Banking
Deployment record
In the tracker →- Organisation
- Office of the Comptroller of the Currency
- System
- AI framework
- Stage
- Announced
- Function
- evaluate banks' use of AI
- 01The OCC released its first framework on evaluating banks' use of AI on November 4, 2026, focusing on the potential consequences and human oversight rather than technical sophistication.
- 02The framework outlines four risk tiers for AI systems, with the highest tier involving systems that take direct actions with significant impacts, such as autonomous payment agents.
- 03Controls recommended for AI agents include circuit breakers, rate limits, and kill switches to manage risks associated with their use.
Show all 5Show less
- 04The OCC does not require banks to define a separate risk appetite for AI, as it affects existing risks like operational and compliance risk.
- 05Major US banks are already restricting the use of outside AI agents in customer accounts, with several institutions implementing new policies regarding AI interactions.
Office of the Comptroller of the Currency
Follow Deployed on Google
The Office of the Comptroller of the Currency (OCC) has issued its first framework for how examiners should evaluate banks' use of AI.
Released on November 4, 2026, the framework gives the regulator's examiners a way to assess how national banks and federal savings associations use AI and AI agents in everyday business, including credit, payments, fraud and customer service.
Its central test is what an AI system can do, not how advanced it is. The framework says classification may rest on "potential consequences, transfer of agency, and the degree of human oversight," rather than technical sophistication.
Under that approach, it says "a simple rules-based agent authorized to initiate transactions could present greater risk" than "a sophisticated model limited to internal drafting assistance."
The OCC uses the term "Super Intelligence" throughout the document. A footnote says the term refers to the technologies previously covered by "Artificial Intelligence" under federal law.
Four Tiers of Risk
The framework sets out four illustrative risk tiers for examiners. The highest tier, labeled critical, covers systems that take direct action with high impact that is difficult or impossible to reverse. \
Examples include autonomous payment agents, real-time credit decisioning, releasing fraud holds and market access.
The second tier covers systems that take direct action or provide heavily weighted decision support, with a human monitoring the process.
Examples include AI-assisted underwriting, customer communications initiated by agents, and the disposition of anti-money laundering alerts.
The third tier covers decision support where a human must be involved in each decision, data sensitivity is limited and outcomes can be reversed, such as summarizing internal credit memos.
The lowest tier covers internal productivity tools and general employee Q&A with no customer or financial data exposure and no direct action.
The week's banking, insurance and brokerage deployments. Tuesdays.
Higher-risk uses may call for tighter controls, limits on autonomy or more direct human supervision.
Controls for Agents
The framework lists controls examiners can look for when banks use agents. It cites "circuit breakers, rate limits, least-privilege permissions, and kill switches" as ways to contain a system, and says the breadth of an agent's permissions and tool access "may be treated as part of the attack surface."
It also suggests thresholds that could trigger reduced autonomy or suspension of a system. The framework also addresses agents that banks do not run themselves.
"Customer, counterparty, fintech, or agentic-commerce systems that the bank does not control could present channel risk," it says. For interactions with external agents, it lists identity, delegation, authentication, monitoring, velocity limits, dispute handling, suspension and revocation as areas for banks to calibrate.
No Separate AI Risk Category
The OCC said examiners should not treat AI as a separate and distinct risk category, and that banks are not required to define a separate risk appetite for it.
Instead, AI affects existing risks such as operational, compliance and credit risk, and the framework supplements the OCC's existing supervision of model risk management, technology and compliance.
The regulator said it takes a technology-neutral approach. Whether banks use traditional methods or new technologies, their activities should be conducted safely, soundly and in line with applicable laws.
Examiners are to consider each bank's size, complexity and risk profile. The OCC described the framework as a living document that it will update regularly as the technology evolves and in response to stakeholder feedback.
Banks Are Already Restricting Agents
The framework arrives as large US banks restrict outside AI agents. Major banks have been blocking third-party agents from operating inside customer accounts and making transactions, Reuters reported on October 22.
According to an Axios report the same day, Morgan Stanley blocked outside agents, while JPMorgan, Bank of America and Citi restricted access.
Wells Fargo has also updated its Online Access Agreement, effective November 24, to say that instructions from a customer's AI agent are deemed to have been authorized directly by the customer.
The OCC did not link its framework to those developments.
Last updated
