The OCC and Federal Reserve are asking banks detailed questions about AI governance, vendor risk, and kill switches during standard exams
Bloomberg / Getty Images
U.S. banking regulators have begun incorporating artificial intelligence oversight into every routine bank examination, pressing lenders on how they deploy the technology across higher-risk functions including lending, customer verification, and sanctions screening.
According to Reuters, which cited three people with knowledge of the situation, both the OCC and the Federal Reserve have made AI a standing topic in their routine examinations, with no bank review now taking place without some discussion of the technology. These conversations happen in written form as well as in person, and the agencies have so far stopped short of mandating specific practices, treating the process primarily as a fact-finding exercise.
Examiners are pressing banks to explain how their AI systems are governed, including what technical limits have been placed on model behavior, how human review is structured, and whether emergency shutdown capabilities — commonly called kill switches — exist to disable a system when problems arise. Banks are also being asked to identify the specific personnel or roles empowered to step in during a system failure and to demonstrate that documented backup plans exist.
Vendor risk is another central area of focus. The growing dependence on outside technology suppliers has drawn scrutiny of whether the AI vendors banks contract with — and the subcontractors those vendors in turn use — are held to governance and security expectations comparable to what regulators require of the banks directly. Banks must also show they have plans to disentangle themselves from a vendor whose system is compromised, according to the outlet.
No AI-specific rulebook has been written; instead, examiners are stretching established supervisory tools — including those governing model risk, outside vendors, and consumer protection — to evaluate how institutions handle the technology. One issue receiving particular attention is data boundary enforcement — specifically, whether AI tools are pulling in or drawing conclusions from information they were never authorized to touch, a risk amplified by the way these models are engineered to synthesize data from multiple sources and that carries implications for privacy and regulatory compliance, according to the outlet.
The three federal banking regulators — the OCC, the Federal Reserve, and the FDIC — issued updated model risk management guidance on April 17, 2026, clarifying that risk management practices should be tailored to a bank's size, complexity, and extent of model use. The guidance does not set enforceable standards, and non-compliance will not result in supervisory criticism, the agencies said. The OCC noted that generative AI and agentic AI models fall outside the scope of the updated guidance, and the three agencies plan to issue a separate request for information on banks' use of AI, including generative and agentic systems.
Federal Reserve Vice Chair for Supervision Michelle Bowman acknowledged the challenge of keeping pace with the technology in a May speech. "Today, banks are relying on existing risk-management frameworks to guide their use of AI," Bowman said. "While these supervisory tools are intended to support banks in applying sound governance and risk management, we should assess whether our supervisory guidance is fit for the future."
JPMorgan $JPM Chase, the largest U.S. bank by assets, plans to deploy autonomous AI agents capable of operating without human intervention for hours at a time later this year, an indication of how rapidly the technology is being embedded in major financial institutions.
Join 500,000+ readers who start their day with Quartz.
By subscribing, you agree to our Terms of Service and Privacy Policy.
