The U.S. Office of the Comptroller of the Currency issued its first framework for examiners assessing banks’ use of AI. It asks them to weigh the consequences of failure, whether actions can be reversed and how much control humans retain, rather than judging risk by a system’s sophistication alone. The framework is nonbinding: it creates no new requirements or enforceable standards, and banks need not establish a separate AI risk category.
The framework also addresses external AI agents that connect through bank channels, even when banks do not control them. It places fully autonomous payment agents among its highest illustrative risk tier and suggests safeguards such as transaction limits, human approval and the ability to revoke access. The OCC did not link the framework’s issuance to reports of unauthorized third-party agents operating in customer accounts.
