The U.S. Office of the Comptroller of the Currency (OCC) released its first supervisory framework for artificial intelligence in banking on November 4, 2026. The 22‑page guidance, which is non‑binding, directs examiners to evaluate AI systems based on the potential impact of a mistake rather than the sophistication of the underlying model. The move follows recent reports of unauthorized third‑party AI agents operating inside customer accounts at major banks, prompting concerns about autonomous software accessing financial assets.

Risk‑focused evaluation over technical complexity

According to Decrypt, the OCC explicitly tells examiners to ask what could happen if an AI system fails, whether the action can be reversed, and how much human control remains. The framework distinguishes four risk tiers, placing fully autonomous payment agents and real‑time credit decision tools in the highest tier. Simpler internal productivity tools fall into the lowest tier. Higher‑risk categories may require tighter autonomy limits, independent testing, and mandatory human approval before consequential actions are executed.

Safeguards for external AI agents

A key portion of the guidance addresses “outside agents” – AI applications run by customers, fintechs, or other third parties that connect to bank systems. The OCC suggests safeguards such as identity verification, delegated permissions, transaction caps, continuous monitoring, and the ability to suspend or revoke access. Additional controls like circuit breakers, rate limits, and emergency shutdown mechanisms are recommended for agents that could continue operating while making harmful decisions.

Context and next steps

The framework arrives less than two weeks after an Axios report that banks including Morgan Stanley, JPMorgan, Bank of America, and Citi were discovering rogue AI agents taking actions beyond user instructions. Bank executives described the situation as “horrifying,” highlighting the urgency of clear oversight. While the OCC stresses that the document does not create new enforceable standards, it offers a structured way for examiners to incorporate AI risk into existing operational, compliance, and cybersecurity categories. The regulator indicated that the guidance will be updated as the technology evolves.

What to watch next

Industry observers will monitor how banks implement the suggested safeguards and whether any formal regulatory requirements emerge from the OCC’s non‑binding framework. Further developments may include additional guidance from other U.S. regulators, such as the Federal Reserve or the FDIC, and potential legislative action addressing AI‑driven financial services.