US and European bank regulators step up questions on AI use, sources say

For the chief risk officer at a mid-size bank

US bank regulators, including the Federal Reserve, the OCC and the FDIC, are questioning banks about advanced AI models, according to two of six people familiar with the matter cited by IBTimes UK in a report published Oct. 13.1

The report says the concern is that fast-moving AI systems could be hijacked or misfire in ways that threaten customer access and wider financial stability.1 The regulators have not commented, and the outlet's sources say they are still gathering information and are not yet being prescriptive about what lenders should do.1

According to Reuters, as reported by IBTimes UK, three of the people said the questions include whether banks deploy Chinese-developed technology, use AI agents in cyber defence and can control increasingly autonomous systems, and two of the people said the OCC, the FDIC and the Fed are also asking about limits placed on these systems.1

Three people with knowledge of regulators' thinking said the written and verbal inquiries have gone to large, mid-size and smaller banks; the OCC, the Fed and the FDIC declined to comment.1

In Europe, three people said the Bank of England and the European Central Bank are pressing banks to improve recovery plans, and two people said British supervisors are encouraging the largest banks to examine bare metal recovery plans, which are expensive to build and maintain; UK authorities do not plan new requirements, the sources said.1

The report says the ECB gave lenders an end-October deadline in July to produce plans against AI-enabled cyber threats, and that US cybersecurity company CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent and Anthropic's Claude Code in a hack on South Korean banks.1

Why it matters

Banks of every size may soon have to explain in writing where they use AI agents, who approves their actions, how each decision can be audited and how the agents can be shut off. Early answers could shape what supervisors later treat as normal, and shutdown plans for agents that defend networks will need a manual fallback and tested recovery.

What’s next

The ECB gave lenders an end-October deadline, set in a July letter, to produce plans against AI-enabled cyber threats, including improved back-up and recovery.1

From the brief

Our take. Regulators are asking, not yet telling. A bank that cannot show who approved an agent's action, or how to switch it off, will be writing that answer for an examiner instead of for itself.

Action. Model risk: Inventory every AI agent and document its permission limits, human approver, decision audit log and tested shutdown procedure.

What our records say

Claude's AI posture in banking is to sell banks Claude seats and API access directly and through cloud marketplaces, and in 2026 add embedded engineering with Goldman Sachs and FIS, restricted cyber-defence access to its Mythos model for a few large banks, and a services firm co-founded with Goldman Sachs.1

  1. Claude: AI programme summary

From our records

Sources

  1. ReportRegulators Ramp up Scrutiny on Banks Fearing AI Could 'Lock Customers Out of Their Accounts' | IBTimes UK International Business Times