The US Office of the Comptroller of the Currency has issued guidance for examiners assessing banks’ use of generative and agentic AI. It creates no new rules, but signals that banks may face questions about what AI systems are allowed to do, who oversees them and what happens when they fail.
Watch Desk analysis
What happened
The OCC released its Supervisory Framework on Bank Use of Super Intelligence on 4 November. A PYMNTS report, drawing on analysis by law firm Ballard Spahr, says the guide asks examiners to consider AI within familiar risk areas such as fraud, privacy, cybersecurity and third-party vendors, rather than treating it as a separate risk category.
The framework sets out four levels of risk, with autonomous payment tools and instant credit decisions at the high end, and internal tools that do not touch customer data at the low end. The report says the guide also addresses guardrails, recovery from system failures and whether safety checks keep working over time. Read the PYMNTS report.
Why it matters
The practical message for banks is that an AI system’s power and freedom to act matter as much as its technical sophistication. A tool that can initiate payments may need stronger controls than a more capable model used only to draft internal notes.
The report says the OCC expects meaningful human oversight, not a person simply clicking “approve”. Reviewers should have the skills, information and authority to reject or stop what a system is doing. Banks remain accountable for their AI, including tools supplied by vendors.
Our read
This is a useful preview of what bank examiners may ask, not a new compliance checklist banks are legally required to follow. The distinction matters: the guide does not create binding standards, but ignoring its questions would be an unusually optimistic approach to an upcoming examination.
The most useful test is whether a bank can explain what its AI can do, who can intervene, and how it will spot a vendor’s system changing in ways that create new risks. “A human is in the loop” is not much reassurance if that human has neither the facts nor the authority to pull the plug.
What to watch
- Whether the OCC’s examinations turn these questions into consistent supervisory practice.
- How banks assess systems with authority to make payments or credit decisions.
- Whether vendor contracts cover changes to AI systems and responsibility when they cause harm.
- Whether banks strengthen oversight without mistaking a policy document for effective control.
Discussion spark: Should bank examiners demand stricter controls whenever an AI system can act on its own, or should the level of oversight depend mainly on the consequences of a mistake?
Sources and evidence
- Source update (11 November 2026, 15:33 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.