OCC Issues Supervisory Framework for Banks' Use of Super Intelligence

Key Takeaways

• New Supervisory Framework: The OCC issued guidance on November 4 to help bank examiners evaluate the use of super intelligence and agentic systems in ordinary banking activities.
• No Separate Risk Category: Examiners should not treat super intelligence as a distinct risk category, and banks are not required to establish a separate SI risk appetite.
• Risk-Based Examinations: Supervisory assessments may consider the consequences of an SI application's failure or misuse, the authority delegated to it, and the degree of human oversight rather than technical sophistication alone.
• No New Regulatory Requirements: The framework is intended for OCC examiners and does not establish enforceable standards, prescriptive requirements, or new supervisory expectations for banks.
• Future Revisions Planned: The OCC intends to update the framework as the technology, banking applications, and supervisory understanding develop.

Deep Dive

The Office of the Comptroller of the Currency has instructed bank examiners not to treat super intelligence as a separate category of risk, drawing a boundary around how the emerging technology should be supervised as financial institutions expand its use. The framework directs examiners to consider what an intelligent system is authorized to do, the consequences if it fails, and how much human oversight remains in place. The sophistication of the technology itself need not determine its risk classification.

The OCC is also declining to impose new requirements on banks. Its guidance is intended for examiners, and institutions will not be required to establish a separate risk appetite for super intelligence or use the framework to evaluate their own risk management programs.

For banks adopting increasingly autonomous systems, the approach offers an indication of how the regulator intends to examine their use. Existing supervisory practices will remain the foundation, with examiners expected to adjust their scrutiny according to the risks of individual applications rather than the novelty of the technology.

The OCC uses the term super intelligence, or SI, broadly. Its definition encompasses technologies and systems previously covered by the term artificial intelligence, along with their rapidly advancing capabilities and potential. The framework also addresses agentic systems, which can exercise varying degrees of autonomy in carrying out activities.

That breadth makes the agency's decision to avoid a separate risk category particularly consequential. The framework does not establish a new supervisory structure for SI. Instead, it allows examiners to identify considerations specific to the technology within existing practices for model risk management, governance, technology, compliance, and operational risk.

The Consequences of Giving Systems Greater Authority

The framework places considerable weight on the transfer of agency, the extent to which an intelligent system is entrusted with authority to act. Examiners have been instructed to tailor their assessments to the materiality of individual use cases. In determining how a bank classifies the associated risks, they may consider the consequences of a system's actions, the authority transferred to it, and the degree of human oversight involved. The OCC also recognizes that the intensity of a bank's controls could increase with the potential consequences of an SI agent's failure or misuse.

These considerations allow examiners to distinguish between applications according to their actual functions and possible effects. Technical sophistication alone is not necessarily a reliable measure of the risk an application presents. The authority exercised by a system, and what could happen when that authority is used improperly or a system fails, may be more relevant.

The framework does not prescribe particular controls for different levels of autonomy. Nor does it establish a mandatory classification system for SI applications. Those judgments remain part of the examination process, informed by the circumstances of each use case.

Community banks are expressly included, although the OCC has instructed examiners to account for differences in institutional size, complexity, and risk profile. The nature and consequences of an SI application, together with its autonomy and complexity, should inform the scope of supervisory work.

The instructions reflect the OCC's decision to preserve flexibility in examinations rather than apply uniform treatment to every institution using the technology.

Existing Banking Obligations Remain Unchanged

The OCC has been explicit about the limits of its new guidance. In Bulletin 2026-54, the agency states that the framework does not establish supervisory expectations for banks. It is a resource for examiners and does not create enforceable standards, prescriptive requirements, or additional regulatory obligations. Banks are not expected to use the document to assess either their SI activities or their management of the associated risks.

The distinction leaves existing obligations intact. Financial institutions must continue conducting their activities safely and soundly and in accordance with applicable laws and regulations, whether those activities involve established banking systems or newer technologies.

In its November 4 announcement, the OCC described the issuance as an important milestone for the financial industry as banks continue adopting SI and agentic technologies. The agency pointed to the banking industry's history of using new technologies to improve operational efficiency and develop services for customers.

Its stated policy is to encourage innovation while maintaining safety and soundness through a technology-neutral approach. The framework was issued under the name of James M. Gallagher, the OCC's senior deputy comptroller and chief national bank examiner.

The agency intends to revise the guidance regularly as the technology develops, banks introduce new applications, and examiners gain experience assessing them. Stakeholder feedback will also inform future versions.

Those revisions may prove important as banks give intelligent systems greater responsibility for activities previously performed or supervised by employees. For now, the OCC has left examiners to determine how existing supervisory principles apply to those activities, with the consequences of an agent's failure or misuse among the considerations that may warrant closer scrutiny.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey