The U.S. Office of the Comptroller of the Currency (OCC), the regulator that supervises national banks, has issued its first supervisory framework for artificial intelligence in banking, telling examiners to focus less on how powerful an AI system is and more on what happens when it makes a mistake.

The 22-page framework, issued as OCC Bulletin 2026-54 and accompanied by a news release, warns in a section covering operational resilience that external agents operated by customers, fintechs, or other businesses could create risks for banks even when the banks do not control those systems. The regulator has not linked the framework's issuance to specific incidents, though it comes amid heightened industry concern about unsanctioned AI agents operating inside customer accounts.

Consequences Over Sophistication

At the core of the document is a distinction between an AI system's technical sophistication and the damage it could cause. A simple agent authorized to initiate financial transactions may present greater risk than a more advanced model limited to writing internal documents, the regulator said. The distinction reflects how agentic software differs from conventional tools: rather than only producing text, agents take actions in connected systems, so the damage potential of a failure grows with the permissions they hold.

Under the framework, examiners can consider the consequences of failure, whether an action can be reversed, and how much control humans retain over the system. The agency outlines four illustrative risk tiers: fully autonomous payment agents and real-time credit decision systems fall into the highest category, while basic internal productivity tools occupy the lowest.

Higher-risk systems may warrant tighter restrictions on autonomy, independent testing, and human approval before consequential actions can proceed.

The framework also addresses AI systems that continue operating while making harmful decisions. Suggested safeguards include circuit breakers, rate limits, restricted permissions, and emergency shutdown controls.

Third-Party AI Agents in Focus

The guidance suggests examiners consider measures including identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access. It aims to tackle a dilemma banks are already confronting: how to let customers use AI assistants to manage their finances without giving autonomous software unrestricted access to accounts.

The framework arrives less than two weeks after reports that major banks were discovering unauthorized third-party AI agents operating inside customer accounts, sometimes taking actions that appeared to go beyond users' instructions. According to an Axios report on October 22, Morgan Stanley was blocking outside agents, while JPMorgan, Bank of America, and Citi were restricting access. Bank executives described the situation as "horrifying," raising questions about who controls an autonomous agent once it has access to someone's money.

Those considerations are especially relevant to the outside agents described in Axios's earlier reporting, where banks struggled to distinguish legitimate customer-authorized software from systems operating beyond their intended permissions.

Guidance, Not New Banking Rules

The OCC stressed that the framework is nonbinding and does not create new regulatory requirements or enforceable standards for banks. Instead, it gives examiners a way to evaluate AI within existing operational, compliance, and cybersecurity risk categories, and banks are not required to establish a separate AI risk category. It provides examples of safeguards covering autonomous payments, third-party access, and human oversight. Nonbinding does not mean inconsequential: OCC examiners evaluate banks against documents like this during routine supervision, so its suggested safeguards can carry practical weight without formal rules.

The framework covers AI used in payments, fraud detection, customer service, and other banking operations, and extends its risk considerations to external AI agents connecting through bank channels.

Notably, the document uses the mandatory term "Super Intelligence" — language the Donald Trump administration insists on using in place of "artificial intelligence," in line with a September White House presidential action — but its scope includes conventional AI and "autonomous agents" rather than only hypothetical systems with intelligence beyond human capabilities.

The OCC said it intends to update the guidance as the technology develops. For now, its illustrative risk scale places autonomous payment agents in the highest-risk category, regardless of how well they perform in testing. How examiners apply those tiers in practice — particularly to the third-party agents banks have been discovering in customer accounts — is the detail to watch as the guidance evolves.

This story was originally reported by Decrypt.