Banks are increasingly turning to artificial intelligence, but regulators want to know whether financial institutions can keep the technology under control.
US banking regulators are questioning banks about their use of autonomous AI agents, the safeguards governing their actions, and their reliance on foreign-developed models, according to Reuters. European authorities are also examining how prepared banks are to withstand and recover from serious cyber incidents.
In Europe, regulators are pressing banks to strengthen their ability to recover from serious cyber incidents, reflecting a broader concern that AI capabilities may be advancing faster than the controls needed to manage them.
The scrutiny comes as AI tools become increasingly capable of carrying out multi-step technical tasks, potentially helping both defenders and attackers identify software weaknesses. For banks, the challenge is to benefit from these capabilities without giving AI systems excessive access to sensitive data, critical infrastructure, or financial operations.
Regulators want to know how banks control AI agents
AI developers may promise that their models are safe, but banking regulators want to know what happens when those systems are put to work inside financial institutions.
According to Reuters, in the U.S., the Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) are asking banks about their use of autonomous AI agents, the controls governing their actions, and the models they deploy.
One concern is auditability. Whether banks can reconstruct what an AI agent did, when it did it, and why it took a particular action.
Regulators are also examining how banks monitor these systems and restrict their actions, including whether human approval is required before an agent performs sensitive operations.
For example, a bank could require an employee to review an AI-generated recommendation before freezing an account or changing payment instructions. Such controls could help institutions benefit from automation without giving AI systems unchecked authority over consequential decisions.
Questions about the use of foreign-developed AI models also indicate that regulators are examining the technologies banks depend on, although the specific concerns behind those questions need to be established.
The regulatory scrutiny highlights two related challenges: controlling AI systems used within banks and ensuring that financial institutions can continue operating when cybersecurity defenses fail.
Why AI raises new cybersecurity concerns for banks
AI tools can help financial institutions automate technical tasks, analyze information, and identify potential security threats. However, giving these systems greater autonomy also raises questions about what happens when they make mistakes, follow malicious instructions, or act beyond their intended authority.
Recent developments, from reported AI-assisted attacks targeting South Korean bank defenses to the International Monetary Fund's (IMF) warnings about cyberattacks undermining confidence in financial markets, suggest the consequences could extend beyond individual institutions.
Chief among them are broader incidents of AI bypassing sandboxes and venturing into external, unauthorized systems. The concern is that if AI can do this in other sectors, it could also do the same in a sensitive sector like banking.
Together, these developments help explain why regulators are pushing banks to strengthen both their AI controls and their ability to recover when cyber defenses fail.
What tighter AI oversight could mean for banks
Greater regulatory scrutiny could push banks to demonstrate that their AI systems operate within clearly defined limits and that employees can intervene when necessary.
For financial institutions, this may mean more rigorous testing, better records of AI activity, tighter restrictions on what autonomous agents can access or change, and stronger recovery arrangements for critical services.
The implications also extend to customers. A serious cyber incident could disrupt payments, restrict account access, or expose sensitive financial information. Effective oversight and recovery planning can help banks limit those consequences, even when an attack cannot be prevented.
The central question for regulators is whether banks can demonstrate that AI remains accountable to the people and systems responsible for protecting financial operations.
Other news: Reports of tampered Ledger hardware wallets highlight how physical supply-chain attacks can put cryptocurrency holdings at risk.