OCC issues first guidance for examiners on reviewing banks' AI use
For the chief risk officer at a national bank
The Office of the Comptroller of the Currency issued guidance on Wednesday, Nov. 4, that it said is its first for how examiners should probe banks' use of artificial intelligence, according to a copy of the document seen by Reuters.1
The sources do not give the OCC's stated reason for issuing the guidance; Reuters reported that banking regulators worldwide have been querying lenders about AI use, worried it poses cybersecurity and potentially financial stability risks.1 The framework was first reported by Reuters, and the source is Reuters' account of the document, not the OCC document itself.1
Under the framework, the OCC says banks are not expected to set up separate risk parameters for AI use, and examiners should not treat the technology as a unique risk.1
Examiners should consider how a lender is using AI, as well as the lender's size and complexity, according to Reuters' description of the document.1
The OCC said examiners should focus on the consequences of potential AI-driven mistakes rather than the sophistication of particular models; as an example, it said a simple AI agent authorized to initiate transactions could be considered riskier than a sophisticated model deployed for internal purposes.1
The document said higher-risk uses of AI may require greater restrictions on autonomy or more direct human oversight; Reuters noted the guidance is not legally binding like a rule, though banks typically comply closely with such guidance.1
Banks can expect examiners to ask what an AI system is allowed to do and what happens if it errs, not how advanced it is. Tools that can initiate transactions may draw closer scrutiny and may need tighter autonomy limits or human review, while a separate AI risk framework is not expected.
Our take. Under the OCC's new exam guidance, a plain agent that can move money may draw more scrutiny than your most sophisticated internal model. Write down what each such agent may do without a human before examiners ask.
Action. Model risk: Inventory every AI agent that can initiate transactions and document its autonomy limits and human-oversight checkpoint.
From our records
- OCCregulator · binding Supervisory guidance · latest OCC Semiannual Risk Perspective, Spring 2026 (May 2026), OCC Bulletin 2026-13 (Apr 2026)