US OCC Issues First AI Supervision Framework for Banks, Flags Autonomous Payment Agents

The U.S. Office of the Comptroller of the Currency (OCC) has issued its first supervisory framework for assessing banks' use of artificial intelligence. The document is addressed to examiners and focuses not on how sophisticated a model is, but on what happens if the system makes a mistake. According to Decrypt, certain provisions address external AI agents that act on behalf of customers, fintechs or other businesses and can create risks for a bank even when the bank does not control those systems. The publication came less than two weeks after reports that major banks had found unauthorized third-party AI agents operating in customer accounts.

Why consequences matter more than model power

In the OCC's logic, AI that initiates financial transactions may carry greater risk than a more advanced model that only writes internal documents. Examiners may consider the consequences of a failure, whether an action can be reversed, and how much human control there is over the system. The framework describes four illustrative risk tiers: fully autonomous payment agents and real-time credit decision systems fall into the highest category, while basic internal productivity tools fall into the lowest. Higher-risk systems may warrant tighter limits on autonomy, independent testing and human approval before consequential actions proceed. Suggested safeguards include circuit breakers, rate limits, restricted permissions and emergency shutdown controls.

Oversight measures for external agents

For external agents, the OCC suggests examiners consider identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access. The document addresses a dilemma banks face: customers want AI assistants to manage their finances, but unrestricted access by autonomous software to accounts carries obvious risks. Decrypt notes that the OCC does not link the publication to specific incidents, although the topic matches an Axios report of October 22: according to it, Morgan Stanley blocked outside agents, while JPMorgan, Bank of America and Citi restricted access. Bank executives, per Axios, described the situation as "horrifying."

Status of the document and its scope

The OCC stresses that the document does not introduce new requirements and is not a binding standard. It gives examiners a way to assess AI within existing operational, compliance and cybersecurity risk categories; banks are not required to set up a separate AI risk category. The scope covers AI used in payments, fraud prevention, customer service and other banking operations, as well as external agents connecting through bank channels. The regulator said it intends to update the guidance as the technology develops.