1. What the OCC released on November 4
The Office of the Comptroller of the Currency (OCC), the federal regulator that supervises national banks, published its first AI framework for bank examiners on November 4, 2026. The 22-page document tells examiners to focus on what happens when an AI system errs, not on how advanced it is. It also addresses outside AI agents near customer accounts and is nonbinding.
The framework appears in OCC Bulletin 2026-54 and an accompanying news release. It is the agency's first attempt to give its supervisors a single reference for judging how banks deploy machine-learning tools, generative models and autonomous software agents. Until now, examiners have generally applied general guidance on model risk, operational resilience and third-party relationships to these systems case by case.
The central message is one of proportion. A bank does not need to treat every AI tool alike, the regulator indicates, because the harm a tool can cause depends far more on what it is allowed to do than on the sophistication of its underlying model. That shift in emphasis shapes the rest of the document, from its risk tiers to its suggested safeguards.
For readers outside banking, the OCC is one of the main federal bodies that charters and oversees national banks and federal savings associations. Its examiners visit institutions regularly, review their controls and issue findings that banks are expected to address. Guidance published by the agency therefore works as a preview of the questions banks will face in their next examination cycle, even when the text itself is described as advisory.
2. Why is AI that moves money riskier than AI that writes memos?
A program authorized to initiate financial transactions can pose a greater danger than a far more capable model that only drafts internal documents, according to the framework. The OCC deliberately separates technical power from consequence. A simple agent with permission to send payments can drain an account in minutes, whereas a sophisticated model confined to writing summaries can, at worst, produce a flawed paragraph that a person will read before anything happens.
To make that distinction usable, the framework asks examiners to consider several questions about any given system: how severe the consequences of a failure would be, whether the resulting actions can be reversed, and how much human control remains in the loop. A payment that settles instantly and cannot be recalled sits at a very different point on that scale than a recommendation that a loan officer reviews before acting.
This approach also explains why the agency has avoided naming specific technologies or vendors. Models change quickly, and a rule that targets a particular architecture would be outdated within months. Anchoring supervision to autonomy and potential harm gives examiners a yardstick that should remain meaningful as the technology evolves.
There is a practical reason for this framing. Financial institutions already apply layered controls to human employees, such as spending authorities, dual sign-off on large transfers and separation between those who initiate and those who approve a payment. The framework effectively asks whether software that acts on its own has been placed under comparable controls, or whether it has been granted wide powers because it is convenient and fast.
3. How does the framework tier AI risk?
The OCC lays out four illustrative risk tiers. At the top are fully autonomous payment agents and systems that make credit decisions in real time. At the bottom are basic internal productivity tools, such as software that helps staff draft or organize routine work. The tiers are described as examples rather than a rigid classification that every bank must adopt.
Systems placed in higher tiers may warrant tighter limits on how much they can do independently, testing performed by parties independent of the team that built them, and a requirement that a person approve consequential actions before they take effect. The framework notes that an autonomous payment agent belongs in the highest tier regardless of how well it performs in testing, which signals that strong benchmark results will not, by themselves, lower the scrutiny.
The document also addresses systems that continue operating while making harmful decisions, a failure mode that is especially worrying for software that runs without pause. Suggested safeguards include circuit breakers that halt activity when behavior looks abnormal, rate limits that cap how quickly a system can act, restricted permissions, and emergency shutdown controls that allow a bank to stop a system at once.
The tiering is meant to help banks decide where to invest effort. A lender that runs dozens of AI tools can concentrate its independent testing and approval requirements on the handful that move money or decide credit, and apply lighter oversight to tools that simply save staff time. The alternative, applying the same heavy process to everything, tends to slow down low-risk projects without making the dangerous ones safer.
4. What does the guidance say about outside AI agents?
In its section on operational resilience, the OCC warns that external agents run by customers, financial technology firms or other businesses can create risks for a bank even when the bank does not control those systems. The agency says the framework extends to agents that connect through a bank's channels, in addition to AI the bank builds or buys for its own use.
For examiners, the suggested lines of inquiry include how a bank verifies identity, how permissions are delegated to a piece of software acting on a customer's behalf, what transaction limits apply, how activity is monitored, and whether the bank can suspend or revoke access quickly. These are practical questions that go to the heart of a dilemma now facing lenders: how to let customers use AI assistants to manage their money without handing autonomous software unrestricted access to their accounts.
The agency has not linked the release to any specific incident. Even so, the timing is notable, because the guidance arrives less than two weeks after reports that several large banks had restricted such access.
Identity is the first obstacle. A bank that sees a login from an automated program must decide whether the person behind it truly authorized that program, and for what purpose. Delegated permissions are the second: even a legitimate agent should be limited to the narrow tasks the customer approved, such as viewing balances, rather than inheriting every power the customer holds. Transaction limits and the ability to revoke access then act as the final backstops.
5. The rogue-agent problem facing large banks
A report published on October 22 said major banks had discovered unauthorized third-party AI agents inside customer accounts, in some cases acting beyond what the account holders had instructed. According to that account, Morgan Stanley blocked outside agents altogether, while JPMorgan, Bank of America and Citi limited their access. Bank executives described the situation as "horrifying".
The episode raised an uncomfortable question about control: when an autonomous program has access to someone's funds, it is not always clear who is responsible for what it does, or how a bank can tell software that a customer genuinely authorized from software that has exceeded its permissions. The OCC framework's emphasis on identity verification, delegated permissions and revocation speaks to exactly that difficulty.
Banks have long dealt with automated access, from account aggregation tools to payment applications. What distinguishes AI agents is that they can interpret instructions, choose among actions and keep going without a person approving each step. That flexibility is what makes them useful to customers, and it is also why supervisors want clear limits.
Customers are adopting AI assistants quickly, and many expect them to handle chores such as paying bills, moving savings or comparing rates. Banks that block every outside agent risk frustrating those customers, while banks that allow everything risk fraud and disputes over who authorized a transfer. The framework does not settle that tension, but it gives supervisors and banks a shared vocabulary for discussing it.
6. Guidance, not new banking rules
The OCC states that the document creates no new regulatory requirements and no enforceable standards. Examiners are meant to assess AI within the categories of operational, compliance and cybersecurity risk that already exist, and banks are not required to create a separate AI risk category. In practice, that means the framework shapes how supervisors ask questions and evaluate answers, but it does not by itself impose penalties or deadlines.
The scope is broad. It covers AI used in payments, fraud detection, customer service and other operations, as well as conventional machine-learning tools and autonomous agents alike. Because it is framed around consequences, a bank using a modest-looking tool in a sensitive function may find itself held to a higher bar than one using an impressive model in a harmless role.
Even nonbinding supervisory guidance tends to carry weight, since banks usually adjust their internal controls to match what examiners are trained to look for. Institutions that already limit AI permissions, log agent activity and keep human approval in place for large transfers will likely find the framework consistent with their existing practices.
Another effect of the framework is on documentation. Banks that can show how they classified each AI system, which controls apply at each tier and who approved the arrangement will be better placed to answer an examiner's questions. Institutions that cannot readily explain what their AI tools are permitted to do may find that the gap becomes a topic of supervisory attention.
7. What happens next
The OCC says it will update the guidance as the technology develops, so the tiers and examples may change as new uses emerge. No date for a revision has been given. Banks and fintech firms that rely on automated agents will be watching how examiners apply the framework in their first reviews, especially around the question of how much autonomy is acceptable in payments.
For crypto and payments companies that are building agent-driven products, the document offers an early signal of how a major federal banking supervisor thinks about autonomy, permissions and reversibility. Any firm hoping to connect AI agents to bank accounts should expect to be asked how it verifies identities, how it limits what an agent can spend, and how quickly access can be shut off if something goes wrong.