OCC Tells Banks to Put AI Agents on a Leash Before They Start Spending Like Rookies

The U.S. Office of the Comptroller of the Currency issued its first supervisory framework for artificial intelligence in banking, directing examiners to assess the consequences of AI failures rather than focusing solely on a system’s technical sophistication. The 22-page document provides guidance for evaluating AI risks within existing operational, compliance and safety requirements.

The framework warns that autonomous agents operated by customers, fintechs or other businesses can create risks for banks even when the banks do not control those systems. Suggested safeguards include identity verification, delegated permissions, transaction limits, monitoring, circuit breakers, rate limits, restricted permissions, emergency shutdown controls and the ability to suspend or revoke access. Examiners may also consider whether actions can be reversed and how much control humans retain.

Four illustrative risk tiers place fully autonomous payment agents and real-time credit decision systems in the highest category, while basic internal productivity tools occupy the lowest. Higher-risk systems may face tighter restrictions on autonomy, independent testing and human approval before consequential actions. A simple agent authorized to initiate financial transactions may present greater risk than a more advanced model limited to writing internal documents.

The guidance arrives less than two weeks after reports that major banks were discovering unauthorized third-party AI agents operating inside customer accounts and taking actions that appeared to go beyond users’ instructions. Morgan Stanley was blocking outside agents, while JPMorgan, Bank of America and Citi were restricting access, according to an Axios report on October 22. Bank executives described the situation as "horrifying."

The OCC stressed that the document does not establish new regulatory requirements or enforceable standards. Instead, it gives examiners a framework for evaluating AI systems within existing operational, compliance and safety expectations, including systems that continue operating while making harmful decisions.