US bank regulator issues its first framework for checking AI in banks

What came out. On November 4 the Office of the Comptroller of the Currency (OCC) issued Bulletin 2026-54 and the framework itself, on how banks use AI. The OCC supervises national banks, federal savings associations and US branches of foreign banks. The bulletin is signed by Senior Deputy Comptroller James Gallagher.

Why "super intelligence". The document uses the term Super Intelligence (SI). A footnote explains that it covers what used to be called artificial intelligence, citing presidential order 14434. It means ordinary AI and autonomous agents, not a hypothetical mind smarter than people.

The main idea. Risk is judged by consequences, not technical sophistication. Use cases can be ranked by what happens if they fail, how much agency is handed to the machine and how much human oversight remains. The more serious the possible harm from an agent's mistake, the tighter the controls. AI is not a separate risk category, and banks do not need a separate AI risk appetite.

What Decrypt found. In its reading of the 22-page document, a simple agent allowed to make payments can be riskier than an advanced model that writes internal documents. There are four illustrative risk tiers: fully autonomous payment agents and real-time credit decisions at the top, office productivity tools at the bottom. Suggested safeguards include identity checks, limited permissions, transaction limits, monitoring and the ability to shut an agent off. The document also covers outside agents run by customers and fintechs.

Context. Less than two weeks earlier Axios reported that big US banks were finding third-party AI agents inside customer accounts, sometimes doing more than asked. The OCC does not link the framework to those cases.

What it does not change. The OCC stresses that the document sets no new requirements or enforceable standards, and banks should not use it to assess themselves. The regulator plans to update it as the technology changes.

Confirmed facts

• On November 4, 2026, the OCC issued Bulletin 2026-54 with a supervisory framework on banks' use of AI (called Super Intelligence in the document).^[1][2]
• The framework is for examiners and sets no new requirements, enforceable standards or expectations for banks.^[2]
• Examiners are told not to treat AI as a separate risk category, and banks do not need a separate AI risk appetite.^[1][2]
• AI use cases can be classified by potential consequences, transfer of agency and human oversight rather than technical sophistication.^[2]
• The term Super Intelligence replaces "artificial intelligence" under presidential order 14434.^[2][4]
• According to Decrypt, the 22-page document has four illustrative risk tiers, with autonomous payment agents in the highest.^[3]
• Decrypt reports that the framework separately covers risks from outside AI agents run by customers, fintechs and other firms.^[3]

Implications

• ConfirmedFor US banks this is a guide to how they will be examined, not a new law: there are no binding requirements.
• Our readingBanks may limit third-party AI agents' access to customer accounts more often or set limits for them.
• Our readingFirms that build AI agents for finance may face stricter checks from partner banks.

Still unknown

• How fast examiners start using the framework
• How banks will change access for third-party AI agents
• Whether the Fed and FDIC follow a similar approach

Who it affects

United States. US bank customers, people using AI assistants for money, fintech firms and AI agent developers

Sources

1. OCC: OCC Issues Supervisory Framework on Bank Use of Super Intelligence November 4, 2026 · official
2. OCC: Super Intelligence: Supervisory Framework (Bulletin 2026-54) November 4, 2026 · official
3. Decrypt: US Bank Regulator Issues First AI Framework as Banks Battle Rogue Agents November 4, 2026 · media
4. PYMNTS: OCC Releases Supervisory Framework for Bank AI Use November 4, 2026 · media