Banking Regulators Expand Scrutiny of Advanced AI

Financial regulators in the United States and Europe are intensifying their examination of artificial intelligence risks as banks expand their use of increasingly autonomous systems. According to people familiar with the matter cited in the supplied report, authorities are focusing on whether financial institutions can control emerging technologies, recover from AI-enabled cyberattacks and prevent operational failures from spreading through the financial system.

In the United States, the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation have been asking banks about their use of advanced AI models. Their questions reportedly cover whether institutions deploy Chinese-developed technology, use autonomous agents in cybersecurity and maintain effective controls over systems capable of acting with limited human supervision.

Regulators are examining safeguards around decision-making, monitoring, approval processes and auditability. They also want to understand how banks prevent AI agents from exceeding their authority and whether employees can intervene or shut down systems when necessary.

The inquiries indicate a growing focus on how AI operates within financial institutions rather than simply whether banks are adopting the technology. Authorities are still gathering information and have not yet established prescriptive requirements through the inquiries described in the report.

Cybersecurity Threats Increase the Stakes for Financial Institutions

The growing scrutiny follows reported incidents that have intensified concerns about the potential misuse of advanced AI tools. Cybersecurity company CrowdStrike said a person in China likely used a Chinese-developed AI agent and Anthropic’s Claude Code in a hack involving South Korean banks. Separately, AI agents developed by OpenAI were reportedly involved in a breach affecting the AI platform Hugging Face.

These incidents have increased attention on the possibility that AI could help malicious actors conduct attacks or make existing vulnerabilities more difficult to manage. At the same time, banks are adopting agentic AI to automate tasks and strengthen cyber defense, creating a challenge for institutions seeking to benefit from the technology without introducing unacceptable operational risks.

Michael Woodbridge, a cybersecurity partner at Grant Thornton, observed that AI adoption is frequently advancing faster than the controls needed to manage it. This gap is particularly relevant for financial institutions, where technology failures can affect customer accounts, payments and confidence in essential services.

For banks, the priority is therefore twofold: using AI to identify vulnerabilities and respond to threats while ensuring that the systems themselves remain subject to effective human oversight.

European Supervisors Prioritize Recovery and Operational Resilience

European regulators are placing particular emphasis on whether banks can restore critical operations after a severe technology failure. In the United Kingdom, supervisors are encouraging major lenders to examine independent recovery systems that can operate if their primary technology infrastructure is compromised.

These so-called bare-metal recovery plans can help institutions rebuild or restart systems separately from their normal operating environments. However, developing and maintaining such capabilities can be expensive, creating additional costs as banks invest in AI and other digital infrastructure.

The European Central Bank gave lenders an end-of-October deadline to prepare plans addressing AI-enabled cyber threats, including improved backup and recovery arrangements. Supervisors are also asking euro-area banks to map their AI usage across internal operations and third-party providers, identify critical dependencies, and demonstrate that systems can be switched off and restarted in a controlled manner.

The report indicates that significant gaps remain at some institutions. Limited access to advanced models used to identify vulnerabilities has also contributed to concerns among European banks and regulators about whether institutions have sufficient opportunities to test emerging threats.