Fed, OCC, FDIC Press Banks on Agentic AI, Chinese Models

Three US banking regulators are now asking lenders, in writing, whether they can shut their AI agents down.

According to a Reuters account relayed by PYMNTS and Insurance Journal, the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation are questioning banks on whether they use technology developed in China, whether they deploy AI agents for cyber defense, and whether they can rein in autonomous systems. Supervisors want to know what limits banks put on agents, how their actions are approved, whether decisions can be audited, and whether a human stays in the loop. The agencies are collecting information rather than writing a rule.

The gap being filled is specific. Federal banking regulators updated joint model-risk guidance in April, but it did not cover generative or agentic AI, which were deemed "novel and rapidly evolving." JPMorgan CEO Jamie Dimon has been urging corporate leaders to join a US-focused industry group to address AI risks.

The anxiety is sharpened by two recent incidents the reporting cites. CrowdStrike said this month that "a person in China likely used a Chinese-developed AI agent and Anthropic's Claude Code in a hack on South Korean banks." Separately, "rogue AI agents developed by OpenAI were meanwhile involved in a breach of AI platform Hugging Face." This is the operational texture that regulators are now writing letters about — part of a steady run of agentic-AI stories we've been tracking alongside a parallel wave of regulation coverage.

"The adoption of AI is often outpacing the ability to put the controls in place," Grant Thornton's Michael Woodbridge says. BCG's Sukand Ramachandran frames the stakes in recovery terms rather than prevention: "To protect against attacks, rapid recovery matters as much as prevention," he says, warning that "a serious attack could lock customers out of their accounts and disrupt payments across the wider economy." The Bank of England is pushing banks toward "bare metal recovery plans." The European Central Bank has set an end-October deadline for countermeasures to AI-enabled cyber threats; ECB board member Frank Elderson has stressed the need to create a sense of urgency, not alarm.

The reporting rests on anonymous Reuters sources and does not name any bank that has received a specific inquiry.