US Bank Regulator Issues First AI Framework as Banks Battle Rogue Agents

What it is

The Office of the Comptroller of the Currency (OCC) has issued a 22-page supervisory framework for examiners assessing AI in banking. It is nonbinding and creates no new requirements or enforceable standards. It arrived less than two weeks after an Axios report of 22 October 2026 that Morgan Stanley was blocking outside AI agents while JPMorgan, Bank of America and Citi restricted them. The OCC has not linked the framework to those incidents.

How it works

Examiners rate AI by consequence of failure, reversibility of the action and the human control retained, not by model sophistication. The page gives an example: a simple agent allowed to initiate transactions may be riskier than an advanced model that only drafts internal documents.

The framework gives four illustrative tiers. Fully autonomous payment agents and real-time credit decision systems are in the highest. Basic internal productivity tools are in the lowest. The page says the top-tier placement of autonomous payment agents holds regardless of how well they perform in testing.

The framework fits AI into existing operational, compliance and cybersecurity risk categories. Banks need not create a separate AI risk category. It covers payments, fraud detection, customer service and other operations, and it extends to external agents connecting through bank channels.

What to do

The page lists safeguards examiners may look for. These are suggestions, not requirements.

• Higher-risk systems: tighter limits on autonomy, independent testing, and human approval before consequential actions.
• Systems that keep running while making harmful decisions: circuit breakers, rate limits, restricted permissions and emergency shutdown controls.
• External agents run by customers, fintechs or other businesses: identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access.

An engineer at a bank can use these as a checklist for how the institution would be examined. Those building agents that touch bank accounts can expect these controls to be asked about.

Caveats

The framework is illustrative and nonbinding, and the OCC says it will update it as the technology develops. The page does not say how banks should tell customer-authorized agents from agents acting beyond their permissions. It notes only that banks struggled with this in the Axios reporting.