US Bank Regulator Issues First AI Framework

The U.S. Office of the Comptroller of the Currency issued its first supervisory framework for artificial intelligence in banking, giving a primary bank regulator in usa tools to evaluate technology risks. Rather than focusing on how powerful a system might be, the new guidance instructs examiners to assess what happens when things go wrong.

The 22-page document arrives less than two weeks after major institutions discovered unauthorized third-party AI software operating inside customer accounts. Major banks including Morgan Stanley blocked outside agents, while JPMorgan, Bank of America, and Citi placed restrictions on access. Executives described these unauthorized actions as alarming, highlighting uncertainties regarding who maintains control over automated financial software.

Understanding Risk Tiers

The framework establishes four illustrative risk categories. Fully autonomous payment systems and real-time credit decision tools sit at the highest level, while internal productivity tools occupy the lowest. Higher-risk classifications call for strict autonomy limitations, independent evaluations, and mandatory human authorization before executing significant transactions.

To manage systems that continue functioning despite generating harmful outcomes, the guidance suggests safeguards like circuit breakers, rate limits, restricted permissions, and emergency shutdowns. The agency emphasized that the document does not create new legal mandates or enforceable standards. Instead, it provides examiners with a structured approach to assess AI within established operational, compliance, and cybersecurity categories, utilizing the administration's mandated term "Super Intelligence" for conventional and autonomous applications.

The OCC's new framework directs examiners to focus on potential failure consequences rather than technical software power.

Why it matters

This supervisory guidance addresses the growing dilemma of allowing customers to utilize digital assistants for financial management without granting autonomous software unmonitored account access. By establishing a clear risk scale for external agents and payment technologies, the framework helps institutions evaluate operational resilience against unexpected software behaviors.