The OCC wrote a 16-part AI checklist for bank examiners and says it isn't a rule
The Comptroller's office told examiners how to judge AI agents at national banks on November 4. Banks aren't required to follow it, and it says the document itself was drafted with AI help.
On November 4 the Office of the Comptroller of the Currency, the regulator that supervises national banks, put out a framework for its examiners on how to look at a bank’s use of AI. The OCC calls the technology “Super Intelligence” throughout, a label the document traces to Executive Order 14434, which the Federal Register carried on October 2. Strip the branding and the question is practical: when a bank lets an AI agent move money or talk to customers, what should an examiner ask about?
Lots of questions, zero requirements.
It’s a guide for examiners, not for banks
OCC Bulletin 2026-54, which came with it, is blunt about this. It says the framework “does not establish supervisory expectations for banks” and that banks “are not expected to use this document to assess their use” of AI. It also says nothing in it creates new regulatory expectations or enforceable standards. The law firm Legal500 describes it the same way in its summary: an examiner resource, not a rulebook.
So nobody can be cited for failing it. What it does is shape the questions examiners walk in with, and that tends to shape what banks prepare for.
What it actually asks
There are 16 components in six pillars, over roughly 20 pages. They cover governance, privacy, vendors, security, testing and paperwork. The two ideas that carry the most weight are these.
First, no separate category. The OCC says examiners should not treat AI as “a separate and distinct risk category,” and banks aren’t required to define a separate AI risk appetite. AI risk is supposed to show up inside the operational, compliance and credit risk banks already track.
Second, consequences over sophistication. The document says a simple rules-based agent that can initiate transactions could be riskier than a sophisticated model that only drafts internal memos. Control intensity, in its words, “could increase with the potential consequences of an SI agent’s failure or misuse.”
| Topic | What the framework says |
|---|---|
| Separate AI risk category | Examiners shouldn’t treat it as one |
| Separate AI risk appetite | Banks not required to define one |
| Riskier use cases | May warrant tighter limits on autonomy and more human oversight |
| Vendors | Accountability generally stays with the bank |
| Binding force | None, per Bulletin 2026-54 |
The agent section reads like an incident plan
Resilience is where it gets concrete. The section describes an agent that “could remain available while taking inappropriate or harmful actions,” and lists containment tools such as circuit breakers and rate limits, plus least-privilege permissions and kill switches. The text also suggests banks define their own AI incident vocabulary, covering hallucination, misfire, drift and manipulation, with notification timelines.
On vendors, the text says a bank that buys AI from a third party still owns the risk, and suggests contracts spell out who pays for model errors and customer harm. It also flags “external SI agents”, meaning customer or fintech agents that act through bank channels, as a risk where identity and delegation checks should match the action requested.
My read: that last point is the one banks will feel first. Consumer assistants that connect to bank accounts are already shipping, like the read-only banking beta Anthropic launched this week, and an examiner reading this document now has language for asking a bank how it would tell a legitimate agent from a bad one.
The footnote I liked
Footnote 3 says the framework “was prepared with the assistance of SI” and that “the content has been reviewed, edited, and approved by a human.” My read: a disclosure beats a guess, though it tells you nothing about which tool was used or how much of the text it wrote.
What’s still open
Don’t expect this version to last. The OCC calls it a living document and plans to update it. Another part is an illustrative risk-tiering section, with tier definitions, that the OCC labels as examples. Whether any bank adopts those tiers as written is unknown, and the sources I read say nothing about how the FDIC or the Federal Reserve will respond. The rename itself came up in the White House’s AI accord in September (which, per Time News, never mentions the rename), and this framework is an agency applying it.
Note on sources: every quote above comes from the OCC bulletin and the framework PDF, which I read directly. The PDF text I had access to was partly abridged, so I could not read the risk-tier definitions in full and have not described them beyond their existence. Legal500 is a law-firm summary, used only to confirm the bulletin’s framing.