US and European bank regulators step up questions on AI use, sources say
For the chief risk officer at a mid-size bank
US bank regulators, including the Federal Reserve, the OCC and the FDIC, are questioning banks about advanced AI models, according to two of six people familiar with the matter cited by IBTimes UK in a report published Oct. 13.1
The report says the concern is that fast-moving AI systems could be hijacked or misfire in ways that threaten customer access and wider financial stability.1 The regulators have not commented, and the outlet's sources say they are still gathering information and are not yet being prescriptive about what lenders should do.1
According to Reuters, as reported by IBTimes UK, three of the people said the questions include whether banks deploy Chinese-developed technology, use AI agents in cyber defence and can control increasingly autonomous systems, and two of the people said the OCC, the FDIC and the Fed are also asking about limits placed on these systems.1
Three people with knowledge of regulators' thinking said the written and verbal inquiries have gone to large, mid-size and smaller banks; the OCC, the Fed and the FDIC declined to comment.1
In Europe, three people said the Bank of England and the European Central Bank are pressing banks to improve recovery plans, and two people said British supervisors are encouraging the largest banks to examine bare metal recovery plans, which are expensive to build and maintain; UK authorities do not plan new requirements, the sources said.1
The report says the ECB gave lenders an end-October deadline in July to produce plans against AI-enabled cyber threats, and that US cybersecurity company CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent and Anthropic's Claude Code in a hack on South Korean banks.1
Banks of every size may soon have to explain in writing where they use AI agents, who approves their actions, how each decision can be audited and how the agents can be shut off. Early answers could shape what supervisors later treat as normal, and shutdown plans for agents that defend networks will need a manual fallback and tested recovery.
The ECB gave lenders an end-October deadline, set in a July letter, to produce plans against AI-enabled cyber threats, including improved back-up and recovery.1
Our take. Regulators are asking, not yet telling. A bank that cannot show who approved an agent's action, or how to switch it off, will be writing that answer for an examiner instead of for itself.
Action. Model risk: Inventory every AI agent and document its permission limits, human approver, decision audit log and tested shutdown procedure.
What our records say
Claude's AI posture in banking is to sell banks Claude seats and API access directly and through cloud marketplaces, and in 2026 add embedded engineering with Goldman Sachs and FIS, restricted cyber-defence access to its Mythos model for a few large banks, and a services firm co-founded with Goldman Sachs.1
From our records
- Federal Reserveregulator · binding Supervisory guidance · latest Cook: Opportunities and Risks of AI (May 2026) (May 2026), Bowman: AI in the Financial System (May 2026) (May 2026)
- OCCregulator · binding Supervisory guidance · latest OCC Semiannual Risk Perspective, Spring 2026 (May 2026), OCC Bulletin 2026-13 (Apr 2026)
- FDICregulator · binding Supervisory guidance · latest Hill House oversight testimony (Jun 2026) (Jun 2026), FDIC FIL-15-2026 (Apr 2026)
- ECBregulator · binding Supervisory guidance · latest ECB 'Dear CEO' letter on AI-enabled cybersecurity threats (SSM-2026-0301) (Jul 2026), Elderson speech: 'Strengthening operational resilience for the age of AI' (June 2026) (Jun 2026)
Sources
- ReportRegulators Ramp up Scrutiny on Banks Fearing AI Could 'Lock Customers Out of Their Accounts' | IBTimes UK International Business Times