US OCC Unveils First AI Oversight Framework for Banks, Classifies Autonomous Payment Agents as Highest Risk

The US Office of the Comptroller of the Currency has unveiled its first supervisory framework for assessing banks' AI systems by the scale of potential harm. Autonomous payment agents that can move funds directly, along with real-time credit decision systems, were placed in the highest-risk category.

Crypto media outlet Decrypt reported on November 4 that the OCC released a 22-page AI supervision framework. Its core principle is to assess risk based on the impact a system malfunction could have on customers and banks, rather than on the complexity of the technology itself.

The framework divides risk into four tiers. Autonomous payment and real-time credit decision systems rank at the top, while basic internal productivity tools sit at the bottom. That means an agent that directly executes even simple financial transactions can be considered riskier than advanced AI used for document drafting.

For high-risk systems, the OCC outlined controls including limits on autonomy, independent testing and human approval before critical actions are taken. The same risk-assessment standard applies when external AI agents connect to bank channels. Banks can review identity verification, delegated authority, transaction limits, monitoring systems, and the ability to suspend or revoke access.

The guidance comes after reports that banks are responding to unauthorized access by external AI agents. Axios reported on October 22 that Morgan Stanley had blocked access by outside agents, while JPMorgan Chase, Bank of America and Citigroup were also restricting access.

The OCC said the document does not create new regulatory requirements or mandatory standards. Instead, it serves as guidance for evaluating AI within existing operational, compliance and cybersecurity risk-management frameworks, and banks are not required to create a separate AI risk category. The agency said it plans to keep refining the guidance in line with technological change.