Banking regulators expand AI scrutiny as stability risks grow

Traders Union
All News
Financial News
Banking regulators expand AI scrutiny

Highlights

U.S. regulators including the Federal Reserve, OCC, and FDIC are widening probes into banks' use of autonomous AI, focusing on cyber risk controls, human oversight, and shutdown mechanisms.
European supervisors such as the ECB and Bank of England are requiring banks to strengthen AI-related cyber recovery plans, setting an end-October deadline for documented improvements after recent incidents.
Authorities and industry warn new agentic AI increases IT and cyber vulnerabilities, prompting calls for costly bare metal recovery solutions and comprehensive mapping of AI dependencies across primary and third-party systems.

Regulators intensify questions on banks' AI use

As first reported by Reuters, banking supervisors are widening their examination of banks' use of advanced AI models, with U.S. agencies including the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation asking lenders how they deploy increasingly autonomous systems. The inquiries cover whether banks use foreign-developed technology, how AI agents are applied in cybersecurity and what controls exist to monitor, approve and audit machine-led decisions.

The U.S. review is focusing in part on agentic AI used to identify, prioritize and respond to cyber threats. Regulators are also asking what safeguards prevent systems from exceeding their authority, whether humans remain involved in key decisions and how banks can switch off autonomous tools if needed.

In Europe, supervisors including the Bank of England and the European Central Bank are pressing banks to strengthen recovery plans as they assess whether fast-moving AI advances could disrupt financial markets sooner than previously expected. The ECB in July gave lenders an end-October deadline to produce plans to counter AI-enabled cyber threats, including stronger backup and recovery arrangements.

Cyber resilience and recovery costs come into focus

Recent incidents and industry warnings are adding urgency to the debate. CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent and Anthropic's Claude Code in a hack on South Korean banks, while rogue AI agents developed by OpenAI were involved in a breach at AI platform Hugging Face.

Banks are racing to adopt agentic AI to perform tasks with limited human supervision, even as new models introduce fresh IT and security weaknesses. In the UK, supervisors are encouraging the largest banks to examine so-called bare metal recovery plans, systems that operate independently from a bank's main technology setup and can be activated if primary systems are compromised, although such arrangements are costly to build and maintain.

Supervisors are also asking banks to map AI use across their businesses and third-party providers so they can understand critical dependencies and restart systems in a controlled way after an incident. Sukand Ramachandran, managing director and senior partner at BCG, said rapid recovery matters as much as prevention because a serious attack without clean and secure copies of critical data could lock customers out of accounts and disrupt payments across the wider economy.

We previously reported on Anthropic’s new safeguards designed to curb AI “distillation” attempts that try to copy Claude’s reasoning capabilities. The company said these protections sharply reduced token extraction and led to bans of tens of thousands of accounts linked to such campaigns, underscoring the growing security and control challenges surrounding frontier AI systems.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.