Banking and Finance Law Daily Wrap Up, PRUDENTIAL REGULATION—OCC issues consequence-based examiner framework for banks’ artificial intelligence use, (Nov 4, 2026)
The OCC released its first framework for the agency’s bank examination workforce on banks’ use of Super Intelligence (SI), and stated that banks need not define a separate SI risk appetite.
The Office of the Comptroller of the Currency (OCC) has issued an examiner framework for banks’ use of Super Intelligence (SI), commonly referred to as Artificial Intelligence, in normal-course business activities. The framework is intended to provide OCC bank examiners with a supervisory framework to evaluate banks’ use of SI and agentic SI in normal course business activities and banks’ associated risks and controls. OCC Bulletin 2026-54 describes it as an examiner resource, not new bank supervisory expectations, enforceable standards, or prescriptive requirements. Examiners should not treat SI as a separate risk category, and banks need not define a separate SI risk appetite.
The bulletin covers national banks, federal savings associations, and federal branches and agencies of foreign banking organizations. The OCC instructed examiners to tailor reviews to use-case materiality. Community-bank examinations should reflect size, complexity, and risk profile and be proportionate to the nature, consequences, autonomy, and complexity of SI uses.
Banks are not expected to use the guide to assess their SI use or risk management. Examiners may use its considerations to supplement existing model risk management, governance, technology, compliance, and operational-risk practices.
The documents’ definition of SI covers technologies and systems previously encompassed by Artificial Intelligence under 15 USC 9401(3), together with their promise, potential, and rapidly advancing capabilities. They cite Exec. Order No. 14434, 91 Fed. Reg. 63129 (Oct. 2, 2026).
Consequences and controls. The framework says model risk management principles in OCC Bulletin 2026-13 apply to non-generative and non-agentic SI models, making this framework more applicable to generative and agentic SI.
Higher-consequence uses may warrant less autonomy, stronger controls, more direct human oversight, more independent validation, and more robust resilience. An illustrative tier comparison places a simple internal productivity tool with no customer or financial data exposure at Tier 4, but a fully autonomous customer-facing payment agent at Tier 1, regardless of how well it performs in testing.
Consumer-facing SI could create compliance risk when outputs are materially inaccurate, misleading, or inconsistent with product terms. The framework says hallucinations about fees, rates, account status, or policies could create legal or customer-harm exposure. Banks may consider limits on automated representations, verification in higher-impact contexts, and prompt correction and remediation.
Resilience covers incorrect operation as well as service loss: an agentic system may remain available while taking harmful actions. For more consequential or autonomous uses, banks may document and test detection, containment, suspension, continuity, recovery, escalation, and remediation arrangements covering internal systems, fallback processes, and external agents interacting through bank channels.
The OCC continues to expect bank activities to be conducted safely and soundly and consistently with applicable laws and regulations, regardless of technology.
The agency intends to update the framework regularly as technology, use cases, and supervisory understanding evolve, and in response to stakeholder feedback.
MainStory: TopStory AINews BankingOperations FinTech GCNNews