OCC AI Banking Guide Puts Autonomous Payment Agents in Highest Risk Tier

The US Office of the Comptroller of the Currency (OCC) has issued a supervisory framework to help regulatory examiners assess banks’ use of artificial intelligence in business activities. It places autonomous payment agents and AI systems that release fraud holds in its highest illustrative risk tier.

The guide includes four illustrative risk tiers and says a simple agent authorized to initiate transactions could pose greater risks than a sophisticated model used to draft internal documents. A fully autonomous payment agent falls into the highest tier regardless of how well it performs in testing.

The guide discusses how banks could detect and stop malfunctioning AI agents. Suggested safeguards include restricted permissions and emergency shutdown controls. The guide also highlights attacks that manipulate an agent’s instructions to bypass restrictions or misuse its access.

The framework is a resource for examiners and creates no new regulatory requirements or supervisory expectations for banks.

The framework also addresses risks from external AI agents interacting through bank channels. It suggests checks on agents’ identities and delegated permissions, alongside monitoring and the ability to revoke access.

The release follows Axios reporting that Morgan Stanley was blocking third-party AI agents, with JPMorgan, Bank of America, and Citi restricting access.

The document uses “super intelligence” (SI), a term that includes technologies and systems previously described by the US government as artificial intelligence.