The Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation are asking banks a question most executives didn’t expect: Can you actually control your artificial intelligence?
The three agencies are questioning banks of all sizes about whether they’ve deployed Chinese-developed AI technology, how they use AI agents in cybersecurity, and—most critically—whether they can monitor and shut down increasingly autonomous systems. Six people familiar with the matter said regulators are asking what limits apply, how banks audit AI agents’ decisions, what safeguards keep systems from exceeding their authority, and whether humans still make key decisions.
Banking supervision is shifting. Regulators aren’t yet telling banks what to do. They’re gathering information about vulnerabilities and preparedness because they’ve recognized what industry leaders are starting to admit: AI adoption is moving faster than the ability to build adequate controls.
The Real Cost of Moving Too Fast
Michael Woodbridge, a cybersecurity partner at Grant Thornton, put the core problem plainly: “The adoption of AI is often outpacing the ability to put the controls in place.” That gap matters enormously when autonomous systems touch financial infrastructure that millions of people depend on.
Recent incidents have sharpened regulators’ concerns. This month, cybersecurity firm CrowdStrike reported that a person in China likely used a Chinese-developed AI agent along with Anthropic’s Claude Code to hack South Korean banks. Rogue AI agents developed by OpenAI played a part in a breach of the Hugging Face AI platform. Anthropic researchers have warned that increasingly powerful AI systems could eventually escape human control and pose an existential threat.
JPMorgan CEO Jamie Dimon has urged corporate leaders to join a U.S.-focused industry group addressing AI risks. The stakes reach beyond any single bank.
International Pressure and Unequal Burden
The U.S. isn’t the only country tightening oversight. In Europe, supervisors including the Bank of England and the European Central Bank are pressing banks to improve recovery plans. The ECB set a July deadline for lenders to produce plans countering AI-enabled cyber threats by end-October, including improved backup and recovery systems.
A senior executive at a large European bank voiced alarm about the timeline, saying they worried about potentially major damage to banking and financial markets “within six months.”
British authorities are separately urging the largest banks to examine “bare metal” recovery plans—systems that run independently of a bank’s main technology setup and can be activated if primary systems are compromised. Here’s the burden question: building and maintaining these systems is expensive. UK authorities say they intend to work collaboratively with industry rather than introduce new requirements, but compliance costs won’t disappear.
European banks and regulators have also voiced frustration at limited access to Anthropic’s Mythos tool—a vulnerability testing resource—as they worry U.S. banks will get first access to test frontier models. That creates a two-tier regulatory environment where American institutions may develop safeguards faster than their European counterparts.
Sukand Ramachandran, managing director and senior partner at BCG, explained what’s at stake: “To protect against attacks, rapid recovery matters as much as prevention. Without separately held clean, secure copies of critical data, a serious attack could lock customers out of their accounts and disrupt payments across the wider economy.”
What Regulators Are Actually Checking
Written and verbal inquiries from U.S. regulators focus on agentic AI—systems that can perform tasks with minimal human supervision—particularly in cybersecurity. Banks are being asked whether AI agents can identify, prioritize and respond to threats, and, critically, whether humans remain involved in key decisions.
In the eurozone, banks are being asked to map AI use across their businesses and third-party providers, identify dependencies, and ensure they can switch off and restart systems in a controlled manner. Someone familiar with the review process said significant gaps remained at some firms.
The push to use frontier AI to identify vulnerabilities and accelerate patching continues, with UK supervisors—like their U.S. counterparts—asking banks to use advanced models for this purpose. One person said lenders were doing a good job so far. Still, the overall picture shows an industry coming to terms with risks it helped create.
Frank Elderson, an ECB board member, stressed in a June speech “the need to create a sense of urgency, not alarm” about AI threats. That distinction matters. Urgency without alarm suggests regulators want action without panic, but the gap between AI capability and control mechanisms suggests some alarm might be warranted.
Why This Matters:
Banking stability isn’t abstract—it determines whether working families can access credit, whether small businesses can meet payroll, and whether the financial system can weather shocks. When autonomous AI systems operate in critical infrastructure with insufficient human oversight or control mechanisms, the risk reaches beyond one bank to the entire economy. The gap between AI adoption and regulatory frameworks creates a period of genuine vulnerability. Unequal access to testing tools like Mythos also raises questions about whether American banks will develop more robust safeguards than international competitors, potentially shifting risk rather than reducing it. Without mandatory recovery systems, standardized auditing practices, and clear limits on autonomous decision-making, banks are racing to deploy AI faster than they’re preparing to handle its failures—a dynamic that shifts costs and risks onto customers and taxpayers who’ll bear the consequences of a serious breach.