US Bank Regulator Issues First AI Framework as Banks Battle Rogue Agents

What it claims

The OCC's first AI supervisory framework, a 22-page document for bank examiners, rates AI risk by what a failure does, not by how capable the model is. The OCC states that a simple agent authorized to start financial transactions can be riskier than a more advanced model that only writes internal documents. The framework appeared less than two weeks after an October 22 Axios report. That report said Morgan Stanley was blocking outside AI agents, and JPMorgan, Bank of America and Citi were restricting their access. Bank executives called unauthorized agents acting inside customer accounts "horrifying." The OCC has not said the incidents prompted the framework.

How it works

Examiners weigh three factors: the consequence of failure, whether an action can be reversed, and how much control humans keep over the system. These factors place systems in four illustrative risk tiers.

• Highest tier: fully autonomous payment agents and real-time credit decision systems.
• Lowest tier: basic internal productivity tools.

Autonomous payment agents sit in the highest tier regardless of how well they perform in testing.

Higher-risk systems may warrant tighter limits on autonomy, independent testing, and human approval before consequential actions proceed. For systems that keep running while making harmful decisions, the suggested safeguards are circuit breakers, rate limits, restricted permissions and emergency shutdown controls.

A separate operational-resilience section covers outside agents run by customers, fintechs or other businesses connecting through bank channels. It names identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access.

Examiners assess AI within the existing operational, compliance and cybersecurity risk categories. Banks do not have to create a separate AI risk category.

The framework covers AI in payments, fraud detection, customer service and other banking operations. The document uses the term "Super Intelligence," which the Trump administration requires in place of "artificial intelligence." Its scope still includes conventional AI and autonomous agents, not only hypothetical superhuman systems.

Limits

The guidance creates no new requirements or enforceable standards. It is a lens for examiners, not a rule banks must meet.

The tiers are illustrative. The article names only the top and bottom tiers and does not describe the two middle tiers. It quotes no thresholds for the suggested safeguards, such as transaction limits or rate limits.

This page is a Decrypt news report, not the framework itself, and it does not link the document. Anyone building agents that touch bank accounts needs to read the OCC text for tier definitions and exact wording. The OCC says it will update the guidance as the technology develops.