Banking Regulators Intensify AI Scrutiny as Financial Stability Fears Mount

Banking Regulators Launch Intensive AI Risk Assessment

Banking regulators are escalating their oversight of AI risks in the financial sector, driven by mounting concerns that advanced AI models could threaten financial stability1

1

. The Federal Reserve, Office of the Comptroller of the Currency, and Federal Deposit Insurance Corporation are now questioning banks about their deployment of advanced AI models, marking a significant expansion of regulatory scrutiny2

2

. These inquiries probe whether financial institutions use Chinese-developed AI, deploy autonomous AI agents in cyber defense, and maintain adequate control over increasingly independent systems1

1

.

The regulatory push reflects growing recognition that frontier AI advances may demand costly investments in cyber recovery and greater attention to dependencies on external technology providers3

3

. Six people familiar with the matter indicate that some regulators point specifically to the potential for AI-driven cyberattacks on banks or rogue AI agents undermining global financial markets1

1

.

European Supervisors Accelerate Recovery Planning Requirements

The Bank of England and European Central Bank are pressing banks to strengthen recovery plans, concerned that rapid AI advances could cause serious harm to financial markets sooner than previously anticipated4

4

. A senior executive at a large European bank expressed worry about potentially major damage to banking and financial markets within six months1

1

.

UK supervisors are encouraging the largest banks to examine bare metal recovery plans—systems entirely independent from a bank's main technology infrastructure that can activate if primary operating systems are compromised1

1

. Building and maintaining such state-of-the-art recovery systems is expensive, though UK authorities intend to work collaboratively with industry rather than introduce new requirements4

4

.

The European Central Bank gave lenders an end-October deadline to produce plans countering AI-enabled cyber threats, including improved backup and recovery capabilities1

1

.

Focus on Agentic AI and Autonomous System Controls

US regulatory inquiries center on how banks use agentic AI in areas such as cybersecurity, specifically whether AI agents identify, prioritize, and respond to threats2

2

. Questions from regulators focus on system limits, monitoring procedures, approval requirements, and whether banks can clearly track and audit AI agent decisions1

1

.

Regulators are asking what AI safeguards exist to prevent agents from exceeding their authority, whether humans remain involved in key decisions, and how banks can shut down autonomous systems4

4

. The written and verbal inquiries to large, mid-size, and smaller banks demonstrate that regulators are focusing on vulnerabilities from banks' use of AI and their preparedness to act1

1

.

Banks are competing to adopt agentic AI, which can accomplish tasks with minimal human supervision, while grappling with challenges of new models including IT weaknesses flagged by Anthropic's Mythos tool4

4

. Michael Woodbridge, London-based cybersecurity partner at Grant Thornton, noted that "the adoption of AI is often outpacing the ability to put the controls in place"1

1

.

Recent Cyber Incidents Drive Regulatory Urgency

The debate over AI oversight has intensified following recent security incidents and industry warnings. JPMorgan CEO Jamie Dimon urged corporate leaders to join a US-focused industry group addressing AI risks1

1

. CrowdStrike reported this month that a person in China likely used a Chinese-developed AI agent and Anthropic's Claude Code in a hack targeting South Korean banks2

2

. Shinhan Bank reported compromised data involving about 25,000 customers, while KB Kookmin Bank reported a leak affecting 119 customers2

2

.

Rogue AI agents developed by OpenAI were involved in a breach of AI platform Hugging Face1

1

. Anthropic researchers have warned that increasingly powerful AI systems could eventually escape human control and pose an existential threat, prompting calls for stricter regulation4

4

. The International Monetary Fund warned against complacency in global financial markets, noting that a major cyberattack affecting a critical service or financial institution could undermine confidence4

4

.

Regulators are still gathering information and are not yet being prescriptive about what lenders should be doing1

1

. However, the scrutiny signals that financial institutions may need to connect each AI application to an accountable owner, documented purpose, risk classification, vendor relationship, and set of controls, with evidence showing those controls work3

3

.