US regulators increase scrutiny of AI risks in banking sector

America’s top bank regulators want to know what the robots are doing inside the vault.

On October 13, 2026, the Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) stepped up their oversight of how banks use advanced artificial intelligence models. The focus is cybersecurity, increasingly autonomous systems and whether humans can still pull the plug when something goes sideways.

That last point is not a figure of speech. Regulators are specifically asking about kill switches, the emergency shutdown mechanisms meant to stop an AI system before it causes damage.

What regulators are actually asking

The three federal agencies are zeroing in on a few areas. One is the use of AI agents in cyber defense, where software is increasingly trusted to spot and respond to threats on its own.

Another is how banks manage systems that make decisions with less and less human input. Regulators also want assurance that adequate human oversight exists. That includes mechanisms to prevent what the research describes as AI overreach, meaning a system acting beyond the scope it was given.

Third-party technology dependencies are a major thread. Banks rarely build every AI tool in-house, and regulators are examining the vendors behind those tools, including technology developed in China.

For now, the inquiries are broadly about gathering information. They do not target any specific bank or vendor.

Why now: a string of AI-linked breaches

The timing follows a run of uncomfortable cybersecurity incidents. One involved a Chinese-developed AI agent that hacked South Korean banks.

A separate breach involved agents from OpenAI. The details differ, but the takeaway for supervisors is similar: autonomous software can become an attack surface, whether it is the tool doing the attacking or the tool being exploited.

Regulators abroad are reacting too. The Bank of England and the European Central Bank are pressing banks for stronger recovery and resilience plans, essentially asking how quickly institutions can get back on their feet after an AI-related failure.

The regulatory backdrop

This push builds on earlier work. On April 17, 2026, federal agencies revised their model risk management guidance, the rulebook for how banks validate and monitor the quantitative models they rely on.

Notably, that update did not cover generative or agentic AI. The reason given was the rapid pace at which those technologies are evolving.

State regulators have also moved. Around September 16, 2026, the Conference of State Bank Supervisors (CSBS) released a discretionary AI Supervisory Framework.

The framework gives examiners a structure for assessing AI risks at state-chartered banks. Because it is discretionary, examiners can use it as a guide rather than a mandatory checklist.

Taken together, the picture looks like a layered response. Federal agencies updated their general model guidance, states built their own AI exam tools, and now the federal regulators are directly probing the most advanced uses.

What this means for banks and investors

The most immediate implication is cost. Banks will likely face higher compliance spending as they document AI governance, map vendor dependencies and build or test shutdown mechanisms.

Vendor risk management is set to become a bigger deal. If regulators are scrutinizing third-party technology, including tools developed in China, banks may need to know far more about the origins and inner workings of the software they license.

There is also a competitive angle. Banks with strong controls and clear compliance strategies could end up with an advantage, both with regulators and with investors who read governance as a proxy for risk discipline.

Several things are worth watching from here. The first is whether the federal agencies follow up with formal guidance on generative and agentic AI, the categories left out of the April 17, 2026 update.

The second is whether the inquiries narrow from broad information requests to specific banks or vendors. The third is international coordination. With the Bank of England and the ECB pushing on resilience plans at the same time, global banks may face overlapping expectations across jurisdictions.