Banks are handing more work to artificial intelligence.
Some AI tools now handle business activities like credit decisioning, customer service and fraud detection. That raises a simple question: Who makes sure these systems get it right? The nation’s top bank regulator offered its answer.
The Office of the Comptroller of the Currency released Nov. 4 the “OCC Supervisory Framework on Bank Use of Super Intelligence,” a new guide to help its examiners review how banks use AI.
The guide focuses on generative AI, which creates text and other content. It also covers agentic AI, which can take actions without a person stepping in each time. The OCC called this technology super intelligence, the term used by the executive branch in place of artificial intelligence, according to a Sept. 29 executive order signed by President Donald Trump.
The guide doesn’t create new rules for banks, according to an analysis from law firm Ballard Spahr. It’s a resource for the people who inspect them. Banks won’t have to treat AI as its own risk category. Examiners will instead look at how AI changes the risks banks already manage. These include fraud, privacy, cybersecurity and work with outside vendors.
The OCC built the guide around six areas, per the analysis. Examiners will ask what an AI system is allowed to do and what happens if it makes a mistake. They’ll look at the guardrails a bank has in place and who’s keeping watch. They’ll check how a bank recovers when a system fails. And they’ll want proof that the bank’s safety checks keep working over time.
The guide also said risk depends on how much freedom an AI system has, according to the analysis. A simple bot that can start payments may pose more danger than a powerful model that only helps staff draft memos. To sort this out, the OCC laid out four risk levels. Payment bots that act on their own and instant credit decisions sit at the top. Internal tools that never touch customer data sit at the bottom.
“[T]he more consequential and autonomous the activity, the more extensive the controls should be,” the analysis said.
Human review gets a close look, too. The OCC warned that a person who just clicks “approve” doesn’t count as real oversight. Reviewers need the skills, the facts and the power to reject or stop what the AI is doing, per the analysis.
Customers are a big focus. AI chatbots can give wrong answers about fees, interest rates or account balances. The OCC said these errors could lead to legal trouble and harm customers, according to the analysis. Banks can’t blame the machine, either. A bank is still on the hook if its AI breaks the law.
Many banks buy their AI from outside companies, so vendors face extra scrutiny, the analysis said. The guide asked whether contracts spell out who pays when an AI tool causes harm. It also asked whether vendors must warn banks before they change how their AI works. A vendor could add new AI features to an old product, and the bank might not notice the new risks.
So, what comes next? In a bulletin released with the guide, the OCC said the document sets no binding standards. Banks aren’t even expected to use it to grade their own AI programs.
Still, the analysis said banks shouldn’t ignore it. The guide offers a clear preview of what examiners may ask about during future bank exams. Banks should study it closely and check whether their current risk and compliance programs already cover the issues the OCC raised. Banks that find gaps now may have an easier time when examiners come calling.
For all PYMNTS AI coverage, subscribe to the daily AI newsletter.
