The Office of the Comptroller of the Currency (OCC) has issued its first-ever guidance on how bank examiners should probe lenders’ use of artificial intelligence, according to a document seen by Reuters. Why it matters: the OCC’s rule of thumb is to judge an AI system by what happens when it is wrong, not by how clever the model is — and that framing will shape how the biggest US banks deploy AI agents.
November 4, 2026
What happened
The OCC, which oversees large national banks, issued the guidance on Wednesday and described it as the first of its kind for its examiners. Its central message cuts against treating AI as a special category of danger: supervisors should monitor how lenders use AI, but should not treat the technology as distinct from other risks. Banks are not expected to set up separate risk parameters just for AI, and examiners should not treat AI as a unique risk in itself.
Instead, examiners are told to weigh two things: how a bank is actually using a system, and the size and complexity of the bank using it. The document is guidance, not a legally binding rule — but as Reuters notes, banks typically follow supervisory guidance closely, so in practice it sets expectations lenders will organise around.
Judge the consequences, not the model
The most practical line in the framework is its example. A simple AI agent that is authorised to initiate transactions can be riskier than a sophisticated model used only for internal purposes, the OCC said. In other words, autonomy and authority matter more than model size: what a system is allowed to do — move money, approve, send, change records — decides how hard examiners should look at it.
Higher-risk uses may require greater restrictions on a system’s autonomy or more direct human oversight, the guidance says. That lands directly on the agentic systems banks are now rolling out: an agent that can act without a human in the loop should expect the toughest questions, however ordinary the underlying model is.
Why it matters
This guidance is the US follow-through on a pattern we covered in October, when banking regulators in the US and Europe were already quizzing lenders about agentic AI limits, audits and shutdown plans. The OCC has now put its position in writing, and it is a notably usable one: no separate AI risk bureaucracy, but real scrutiny of consequences, autonomy and oversight. For banks, the homework is clear — inventory what your AI is permitted to do on its own, especially anything that can initiate transactions, and be able to show the human checkpoint. For AI vendors selling into banking, “our model is state of the art” is not the pitch that answers an examiner; “here is exactly what it can and cannot do without approval” is.
Frequently asked questions
Is the OCC guidance legally binding on banks?
No. Reuters reports the document is not legally binding like a rule, but banks typically comply closely with supervisory guidance, so it shapes examiner expectations in practice.
Do banks need separate AI risk limits under the guidance?
No. The OCC says banks are not expected to establish separate risk parameters for AI, and examiners should not treat AI as a unique risk — they should weigh how each system is used and the bank’s size and complexity.
What kind of AI use worries the OCC most?
Uses where mistakes carry real consequences. The guidance gives the example of a simple agent authorised to initiate transactions being riskier than a sophisticated model used internally, and says higher-risk uses may need limits on autonomy or more direct human oversight.
Sources: Reuters