OCC issues what Reuters calls its first-ever AI guidance for bank examiners

The Office of the Comptroller of the Currency issued what it said was the first-ever guidance for how examiners should probe banks’ use of artificial intelligence, Reuters reported on Wednesday, Nov. 4.

The OCC published the supervisory framework the same day with Bulletin 2026-54 and News Release 2026-97. The bulletin is addressed to the chief executives of all national banks, federal savings associations and federal branches and agencies of foreign banks, and it says examiners may also use the framework for community banks, tailoring exams to each bank’s size, complexity and risk profile.

The OCC uses the term “super intelligence,” or SI. The bulletin says it refers to the technologies previously covered by the term “Artificial Intelligence” as defined in federal law, as well as “the promise, potential, and rapidly advancing capabilities of those technologies,” and cites Executive Order 14434, dated Oct. 2.

The framework says examiners “should not treat SI as a separate and distinct risk category, and banks are not required to define a separate SI risk appetite.” Instead, it says SI use “can introduce, amplify or modify risk in existing risk categories, such as operational, compliance and credit.”

The bulletin says the framework “does not establish supervisory expectations for banks” and is “intended as a resource to assist examiners.” Reuters noted that such guidance is not legally binding like a rule, but banks typically comply closely with it.

The core of the framework is risk by use and consequence. “Risk classification may be based on potential consequences, transfer of agency, and the degree of human oversight, rather than the technical sophistication of the SI used,” it says.

AI agents that can move money get specific attention. “For example, a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting assistance,” the framework says. In an illustrative tiering example, it places a fully autonomous, customer-facing payment agent in its highest tier, “regardless of how well it performs in testing.”

On autonomy and oversight, the framework says “Higher consequence use cases may warrant greater restrictions on autonomy, stronger controls, more direct human oversight, more independent validation, and more robust resilience measures.” It distinguishes human-in-the-loop review, meaning approval before an output or action is used, from human-on-the-loop monitoring with authority to intervene. It says an assigned reviewer may need the expertise and authority to “evaluate, reject, modify, pause, or halt” a system’s output or action.

The framework says it was “prepared with the assistance of SI” and that the content was “reviewed, edited, and approved by a human.” The OCC said in its news release that it intends to update the framework regularly.

Reuters reported that banking regulators worldwide have been querying lenders about their AI use, worried about cybersecurity and potential financial stability risks.

OCC issues what Reuters calls its first-ever AI guidance for bank examiners

Sources