The Pulse
U.S. Regulators Ask Banks How They Would Shut Down AI Agents
The Federal Reserve, OCC and FDIC are asking banks about the controls on autonomous AI agents, including whether staff can track their decisions and stop them. European supervisors are pressing lenders to prepare for AI-enabled cyberattacks
AI.info Team · Written with AI ·
On October 13, U.S. bank regulators were asking lenders a question with an operational edge: if an AI agent acts beyond its authority, can the bank stop it? The Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation are asking about banks’ use of advanced AI, including systems that can identify and respond to cybersecurity threats. The inquiries put pressure on banks eager to deploy agents that perform tasks with limited human supervision.
Fed, OCC and FDIC probe who can stop an agent
Questions described by people familiar with the inquiries cover the limits placed on AI systems, how their actions are monitored and approved, and whether banks can track and audit agents’ decisions. Regulators are also asking what prevents an agent from exceeding its authority, whether a person remains involved in key decisions and how a bank can shut down an autonomous system. The questions also reach into banks’ use of Chinese-developed technology and AI agents in cyber defense.
The agencies are sending written questions and raising them in conversations with large, midsize and smaller banks, according to Reuters. The inquiries focus on how lenders use agents to identify, prioritize and respond to security threats, as well as how prepared they are to act if a system or its environment is compromised. The Fed, OCC and FDIC declined to comment.
Banks’ appetite for agents meets a control problem
Agentic AI can carry out sequences of tasks with less direct human supervision than conventional AI tools, giving it a more active role in bank operations. That makes the questions about approvals, audit trails and shutdown authority more than an exercise in model governance: they concern who can intervene when software is taking action. Regulators are testing whether banks can explain not just what a system is meant to do, but how they would regain control of it.
“The adoption of AI is often outpacing the ability to put the controls in place,” said Michael Woodbridge, a London-based cybersecurity partner at Grant Thornton. The regulators’ inquiries, however, do not yet amount to a new U.S. rule for AI agents. People familiar with the discussions said supervisors are still collecting information rather than prescribing how lenders must deploy the systems.
European supervisors focus on recovery after an attack
In Europe, regulators are pressing banks to plan for disruption as well as prevention. The Bank of England is encouraging the largest lenders to examine “bare metal” recovery plans: systems kept independent of a bank’s main technology setup that could be used if its primary systems are compromised. Those plans can be expensive to build and maintain, and UK authorities intend to work with the industry rather than introduce new requirements, Reuters reported.
The European Central Bank has taken a more scheduled approach, setting an end-of-October deadline for lenders to produce plans addressing AI-enabled cyber threats, including backup and recovery. Supervisors are also asking euro zone banks to map how AI is used across their operations and third-party providers, and to show they can switch systems off and restart them in a controlled way. People familiar with the matter said significant gaps remain at some firms.
The October deadline puts preparedness on the clock
The contrast is clear: U.S. supervisors are gathering evidence about how banks manage autonomous systems, while European oversight also includes a specified deadline for cyber-response plans. Both approaches confront the same tension—banks are adopting AI for security work even as the systems’ growing autonomy makes oversight and recovery harder to demonstrate. For euro zone lenders, the immediate test is whether they can deliver their plans by the end of October and account for how AI is used, controlled and restarted.