OCC tells bank examiners to judge AI by consequences, not sophistication

Overview

Updated 1 hour ago

On November 4, the Office of the Comptroller of the Currency (OCC) told its bank examiners how to review artificial intelligence. The 22-page framework says a simple AI agent that can move money is riskier than a sophisticated model that only writes internal memos.

The guidance is not binding and creates no new requirements for banks. But examiners carry weight in how lenders behave, and the framework gives them a shared yardstick for AI systems banks already run — including outside agents that customers and fintechs connect to bank accounts.

Why it matters

Bank examiners now have a shared test for AI risk, which will shape how much autonomy banks give software that touches customer money.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

Pages in the framework

The OCC's examiner guide runs 22 pages, per Decrypt.

Illustrative risk tiers

Fully autonomous payment agents sit in the highest tier; internal productivity tools in the lowest.

New regulatory requirements

The OCC says the framework sets no enforceable standards and requires no separate AI risk appetite.

1st

First OCC AI examiner framework

The agency calls it its first guidance for how examiners should probe banks' AI use.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

James M. Gallagher

Senior Deputy Comptroller and Chief National Bank Examiner, OCC

Signed the November 4, 2026 framework

Organizations Involved

Office of the Comptroller of the Currency

Federal Agency

Issued the framework on November 4, 2026

The federal agency that charters and supervises national banks and federal savings associations.

Timeline

October 2026 November 2026

3 events Latest: 3 days ago

November 2026
OCC issues first AI framework for examiners
Latest Regulation

Bulletin 2026-54 tells examiners to weigh AI by consequences and autonomy, not model sophistication, and addresses outside agents.
3 days ago
October 2026
Banks move to block outside AI agents
Industry

Axios reports Morgan Stanley blocking third-party AI agents and JPMorgan, Bank of America and Citi restricting access, per Decrypt.
October 22nd, 2026
Executive order sets 'Super Intelligence' terminology
Policy

Executive Order 14434 defines 'Super Intelligence' to cover technologies previously called artificial intelligence, including autonomous agents.
October 2nd, 2026

Scenarios

Framework stays guidance, no binding AI rule

Likely Resolves by End of 2027

Discussed by: OCC's own bulletin language and Reuters reporting

The OCC treats the framework as an examiner resource and updates it informally. Banks adjust agent permissions and human-oversight controls in response to exam findings rather than a formal rule. This is the path the agency describes in the document itself.

OCC turns AI guidance into a formal rule

Unlikely Resolves by End of 2027

Discussed by: Banking trade press and regulatory lawyers

Pressure from AI-driven incidents, or a change in agency leadership, pushes the OCC to convert the framework into enforceable standards. That would require notice-and-comment rulemaking and would give banks a defined compliance target instead of examiner discretion.

Framework revised to address outside AI agents

Possible Resolves by Q2 2027

Discussed by: Decrypt and the OCC's stated intent to update the guide

The OCC says it will update the framework as technology changes. A revision could add explicit expectations for customer- and fintech-operated agents, including identity verification, delegated permissions and revocation controls. The current document already lists those safeguards as considerations.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

April 2011

Model Risk Management Guidance (2011)

The Federal Reserve and the OCC issued supervisory guidance on how banks should manage the risk of quantitative models. It was guidance, not a rule, but it gave examiners a common vocabulary for reviewing models used in pricing, credit and capital.

Then

Banks built formal model-validation teams and documentation standards to satisfy examiners.

Now

The framework became the reference point for later reviews of algorithmic and AI systems.

Why this matters now

The OCC's new AI framework follows the same pattern: nonbinding guidance that shapes behavior through examinations rather than statute.

March 2013

Interagency Leveraged Lending Guidance (2013)

Three federal banking agencies issued guidance on leveraged lending, warning about weak underwriting in high-debt deals. It set no legal limit, but examiners used it to challenge bank practices.

Then

Some banks pulled back from leveraged loans, and examiners cited the guidance in supervisory findings.

Now

It showed how guidance can constrain lending even without a formal rule.

Why this matters now

It is the clearest recent example of bank guidance carrying practical weight, which is the question hanging over the OCC's AI framework.

August 2024

European Union AI Act (2024)

The EU adopted a binding, risk-tiered law regulating AI systems, with obligations phased in over several years. It classifies uses by risk and imposes requirements on high-risk applications.

Then

Companies began mapping AI uses to the law's risk categories ahead of compliance deadlines.

Now

It became the main contrast point for jurisdictions weighing rules versus guidance.

Why this matters now

The OCC chose guidance and examiner discretion where the EU chose statute and tiers, a split that will shape how multinational banks manage AI compliance.