Banking regulators are asking major financial institutions to prove they can control artificial intelligence systems before those systems control their operations. The Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation are questioning banks about their use of advanced AI models, focusing on whether staff can monitor, audit, and shut down autonomous systems when necessary.
The written and verbal inquiries reach large, midsize, and smaller banks nationwide. Regulators want answers to basic governance questions. What limits apply to AI systems? How do banks monitor and approve actions? Can they track and audit agents' decisions? What keeps agents from exceeding their authority? Do humans remain involved in key decisions? How can banks shut down autonomous systems? The OCC, Fed, and FDIC declined to comment on their investigation.
The Oversight Gap
The scrutiny reflects a widening gap between adoption and accountability. Banks are racing to deploy what's called agentic AI—systems that perform tasks with minimal human supervision—but the ability to put proper controls in place hasn't kept pace. “The adoption of AI is often outpacing the ability to put the controls in place,” said Michael Woodbridge, a cybersecurity partner at Grant Thornton.
Regulators focus heavily on agentic AI in cybersecurity, where banks use these systems to identify, prioritize, and respond to threats. They're especially concerned about banks deploying Chinese-developed technology and whether banks understand their reliance on external technology providers. A serious vulnerability could expose the entire financial system, not just one institution, to cascading failures.
JPMorgan CEO Jamie Dimon has already signaled the stakes. He urged corporate leaders to join a U.S.-focused industry group addressing AI risks. That urgency grew after CrowdStrike disclosed that a person in China likely used a Chinese-developed AI agent and Anthropic's Claude Code in a hack on South Korean banks. Separate incidents revealed that rogue AI agents developed by OpenAI played a role in a breach of AI platform Hugging Face.
International Pressure and Expensive Solutions
U.S. regulators aren't alone in their concern. European supervisors at the Bank of England and European Central Bank are pressing banks to improve recovery plans, worried that rapid AI advances could cause serious harm and disrupt financial markets sooner than expected. A senior executive at a large European bank voiced concern about potentially major damage to banking and financial markets “within six months.”
The ECB gave lenders an end-October deadline to produce plans to counter AI-enabled cyber threats, including better backup and recovery capabilities. Britain's supervisors are separately urging the largest banks to examine “bare metal” recovery plans—systems that operate independently of a bank's main technology setup and can be activated if primary systems are compromised. Sources familiar with their thinking say building and maintaining these systems is expensive.
Anthropric researchers flagged IT weaknesses through their Mythos tool, putting more pressure on financial institutions. European banks and regulators have expressed frustration over limited access to the testing tool, amid concerns that U.S. banks will get first access to test frontier models. Euro zone banks now must map AI use across their businesses, identify dependencies on third-party providers, and ensure they can switch off and restart systems in a controlled manner. Some firms still had significant gaps.
Why This Matters:
Government regulators are right to demand accountability before autonomous systems multiply across the financial sector. What's at stake isn't just one bank's cyber defenses: it's whether the infrastructure millions of Americans depend on for payments, loans, and account access can withstand an attack and recover. Building robust recovery systems will cost a substantial amount, and banks will likely pass those expenses to customers and investors. But the alternative—systems operating with insufficient human oversight and inadequate backup plans—poses genuine systemic risk.
The questions regulators are asking are the right ones. Can banks monitor these systems? Can they stop them? Banks are still scrambling to answer, which suggests technology adoption has genuinely outrun governance capacity. How quickly institutions close that gap will determine whether AI becomes a tool banks control or a vulnerability they can't manage.