Reuters reported on Tuesday, citing people familiar with the matter, that the Federal Reserve, the OCC and the FDIC are questioning banks about their use of advanced AI. Do you use Chinese-developed technology? Do you use AI agents in cyber defense? What limits sit on those agents, how are their actions approved, can you audit their decisions, does a human stay in key decisions, and how would you shut the systems down? The questions are going out in writing and verbally to large, mid-size and smaller banks. Reuters says the agencies are still gathering information and are not yet prescriptive.
Europe has already moved past questions. In July the ECB gave euro zone lenders an end-October deadline to produce plans against AI-enabled cyber threats, including better backup and recovery. Euro zone banks are also being asked, one person told Reuters, to map how AI is used across their businesses and their third-party providers, and to make sure they can switch those systems off and restart them in a controlled way. UK supervisors are encouraging the largest banks to examine recovery systems that sit entirely outside their main technology stack, which Reuters notes are expensive to build and run.
This matters outside banking. Supervisory questions are where formal guidance starts, and bank examiners tend to set the bar that auditors, insurers and other sector regulators copy. The questions are also plain operational ones that any company running agents should be able to answer today: an inventory of every agent, the vendor and model behind it, its permissions, its approval path, its log, and a tested off switch.
The cost is real but bounded. Most of it is documentation and testing that should exist already. The expensive part is recovery that works when your primary systems are compromised, and that line belongs in the 2027 budget now, not after an examiner writes it into a finding.
If you cannot answer the shutdown question in writing, slow new agent deployments until you can. That is cheaper than doing it under a deadline someone else sets.
Action items
US bank supervisors are now asking how AI agents are limited, approved, logged and switched off. Those are fair questions for any company that runs agents.
For the CISO
Build one register of every agent in production: vendor, model, permissions, approval path, log location, and a shutdown procedure you have tested.
For the CFO
Add a line for recovery systems that work when primary systems are compromised. Europe's banks are already being pressed to build it.
For the General Counsel
Treat the US questions as a draft of future guidance, and keep written answers ready before an examiner, auditor or insurer asks.
Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.
Also worth knowing
- Reuters (via CP24)Banking watchdogs ramp up AI scrutiny as stability fears mount, sources say(opens in a new tab)
US regulators are asking banks about agent limits, approvals, audit trails, Chinese technology and shutdown. The ECB set an end-October deadline for AI cyber recovery plans. Expect other sectors to borrow these questions.
- Deal N TechGemini 4 Argon Is Now Available to Google AI Pro and Ultra Subscribers and Paid API Developers(opens in a new tab)
Argon is now on the paid Gemini API at $2 in and $10 out per million tokens until November 30, then $4 and $20. Run your bake-off at the intro price, but budget at the standard one.
- LeadDevAI code causes real world production outages(opens in a new tab)
In an Undo survey of 300 engineering leaders, 81% had an outage tied to AI coding tools in six months and 79% said release cycles are no faster. Measure shipped, stable releases, not lines generated.