US Bank Regulator Issues First AI Framework as Banks Battle Rogue Agents

In brief

• The OCC has issued its first framework for examiners assessing banks' use of AI, focusing on consequences and autonomy rather than model sophistication.
• The guidance explicitly addresses outside AI agents, echoing concerns raised by major banks.
• The framework is nonbinding, but provides examples of safeguards for autonomous payments, third-party access, and human oversight.

The U.S. Office of the Comptroller of the Currency issued its first supervisory framework for artificial intelligence in banking today, telling examiners to focus less on how powerful an AI system is and more on what happens when it makes a mistake.

The OCC's framework addresses that very concern, although the regulator has not linked its issuance to those specific incidents.

In a section covering operational resilience, the agency warns that external agents operated by customers, fintechs, or other businesses could create risks for banks even when the banks don't control those systems.

It suggests examiners consider measures including identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access.

The guidelines aim to tackle the dilemma of how to let customers use AI assistants to manage their finances without giving autonomous software unrestricted access to accounts that banks are already facing.