OCC Releases Inaugural AI Supervision Guidelines
OCC sets new evaluation standards for autonomous agents, transaction risks, and operational controls across US banking institutions.
08/11/2026
Artificial Intelligence (AI)
The U.S. Office of the Comptroller of the Currency (OCC) has published its inaugural supervisory framework for artificial intelligence (AI) in the banking sector. The OCC emphasises that examiners should prioritise understanding the consequences of AI failures rather than merely assessing the capabilities of AI systems.
The framework specifically highlights concerns about operational resilience, noting that external agents—such as those operated by customers, fintech companies, or other institutions—may pose risks to banks, even in cases where the banks do not directly control these systems.
Examiners are advised to implement identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access to manage the risk associated with allowing customers to use AI assistants for financial management, balancing customer convenience with security concerns.
Transaction AI vs. Text AI: A Steep Shift in Risk Profile
The OCC guidance follows reports of unauthorised third-party AI agents in bank accounts, prompting major banks like Morgan Stanley to block them and others such as JPMorgan, Bank of America, and Citi to restrict access. Executives have expressed concern about the control over these autonomous agents and their actions involving customer funds, describing the situation as “horrifying.”
The OCC's framework differentiates between the technical sophistication of AI systems and the potential damage they could cause. The regulator notes that a basic agent permitted to execute financial transactions may pose a higher risk than a more complex model designed solely for drafting internal documents.
The 22-page framework allows examiners to evaluate the implications of failures, the reversibility of actions, and the extent of human control over the system.
The agency identifies four risk tiers for autonomous systems: fully autonomous payment agents and real-time credit decision systems are categorised as high risk, while basic internal productivity tools represent the lowest risk tier. Higher-risk systems may require stricter autonomy controls, independent testing, and human oversight before executing significant actions.
Meanwhile, the framework proposes safeguards for AI systems that make harmful decisions, including circuit breakers, rate limits, restricted permissions, and emergency shutdown controls. These measures are particularly pertinent for outside agents, as reported by Axios, where banks faced challenges in differentiating between legitimate customer-authorised software and unauthorised systems operating beyond their intended permissions.
Guidance Over Regulation
The OCC clarified that the document does not impose new regulatory requirements for banks but rather provides a framework for examiners to assess AI within current operational, compliance, and cybersecurity risk categories. There is no obligation for banks to create a distinct AI risk category.
Further, the document employs the term “Super Intelligence,” mandated by the Trump administration, yet encompasses conventional AI and autonomous agents, rather than solely focusing on hypothetical systems exceeding human intelligence.
In summary, the framework addresses the use of AI in payments, fraud detection, customer service, and related banking operations, while also encompassing risks posed by external AI agents interacting with bank systems. The OCC plans to revise the guidance as technology advances, currently categorising autonomous payment agents as high-risk, irrespective of their testing outcomes.