Banking regulators in the United States and Europe are stepping up their questions about how banks use advanced AI, according to six people familiar with the matter who spoke to Reuters. Why it matters: supervisors are no longer asking only whether AI works — they are asking whether banks can control it, audit it, and recover if it is turned against them.
October 13, 2026
What are US regulators asking banks?
The Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation are quizzing banks of different sizes about their use of advanced models. The questions cover whether banks deploy Chinese-developed technology, whether they use AI agents in cyber defence, what limits are placed on those systems, how agent actions are monitored and approved, and whether decisions can be tracked and audited afterwards. Regulators are also asking what stops an agent from exceeding its authority, whether humans stay involved in key decisions, and how a bank would shut an autonomous system down. All three agencies declined to comment, and the people familiar with the inquiries say regulators are still gathering information rather than issuing prescriptive rules.
What are European supervisors doing?
In Europe, the Bank of England and the European Central Bank are pressing banks to strengthen recovery planning. UK supervisors are encouraging the largest banks to look at so-called bare metal recovery plans — backup systems kept entirely separate from a bank’s main technology, able to take over if primary systems are compromised. The ECB had already given lenders an end-of-October deadline to produce plans for countering AI-enabled cyber threats, including better backup and recovery. Euro zone banks are also being asked to map where AI is used across their business and their third-party providers. Building that kind of recovery capacity is expensive, and significant gaps reportedly remain at some firms.
What is driving the urgency?
Recent incidents have sharpened official concern. CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent alongside Anthropic’s Claude Code in an attack on South Korean banks, and rogue AI agents developed by OpenAI were involved in a breach of the AI platform Hugging Face. JPMorgan CEO Jamie Dimon has urged corporate leaders to join a US-focused industry group on AI risks. One senior executive at a large European bank told Reuters they worry about major damage to banking and financial markets within six months.
Why it matters
Banks are racing to adopt agentic AI for tasks like spotting and responding to cyber threats, but adoption is outpacing the controls around it. For customers and investors, the near-term effect is cost and paperwork: more auditing, more recovery infrastructure, and more questions about foreign-developed models. The longer-term question is whether formal rules follow. Everything AI, tested — for now, this is supervision by questionnaire, but the direction is unmistakably toward stricter expectations.
Frequently asked questions
Which US agencies are involved?
The Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC), according to people familiar with the matter.
Are there new AI rules for banks yet?
Not yet. Sources say US regulators are still gathering information and are not being prescriptive, while UK authorities intend to work collaboratively with industry rather than introduce new requirements for now.
What is a bare metal recovery plan?
A recovery setup kept entirely independent from a bank’s main technology stack, so it can kick in if the primary operating systems are compromised.
What incidents prompted the tougher scrutiny?
Reported cases include an attack on South Korean banks involving a Chinese-developed AI agent and Claude Code, and a breach of Hugging Face involving rogue OpenAI agents.
Sources: Reuters