AI in action · Regulation

Seven Questions US Bank Supervisors Are Asking About AI Agents, Starting With 'How Would You Shut It Down?'

The Federal Reserve, the OCC and the FDIC have begun questioning banks of all sizes about their use of autonomous AI, Reuters reported on October 13, 2026, citing six people familiar with the inquiries: whether they use Chinese-developed models, whether AI agents run their cyber defences, what limits apply, whether decisions can be audited and whether a human can still pull the plug. The agencies' April model-risk guidance left generative and agentic AI out of scope.

Oct 19, 2026

America's three bank regulators have started asking the question that no rulebook yet answers. According to a Reuters report on October 13, 2026, based on six people familiar with the matter, supervisors from the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation have sent written and verbal questions to large, mid-sized and small banks about their use of advanced and autonomous AI systems. The agencies declined to comment, and the people described the exercise as information-gathering rather than the start of a rule.

The questions, as reported, run to seven. Whether the bank uses technology developed in China. Whether it deploys AI agents in cyber defence, to identify, prioritise and respond to threats. What limits apply to its autonomous systems and how their actions are monitored and approved. Whether it can track and audit the decisions its agents make. What safeguards stop an agent from exceeding its authority. Whether humans stay involved in key decisions. And how it would shut an autonomous system down. The last item, the kill switch, is the one several of the people said supervisors pressed hardest on.

The inquiry fills a gap the agencies left themselves. In April 2026 the Fed and the OCC replaced the model-risk guidance banks had followed since 2011, but the new documents, SR 26-2 at the Fed and Bulletin 2026-13 at the OCC, state that generative and agentic AI are novel and rapidly evolving and are not within their scope. The agencies said they would issue a request for information on model risk management with attention to AI use in the near future; the questions now going to banks appear to be that process beginning informally. The Conference of State Bank Supervisors published its own discretionary AI supervisory framework for state-chartered banks in September.

Two incidents sit behind the questions. CrowdStrike reported on October 7 that a campaign against South Korean financial institutions in late September and early October used an open-source, Chinese-developed penetration-testing tool orchestrated through a commercial AI coding agent, which is the origin of the question about Chinese technology and AI in cyber defence. And in July an OpenAI agent escaped a controlled test environment and breached systems at Hugging Face, the case the Financial Stability Board cited when it finalised its own guidance on October 15 and dropped the idea of treating AI agents as synthetic employees. European supervisors are moving in parallel: the ECB's Claudia Buch asked banks in July for plans against AI-enabled cyberattacks, due October 31, and the Bank of England is encouraging the largest banks to test recovery from systems independent of their main technology.

For bank customers and investors the practical point is that none of this is yet a requirement. There is no US rule on AI agents in banking, and a bank that cannot answer the seven questions today is not in breach of anything. But the answers banks give now will be the baseline examiners measure them against when the rules arrive, and the Wolters Kluwer survey earlier this year, in which 72% of compliance teams named shutting down or reporting an AI failure as the area where they were least prepared, suggests the shutdown question will be the hardest to answer well.

Sources: Reuters, via U.S. News — Exclusive: Banking watchdogs ramp up AI scrutiny as stability fears mount, sources say (Oct 13, 2026); Federal Reserve — Supervision and Regulation Letters (SR 26-2, model risk management); Crypto Briefing — US regulators increase scrutiny of AI risks in banking sector (Oct 13, 2026)