulator has not linked its issuance to those specific incidents. In a section covering operational resilience, the agency warns that external agents operated by customers, fintechs, or other businesses could create risks for banks even when the banks don't control those systems. It suggests examiners consider measures including identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access. The guidelines aim to tackle the dilemma of how to let customers use AI assistants to manage their finances without giving autonomous software unrestricted access to accounts that banks are already facing. The new OCC guidance arrives less than two weeks after reports https://decrypt.co/381602/banks-rogue-ai-agents-inside-customer-accounts that major banks were discovering unauthorized third-party AI agents operating inside customer accounts, sometimes taking actions that appeared to go beyond users' instructions. Morgan Stanley was blocking outside agents, while JPMorgan, Bank of America, and Citi were restricting access, according to an Axios report on October 22. Bank executives described the situation as "horrifying," raising questions about who controls an autonomous agent once it has access to someone's money. AI that moves money is riskier than one that writes emails The OCC's framework makes a distinction between an AI system's technical sophistication and the damage it could cause. A simple agent authorized to initiate financial transactions may present greater risk than a more advanced model limited to writing internal documents, the regulator said. Under the 22-page framework https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-97a.pdf , examiners can consider the consequences of failure, whether an action can be reversed, and how much control humans retain over the system. The agency outlines four illustrative risk tiers. Fully autonomous payment agents and real-time credit decision systems fall into the highest category, while basic internal productivity tools occupy the lowest. Higher-risk systems may warrant tighter restrictions on autonomy, independent testing, and human approval before consequential actions can proceed. The framework also addresses AI systems that continue operating while making harmful decisions. Suggested safeguards include circuit breakers, rate limits, restricted permissions, and emergency shutdown controls. Those considerations are especially relevant to the outside agents described in Axios 's earlier reporting, where banks struggled to distinguish legitimate customer-authorized software from systems operating beyond their intended permissions. Guidance, not new banking rules The OCC stressed that the document does not create new regulatory requirements or enforceable standards for banks. Instead, it gives examiners a way to evaluate AI within existing operational, compliance, and cybersecurity risk categories. Banks are not required to establish a separate AI risk category. The document uses the mandatory https://www.whitehouse.gov/presidential-actions/2026/09/inaugurating-the-era-of-super-intelligence/ term "Super Intelligence," which the Donald Trump administration insists on using in place of “artificial intelligence,” but its scope includes conventional AI and “autonomous agents” rather than only hypothetical systems with intelligence beyond human capabilities. The framework covers AI used in payments, fraud detection, customer service, and other banking operations. It also extends its risk considerations to external AI agents connecting through bank channels. The OCC said it intends to update the guidance as the technology develops. For now, its illustrative risk scale puts autonomous payment agents in the highest-risk category, regardless of how well they perform in testing. Daily Debrief Newsletter Start every day with the top news stories right now, plus original features, a podcast, videos and more. Join 72,000+ readers Add on Google https://www.google.com/preferences/source?q=decrypt.co