On Wednesday, the Office of the Comptroller of the Currency issued its first supervisory framework for how large national banks use artificial intelligence. The regulator told examiners not to treat AI as a separate risk category and said banks do not need to set a distinct risk limit for the technology. Instead, the OCC described its approach as technology-neutral, with reviews based on how a bank uses AI, its size, and its complexity. The framework focuses less on how advanced an AI system is and more on the damage it could cause if it fails.
The guidance draws a sharp distinction between technical sophistication and operational harm. A complex internal AI tool may be less concerning than a simple AI agent authorized to initiate payments on its own. Fully autonomous payment agents and real-time credit decision systems fall into the highest risk tier, while basic internal productivity tools occupy the lowest. For higher-risk systems, the OCC said banks may need to limit what AI can do without human involvement, require independent testing, or keep a person closely involved before consequential actions proceed.
The framework arrives after major US banks moved to restrict outside AI agents from customer accounts. JPMorgan Chase, Bank of America, Citigroup, and Morgan Stanley have limited or blocked third-party agents over fears they could move unused cash or take actions beyond customer instructions. JPMorgan CEO Jamie Dimon described rogue agents as a danger, while Bank of America CEO Brian Moynihan said he wants a human involved before money leaves an account. The OCC guidance suggests safeguards such as identity verification, delegated permissions, transaction limits, monitoring, circuit breakers, restricted permissions, and the ability to suspend or revoke access.
The document does not create new enforceable requirements. Instead, it gives examiners a way to evaluate AI within existing operational, compliance, and cybersecurity risk categories. The OCC said the framework will be updated as AI technology develops. Earlier in April, the OCC, Federal Reserve, and FDIC had refreshed model risk rules but did not cover generative or agentic AI; the new framework closes that regulatory gap.
