On 4 November the Office of the Comptroller of the Currency (OCC), which supervises nationally chartered US banks, published a 22-page examination framework for generative and agentic AI under Bulletin 2026-54. It ties the classification of an AI agent to the potential cost of an error. On 21 October this site reported that only the US state supervisors had written down what the federal agencies were leaving open on AI agents. The framework appears to be the first document from any of the three federal banking agencies to treat both as a subject of examination, after the Federal Reserve (Fed), the OCC and the Federal Deposit Insurance Corporation (FDIC) carved them out of their new model risk guidance in April. The article on the state supervisors set out that gap in detail.
The technical sophistication of the model comes second to that. The illustrative tiers therefore place a plain rules-based agent that may initiate payments above a powerful model confined to internal drafting, and a fully autonomous, customer-facing payment agent lands in the top of four illustrative tiers, “regardless of how well it performs in testing”. At first sight, two other points stand out: the term “Super Intelligence” (SI), which an executive order has required federal agencies to use since October, and the statement that the framework creates no new expectations for banks. Both are accurate. For chief risk officers, though, the substance lies in the checklist itself. Reuters reported on 13 October that the three agencies had informally been asking banks about the limits on agents, the traceability of their decisions and how to shut them down, and the checklist largely matches those questions.
What follows is a reading of an examiner document, not a forecast of examination findings. The framework calls its tiers “illustrative”, uses “may” and “could” almost throughout, and says it will be revised regularly. According to the bulletin, however, the OCC has instructed its examiners to tailor their review of AI to the materiality of each use case. This framework is the document built for that task. As of 5 November, neither the Fed nor the FDIC had published anything comparable, and the request for information (RFI) on AI in model risk announced in April had not appeared in the Federal Register. The bulletin states expressly that banks are not expected to use the document to assess themselves, so reading obligations into it stretches it. Dismissing it as a statement of intent undervalues it all the same, because it hands examiners a set of questions they can use.
What: OCC Bulletin 2026-54, issued on 4 November 2026, with the “OCC Supervisory Framework for Bank Use of Super Intelligence”, 22 pages, 16 components in six pillars, four illustrative risk tiers
For whom: OCC examiners. Supervised entities are national banks, federal savings associations and federal branches and agencies of foreign banks, which together hold 68% of US commercial banking assets according to the OCC
Legal status: an examiner resource which, according to the bulletin, sets no new supervisory expectations for banks. A separate risk appetite for AI is not required
Context: covers generative and agentic AI, which the model risk guidance issued on 17 April 2026 (SR 26-2, OCC Bulletin 2026-13) excludes
Catch: no paper yet from the Fed or the FDIC, and the announced RFI had not appeared by 5 November. German banks mostly run their New York branches under a state licence and therefore fall outside the OCC
A simple rules-based agent with payment authority can be riskier than a sophisticated model
Section 1.1 states the principle: “A bank’s control intensity could increase with the potential consequences of an SI agent’s failure or misuse.” A use case may be classified by its potential consequences, by the “transfer of agency” and by the degree of human oversight, “rather than the technical sophistication of the SI used”. Section 3.1 breaks this down into seven factors. First comes consequence, meaning whether the system merely informs a human decision, decides on its own or acts on its own, for instance by moving funds or changing a customer record. Reversibility and the level of autonomy follow. They are supplemented by the potential impact on customers, markets and the bank, the sensitivity of the data, the explainability of the output and the provenance of the model, whether built in-house, fine-tuned from a third-party base model or consumed as an external service.
Under section 3.1 the factors combine into a composite tier, and section 3.2 sets out four tiers with examples that the OCC expressly calls illustrative. The top tier holds the autonomous payment agent, real-time credit decisioning, the release of payments held after a fraud check, and market access. Below it come AI-assisted underwriting, customer communications initiated by an agent, the disposition of anti-money-laundering alerts, and code assistance that changes internal code or data access. The third tier covers summaries for credit memos with mandatory human approval. The bottom tier holds internal productivity tools with no access to customer or financial data. Anyone who has run a trading floor with limits will recognise the logic. A limit is sized by the largest possible loss on a position, not by how clever the strategy behind it is, and a trader with a plain strategy and a large limit needs more oversight than a brilliant analyst with no authority to trade.
This way of thinking is not new, admittedly. Model risk was already managed by materiality under the 2011 guidance, and the optional worksheet of the state supervisors has sorted use cases into tiers since September. Yet the two grids add up differently. In the worksheet of the Conference of State Bank Supervisors (CSBS), the highest-rated single factor generally sets the preliminary tier. At the OCC the factors combine into a “composite tier”, with no rule for how. Autonomy also becomes an axis in its own right: under section 2.2, how long an agent may run without a meaningful human checkpoint, and which data, tools and accounts it can reach, may materially affect its risk. The inventory thus moves from the model risk team to the business lines that grant an agent its permissions. The OCC does not require a separate risk appetite for AI. Section 2.4 does, however, describe what such a risk appetite could cover if the board and senior management set one: autonomy, permitted actions, impact on customers and the bank, legal and operational exposure, concentration. An examiner who asks about it will find the outline in the document.
The framework plans for the agent that keeps running and still gets it wrong
The section on operational resilience contains the sentence that separates the examination of an agent from that of a data centre: “An agentic system could remain available while taking inappropriate or harmful actions”. An outage is noticed at once. A system that stays up and does the wrong thing may only surface in the evening reconciliation. As possible remedies the framework lists monitoring, control agents, deterministic rules, “circuit breakers, rate limits, least-privilege permissions, and kill switches”. It describes a fallback, whether trained staff, a narrower substitute agent or another approved process, which the bank may test, and a separate workstream for affected customers that runs from identifying everyone affected to independently verifying that the remediation is complete. Where a kill switch should sit, at the individual firm or across the market, was discussed here using the Bank of England as an example. The OCC answers the question for the bank itself.
Capital markets have known this failure mode since 1 August 2012. According to an order of the US Securities and Exchange Commission (SEC) issued on 16 October 2013, broker Knight Capital’s automated order router turned 212 small customer orders into millions of child orders that morning and generated more than four million executions in 154 stocks in roughly 45 minutes. Knight lost more than $460 million. The system was available throughout. It was simply running a long-retired piece of code that a repurposed flag had revived on one of eight servers. The SEC found that Knight had no procedures to halt the system in response to its own aberrant activity. Ninety-seven automated messages before the open were not designed as alerts and were generally not read. The first countermeasure, removing the new code from the seven servers that were working correctly, made matters worse. No AI was involved. Knight ran a plain, rules-based router with authority to trade, of the kind the OCC has in mind in section 1.1.
The framework is just as precise about where human oversight could break down. It distinguishes human-in-the-loop, approval before each action, from human-on-the-loop, active monitoring with the authority and practical ability to intervene. Review triggers and standards could be set so that approval is “more than a nominal click”, while high volumes and bulk approval could degrade review quality and feed alert fatigue. Banks could assess how many agents, accounts, alerts or actions one person can credibly monitor and how much time is left to intervene. The summary table states the underlying risk plainly: a named human reviewer without practical authority, competency, capacity or a meaningful review standard. Knight’s 97 unread messages show a related weakness: the message was there, but nobody read it.
Section 2.14 is specific about the audit trail. Records may allow material outputs or actions to be reconstructed even when the model cannot produce a rule-based rationale. As evidence the framework names inputs, outputs, context, retrieved sources, “tool calls”, approvals, overrides and actions, together with versions of the model, prompt, fine-tuning, data, configuration, provider, tools and permissions. Explainability tools may point to factors associated with an output, “but they do not reveal the SI’s reasoning”. For internal audit this creates a task, set out in section 2.15: where a control agent, a fallback agent or a kill switch serves as the last line of defence, audit may assess whether that backstop is independently governed, tested and effective. Knight had no procedure to halt the system, and so no such safeguard.
Super Intelligence is, for now, official language for the same technology
The term in the framework’s title has little to do with its content. Executive Order 14434, “Inaugurating the Era of Super Intelligence”, signed on 29 September and published in the Federal Register on 2 October, directs the executive branch to use “Super Intelligence” and “SI” in place of “Artificial Intelligence” and “AI”. Under Sec. 2(b), earlier regulations and documents need not be altered. Sec. 3 ties the definition to the existing statutory definition of AI. The OCC is not alone: the SEC also refers to “super intelligence (SI)” in its examination priorities for 2027. The law firm Wiley summarised the order on 2 October as changing “federal terminology, not the substantive scope of technologies currently covered by federal law”. That holds only for now. Under Sec. 3(b), the President’s science and technology adviser is to submit proposed legislative language for a federal definition within 60 days, so by the end of November, and to consider whether it should modify or expand the existing definition of AI.
In the OCC document the renaming reaches into the annex. Its lexicon adopts the definitions of the Artificial Intelligence Executive Oversight Group, a working group of the US Treasury, financial regulators and industry representatives that published its glossary on 19 February 2026, and notes that “artificial intelligence” and “AI” have been changed to “Super Intelligence” and “SI”. A footnote shows the OCC using the technology it describes: the framework was “prepared with the assistance of SI”, but the content was “reviewed, edited, and approved by a human”. An examiner document that asks examiners to look at human sign-off on machine drafts thus applies the procedure it describes to itself. For banks the name changes nothing they would need to implement. On 7 October the Cloud Security Alliance advised against creating a separate risk tier called SI in response to the order, and the framework now says the same: examiners should not treat SI as a separate risk category.
Under Annex III of the EU AI Act the payment agent would not be high-risk
Europe sorts AI by a different question. The EU AI Act, Regulation (EU) 2024/1689, identifies high-risk systems through a closed list of purposes in Annex III, and for banks that list has exactly one entry, point 5(b): AI systems “intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud”. How this approach turns on intended purpose, and where it governs autonomy and the stop button, was set out here in the context of Citigroup’s agent architecture. For the comparison with the OCC, one finding suffices. On the author’s own mapping, real-time credit decisioning would fall under point 5(b) of Annex III, but only for natural persons. The payment agent, market access and the release of held payments appear in no entry. Two caveats remain. An agent that analyses biometric behavioural traits may fall under point 1 of Annex III, and the Commission’s guidelines on classification exist only as a draft dated May 2026. Under the digital omnibus, Regulation (EU) 2026/1744, the obligations apply from 2 December 2027.
The comparison is fair only with a qualification. Under Article 9, the AI Act protects health, safety and fundamental rights, whereas the OCC protects the soundness of the bank and its customers. The AI Act asks whether a purpose appears on a list that protects fundamental rights. The OCC asks, for every purpose, how hard an error would hit the bank and its customers. For high-risk systems, which in banking means creditworthiness assessment of natural persons, the AI Act itself points to the law that already applies. For financial institutions, Article 26(5), second subparagraph, deems the deployer’s monitoring obligation fulfilled by complying with the internal governance rules of the relevant financial services law. Under Article 26(6), second subparagraph, they keep the logs as part of the documentation that law requires. The article on the case studies of the Financial Conduct Authority (FCA) already described this cross-reference. For every other agent, the payment agent included, that governance law is the only framework anyway. Either way, a tiering model for agents would have to sit in the EU where a bank’s governance is regulated.
No such model can be found there yet. The ninth amendment to Germany’s Minimum Requirements for Risk Management (MaRisk), published in June 2026, deals with AI in AT 4.3.4 under the “use of models” without naming agents. It does not apply to institutions directly supervised by the European Central Bank (ECB). The Digital Operational Resilience Act (DORA) does not contain the words “artificial intelligence” and is built around availability, integrity and confidentiality. Whether an agent that is available but acting wrongly counts as an information and communication technology (ICT) incident remains a matter of interpretation. BaFin’s guidance on ICT risks in the use of AI, published on 18 December 2025, is, like the OCC framework, non-binding, as it “definiert keine aufsichtlichen Erwartungen” (sets no supervisory expectations), and recommends, on a risk basis, “lückenlose Protokollierung von KI-Entscheidungen, Modellversionen und Trainingsdaten (soweit datenschutzrechtlich zulässig)” (complete logging of AI decisions, model versions and training data, where data protection law permits). Its 38 pages never mention agents, and instead of tiers it separates systems in critical or important functions from assistants under full human supervision.
For the payment agent, the EU relies on different law: under Article 97 of the second Payment Services Directive (PSD2), initiating a payment requires strong customer authentication, and under Article 73 the institution refunds an unauthorised payment by the end of the following business day at the latest. Read this way, the liability follows a logic of consequences closer to the OCC’s than to the AI Act’s. Whether a payment initiated by an agent counts as initiated by the payer is an open legal question. What the OCC sets out in 22 pages, a German institution today finds spread across several bodies of rules, from the EU AI Act through MaRisk and DORA to PSD2.
The framework applies to few German banks in New York
As a direct examination standard, the framework applies to national banks, federal savings associations and federal branches of foreign banks. According to the OCC’s institution lists as of 30 September 2026 and the Fed’s structure data, Deutsche Bank, Commerzbank, DZ BANK, Helaba, LBBW, NORD/LB and HypoVereinsbank run their New York branches as state branches, supervised by New York State and the Fed. Deutsche Bank Trust Company Americas is not a national bank either, but a state member bank supervised by the Fed. Within the Deutsche Bank group, only two trust banks sit with the OCC, Deutsche Bank National Trust Company and Deutsche Bank Trust Company, N.A. Among the state-owned regional banks (Landesbanken), only BayernLB has a federal branch. Among European banks, Santander and UBS are inside the perimeter with federal branches and their own national banks, while BNP Paribas, Société Générale, Crédit Agricole and Rabobank are not. For most German banks the framework is therefore not an examination standard. It is, however, a fully drafted template from a federal banking supervisor for what their own governance rules still lack.
Recommendations for risk management, model risk and internal audit
For each agent, record whether it informs, decides or acts on its own, whether an error can be caught before harm occurs, how long it runs without a human checkpoint and which accounts, tools and data it can reach. The seven factors in section 3.1 of the OCC framework make a workable template, including for institutions that will never see an OCC examiner. The OCC expressly does not expect banks to use the document for self-assessment, but it works as a voluntary outline. The existing class in the model inventory stays alongside, as it answers a different question.
The framework suggests describing permitted data sources, systems, tools, accounts and actions “in terms that can be tested” rather than as a general capability. Only then can anyone tell when an agent strays from its mandate. Under section 2.1, activity outside the approved purpose may be treated as a control failure even when the outcome looks reasonable.
A kill switch that has never been pulled is an assumption. A useful exercise halts a top-tier agent, keeps the business process running through staff or a narrower substitute agent, and identifies and corrects every affected customer. Internal audit can then test this safeguard like any other control.
Input and output are not enough for a reconstruction when an agent retrieves sources, operates tools and obtains approvals in between. Reuters reported in October that supervisors were asking whether banks can track and audit agent decisions, and logs of tool calls, approvals, overrides and model and prompt versions are what that requires. In the EU these logs can rest on the record-keeping duties of financial services law, to which Article 26(6) of the EU AI Act points for high-risk systems.
A payment agent that is not a high-risk system falls outside the AI Act’s obligations but not outside risk management. It is worth deciding whether a system that is available but acting wrongly is treated in-house as an ICT incident under DORA, and documenting the classification under Annex III together with its reasoning. Institutions operating a federal branch in New York should also check which of their agents fall under the OCC framework there.
Glossary
Human-in-the-loop and human-on-the-loop: In the first case a person approves each output or action before execution, in the second a person monitors a system running on its own and can intervene. For the OCC’s classification, what counts is which of the two is actually practised.
National bank and federal branch: a bank with a federal charter, or a branch of a foreign bank with a federal licence, both supervised by the OCC. A state branch holds its licence from the state and falls outside the OCC framework.
Kill switch and circuit breaker: an emergency switch that halts an agent at once, and an automatic interruption triggered at preset thresholds. Both only work if the business process can continue afterwards.
Scope drift: an agent acting outside its approved purpose. The OCC framework treats this as a control failure even when the outcome looks reasonable.
Request for information (RFI): a public query from a US agency to the industry, usually ahead of guidance or a rule. The RFI on AI in model risk announced in April had not appeared by 5 November 2026.
Christian Schablitzki – the agentic banker
Strategy & Management Consultant · Agentic AI expert for financial institutions
More than 20 years in investment banking and derivatives trading, followed by over 10 years advising financial institutions. Certified as Claude Partner – Claude Code (Anthropic), as well as in Google AI, Generative AI Leader (Google Cloud) and IBM RAG and Agentic AI.
LinkedIn profile → · agenticbanker.ai →Keep reading – every 14 days in your inbox.
Capital-markets insights, regulatory updates and AI trends. Concise, well-founded, free.
GDPR-compliant. Unsubscribe at any time.