Regulators' AI warnings to banks cluster in three areas: AI-enabled fraud — deepfake identity documents, voice cloning and industrialized scams (FinCEN, FDIC, OCC, CFTC); AI-driven cyber threats — capped by the ECB's July 2026 Dear-CEO letter requiring action plans from every significant institution by October 31, 2026 (with NY DFS and the UK authorities issuing parallel letters); and financial-stability risks from model and vendor concentration (FSB, FSOC, Bank of England). The newest warning tracked here is FIN-2026-Alert005 (Digital Asset Investment Scam Centers) (Sep 3, 2026).
What have regulators warned banks about AI fraud and deepfakes?
The most concrete warnings: criminals using generative AI to defeat identity verification, clone voices, forge documents and industrialize scams — with red flags banks are expected to detect and report.
| Date | Authority | Warning | Status |
|---|---|---|---|
| Sep 3, 2026 | FinCEN | FIN-2026-Alert005 (Digital Asset Investment Scam Centers) — FinCEN Alert FIN-2026-Alert005, issued September 3, 2026, urges financial institutions to detect and report money laundering tied to digital asset investment ('pig butchering') scam centers, predominantly run by… | In force |
| Jul 24, 2026 | FinCEN | FIN-2026-Alert004 (Federal Student Aid Fraud) — FinCEN Alert FIN-2026-Alert004, issued July 24, 2026, asks financial institutions to detect and report fraud rings stealing federal student aid through 'ghost students' and 'straw students.' It states that fraudsters… | In force |
| May 7, 2026 | OCC | OCC Semiannual Risk Perspective, Spring 2026 — The OCC's Spring 2026 Semiannual Risk Perspective, released May 7, 2026, says artificial intelligence is 'significantly transforming the cyber threat landscape' — lowering the barrier to entry for attackers and… | Final |
| Dec 11, 2025 | U.S. Treasury | FSOC 2025 Annual Report — FSOC's 2025 annual report, unanimously approved December 11, 2025, made 'harnessing AI to promote financial stability' one of four priority areas and formalized an FSOC Artificial Intelligence Working Group. | Final |
| Sep 18, 2025 | MAS | MAS Circular MAS/TCRS/2025/06 — MAS circular MAS/TCRS/2025/06, an information paper dated September 2025 and issued on 18 September 2025, examines how deepfakes threaten financial institutions and what mitigating measures they can take. | In force |
| Jul 14, 2025 | FDIC | FDIC 2025 Report on Cybersecurity and Resilience — The FDIC's 2025 Report on Cybersecurity and Resilience, submitted to the House Financial Services and Senate Banking Committees under Section 108 of the Consolidated Appropriations Act, 2021 and posted in July 2025,… | Final |
| Mar 24, 2025 | NIST | NIST AI 100-2e2025 (Adversarial ML) — NIST AI 100-2e2025, finalized on March 24, 2025, is NIST's taxonomy and terminology of adversarial machine learning attacks and mitigations, updating the January 2024 edition (AI 100-2e2023). | Final |
| Nov 14, 2024 | FSB | FSB AI financial stability report (Nov 2024) — On 14 November 2024 the FSB published its post-generative-AI assessment of AI's financial-stability implications. | Final |
| Nov 13, 2024 | FinCEN | FIN-2024-Alert004 (Deepfake Media) — FinCEN Alert FIN-2024-Alert004, issued November 13, 2024, warns that criminals are using generative AI to create deepfake identity documents, images, video, and audio to defeat banks' identity verification,… | In force |
| Oct 16, 2024 | NY DFS | DFS AI Cybersecurity Industry Letter (Oct 2024) — On October 16, 2024, DFS issued an Industry Letter telling every DFS-regulated entity how to address AI-related cyber risk under 23 NYCRR Part 500. | In force |
| Jul 30, 2024 | MAS | MAS Circular MAS/TCRS/2024/05 — MAS circular MAS/TCRS/2024/05, published on 30 July 2024, is an information paper that gives financial institutions an overview of cyber threats arising from generative AI, the risk implications and mitigation measures. | In force |
| May 22, 2024 | FDIC | FDIC 2024 Risk Review — The FDIC's 2024 Risk Review, published May 22, 2024, is the agency's most explicit published treatment of AI as a bank risk. | Final |
| Mar 27, 2024 | U.S. Treasury | Treasury AI cybersecurity risks report (Mar 2024) — On March 27, 2024 the Treasury released 'Managing Artificial Intelligence-Specific Cybersecurity Risks in the Financial Services Sector', written under Executive Order 14110 and led by its Office of Cybersecurity and… | Final |
| Jan 25, 2024 | CFTC | CFTC AI Scams Customer Advisory — On January 25, 2024 the CFTC's Office of Customer Education and Outreach warned that fraudsters exploit interest in artificial intelligence to sell trading bots, signal services, and crypto schemes promising guaranteed… | In force |
What are regulators saying about AI-driven cyber risk to banks?
Supervisors now treat AI as a force multiplier for attackers. The strongest signal yet: the ECB's first technology-focused Dear-CEO letter, requiring significant institutions to file AI-cyber action plans.
| Date | Authority | Warning | Status |
|---|---|---|---|
| Sep 2, 2026 | UK (BoE / PRA / FCA) | FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026) — The FCA published a multi-firm review on 2 September 2026 sharing what it learned engaging with firms on frontier AI and cyber resilience. | In force |
| Aug 31, 2026 | FSB | FSB Chair's letter to G20 (Aug 2026) — On 31 August 2026, ahead of the G20 Finance Ministers and Central Bank Governors meeting, FSB Chair Andrew Bailey wrote that frontier AI models now show 'increasingly sophisticated autonomy and problem-solving… | Final |
| Jul 31, 2026 | EBA | ESA Statement on ICT risks from frontier AI models (JC 2026 25) — On July 31, 2026 the EBA, EIOPA and ESMA published joint statement JC 2026 25 on ICT risks from frontier AI models, warning that highly capable AI models sharply accelerate vulnerability discovery and exploitation and… | In force |
| Jul 7, 2026 | ECB | ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) — On 7 July 2026 Claudia Buch, Chair of the ECB Supervisory Board, sent letter SSM-2026-0301, 'Addressing AI-enabled cybersecurity threats', to the CEO of every significant institution. | In force |
| Jun 2, 2026 | Hong Kong SFC | SFC Circular 26EC32 (AI-enabled cyberattacks) — SFC Circular 26EC32 (reference SFO/IS/020/2026), issued on 2 June 2026, reminds licensed corporations, SFC-licensed virtual asset trading platforms and their associated entities to review and enhance cybersecurity… | In force |
| May 22, 2026 | Japan FSA | Japan FSA/BOJ frontier AI request — On 22 May 2026 the Japan Financial Services Agency and the Bank of Japan jointly requested financial institutions to take short-term measures against the changed cyber threat posed by frontier AI, which can discover… | In force |
| May 21, 2026 | NY DFS | DFS Frontier AI Models Industry Letter (May 2026) — On May 21, 2026, DFS issued an Industry Letter warning that 'frontier AI models' able to identify vulnerabilities and build exploits at unprecedented speed and scale will soon become widely available, and directing… | In force |
| May 21, 2026 | NY DFS | DFS Heightened Threat Environment Guidance (May 2026) — Issued May 21, 2026 as the companion to DFS's frontier-AI letter, this guidance defines a 'heightened cybersecurity threat environment' as one where risks are significantly elevated with a high likelihood of impacting… | In force |
| May 15, 2026 | UK (BoE / PRA / FCA) | BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026) — On 15 May 2026 the Bank of England, FCA and HM Treasury jointly warned that frontier AI models' cyber capabilities already exceed what a skilled practitioner could achieve, at higher speed, scale and lower cost, and… | In force |
| Apr 30, 2026 | APRA / ASIC | APRA AI Letter to Industry (April 2026) — APRA's Letter to Industry on Artificial Intelligence, published on 30 April 2026 and addressed to all APRA-regulated entities, calls for a step-change in how banks, insurers and superannuation trustees manage AI-related… | Final |
| Oct 10, 2025 | FSB | FSB AI monitoring report (Oct 2025) — Published 10 October 2025, this report gives national authorities key considerations and candidate indicators for tracking AI adoption and the vulnerabilities identified in November 2024 — third-party dependencies,… | Final |
| Apr 9, 2025 | UK (BoE / PRA / FCA) | FPC Financial Stability in Focus: AI (Apr 2025) — The Bank of England's Financial Policy Committee published its first dedicated assessment of AI and financial stability on 9 April 2025. | Final |
| Sep 24, 2024 | OSFI | OSFI-FCAC AI Risk Report (2024) — The OSFI-FCAC Risk Report on AI uses and risks, published on 24 September 2024 by the Office of the Superintendent of Financial Institutions and the Financial Consumer Agency of Canada, is the regulators' joint survey… | Final |
| May 1, 2024 | ECB | ECB FSR May 2024 AI special feature — In May 2024 the ECB's Financial Stability Review carried a special feature, 'The rise of artificial intelligence: benefits and risks for financial stability', by Leitner, Singh, van der Kraaij and Zsámboki. | Final |
What systemic AI risks are authorities monitoring?
Concentration in a few model and cloud providers, herding from common models, and AI-washing — claims about AI that the SEC has already brought enforcement over.
| Date | Authority | Warning | Status |
|---|---|---|---|
| Oct 29, 2024 | APRA / ASIC | ASIC REP 798 — ASIC Report 798, 'Beware the gap: Governance arrangements in the face of AI innovation', released on 29 October 2024, is the Australian Securities and Investments Commission's first examination of how financial services… | Final |
| Feb 13, 2024 | SEC | Gensler 'AI washing' remarks at Yale (Feb 2024) — On February 13, 2024 SEC Chair Gary Gensler used a Yale Law School speech to put 'AI washing' on the record as a securities-law problem: public companies and investment advisers that overstate their AI use or make… | Final |
What has FinCEN warned banks about deepfakes?
FinCEN's November 2024 alert (FIN-2024-Alert004) warns that criminals are using generative AI to create deepfake identity documents and media that defeat bank onboarding and verification, lists red flags — inconsistencies between documents and live verification, re-used device fingerprints, synthetic photos — and tells banks to reference the alert in Suspicious Activity Reports. A July 2026 follow-up alert covers AI-assisted federal student-aid fraud schemes.
What is the ECB's 'Dear CEO' letter on AI?
On July 7, 2026 the ECB sent letter SSM-2026-0301 — its first Dear-CEO letter devoted to a technology threat — warning every significant euro-area institution about AI-enabled cybersecurity risks: accelerated vulnerability exploitation, AI-enhanced phishing and deepfake-assisted intrusion. Each institution must submit a comprehensive action plan to its Joint Supervisory Team by October 31, 2026.
Is AI-enabled fraud a US supervisory priority?
Yes. The OCC's Spring 2026 Semiannual Risk Perspective flags AI as amplifying fraud and the speed and sophistication of cyberattacks; the FDIC's 2024 Risk Review devotes a section to deepfakes, voice cloning and check fraud; the CFTC issued a customer advisory on AI scams; and New York DFS has issued three industry letters on AI cyber risk, including two in May 2026 on frontier-model threats.
Every new warning lands in the brief
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am ET · free
plus every tracker, bank and agent page update, the morning after · leave any morning