OCC Sees Strong Banks but Growing Pressure From Cyber Threats, CRE Risk, & AI Complexity

Key Takeaways

• OCC Warns of Emerging Pressure Points: The OCC said the federal banking system remains financially strong overall, but regulators are closely monitoring growing risks tied to commercial real estate refinancing, private credit markets, cyber threats, fraud, and geopolitical instability.
• Commercial Real Estate Risks Persist: Large volumes of CRE loans originated during the low-interest-rate era are approaching maturity, creating refinancing pressure in office, warehouse, hotel, and other vulnerable property segments.
• Cyber Threats and Fraud Are Escalating: The OCC warned that cybercriminal groups and foreign state-sponsored actors are becoming increasingly sophisticated, while fraud and scams continue growing in both scale and complexity.
• AI Is Reshaping Banking Risk Management: Regulators highlighted the growing use of generative and agentic AI across banking operations and cybersecurity functions, while cautioning that governance, explainability, validation, and data privacy challenges remain significant.
• Geopolitical Tensions Are Increasing Compliance Risk: The report warned that sanctions exposure and anti-money laundering risks are rising amid global instability, placing additional strain on bank compliance systems and increasing the risk of BSA/AML violations.

Deep Dive

The U.S. banking system entered 2026 on solid footing, with stronger earnings, healthy liquidity, and manageable credit exposure helping stabilize the industry after years of economic uncertainty. But beneath those reassuring numbers, federal regulators are increasingly focused on a more complicated reality taking shape across commercial real estate markets, cyber defense systems, fraud networks, and the rapidly evolving world of artificial intelligence.

That balancing act sits at the very heart of the Office of the Comptroller of the Currency’s Spring 2026 Semiannual Risk Perspective, released Thursday, which outlines the agency’s latest assessment of the risks facing federally supervised banks.

The report paints a picture of an industry that remains resilient overall, even as geopolitical instability, persistent inflation concerns, sophisticated cyberattacks, and emerging AI-related risks create new layers of operational and compliance pressure.

Bank earnings improved throughout 2025, fueled by stronger loan growth and lower funding costs, according to the OCC. Capital ratios and liquidity levels also remained high by historical standards, while first-quarter 2026 earnings reports suggest those trends have largely continued into the new year.

The broader U.S. economy, while slowing in some areas, also continued to provide support. The OCC said economic growth in 2025 remained moderate but resilient, driven in part by consumer spending and investment tied to artificial intelligence and productivity-enhancing technologies.

Still, regulators made clear that the environment facing banks is becoming more fragile and more interconnected.

Commercial real estate remains one of the clearest examples.

The OCC warned that refinancing risk in several commercial real estate segments warrants continued monitoring as large volumes of loans originated during the low-interest-rate years approach maturity. Higher prevailing interest rates could place pressure on borrowers seeking to refinance debt over the next several years.

Office properties continue to face headwinds, though the report noted signs of stabilization during the second half of 2025 as net absorption turned positive. Even so, some larger banks continued taking additional charge-offs tied to office exposures. Warehouse properties are also expected to face elevated vacancy rates in the near term, while hotel performance has weakened amid lower room demand. Retail real estate, by contrast, was described as comparatively resilient, with vacancy rates remaining low in many markets.

The agency also signaled growing attention toward the private credit market, an area regulators globally have increasingly scrutinized as nonbank lending continues expanding.

According to the OCC, some portions of the private credit market are showing signs of weakening credit quality. The report cautioned that restructuring practices and paid-in-kind financing mechanisms could obscure underlying deterioration in loan portfolios held by private credit funds. At the same time, growing concentrations in lending tied to those funds are making borrower monitoring and refinancing oversight increasingly important for banks.

Consumer credit stress is also beginning to emerge more visibly, though regulators emphasized the situation remains manageable.

The OCC said past-due consumer loans have increased modestly, particularly among borrowers with weaker credit profiles. However, federally supervised banks continue to maintain manageable exposure levels to higher-risk borrowers overall.

While credit conditions drew significant attention in the report, cybersecurity and fraud risks occupied an equally prominent role.

The OCC warned that cybercriminal organizations targeting financial institutions are becoming increasingly sophisticated, while foreign state-sponsored actors continue to pose a persistent threat to the banking sector. Heightened geopolitical tensions, particularly those tied to the conflict in the Middle East, could further increase the likelihood of malicious cyber activity aimed at financial institutions and critical service providers.

At the same time, artificial intelligence is changing both sides of the cybersecurity equation.

The regulator said AI technologies are making cyberattacks faster, cheaper, and more sophisticated by enabling automated reconnaissance, adaptive malware, targeted social engineering campaigns, and AI-enabled fraud schemes. Yet many of those same technologies are also emerging as tools banks can use to strengthen threat detection, monitoring, and cyber risk management capabilities.

That tension, AI as both opportunity and risk, runs throughout the OCC’s broader outlook.

The report said banks across the industry are increasingly exploring generative AI and agentic AI technologies, though adoption remains measured and largely confined to specific use cases with governance controls and human oversight. To date, the OCC said many deployments remain focused on productivity improvements and customer experience enhancements.

But regulators also acknowledged that newer forms of AI introduce governance and risk management challenges that the industry is still learning to address.

Among the concerns highlighted in the report were explainability limitations, data privacy issues, data poisoning risks, cybersecurity vulnerabilities, and evolving validation challenges tied to generative and agentic AI systems.

The OCC indicated that additional regulatory attention around AI is likely forthcoming. The agency said federal banking regulators are preparing a request for information focused on model risk management and banks’ use of artificial intelligence technologies, including generative and agentic AI.

Compliance pressures are also intensifying as geopolitical tensions reshape financial crime and sanctions risk.

The OCC warned that rising geopolitical instability is increasing sanctions and anti-money laundering exposure, placing additional strain on bank compliance systems and elevating the potential for Bank Secrecy Act and anti-money laundering violations. The report specifically referenced FinCEN concerns regarding Chinese money laundering networks operating through the U.S. financial system.

At the same time, regulators said they are continuing efforts to tailor supervision and reduce unnecessary compliance burden, particularly for community banks. The OCC pointed to recent actions aimed at refining BSA/AML examination procedures and reducing data collection requirements for smaller institutions.

Despite the growing list of risks, the OCC’s overall assessment stops well short of sounding alarmist.

Bank profitability improved materially in 2025, with return on equity reaching 12.2 percent across the federal banking system and 11 percent among community banks. Liquidity levels also remain historically strong, with liquid assets representing 31 percent of total assets at the end of 2025, which is roughly double levels seen during the 2008 financial crisis.

The risks facing banks are no longer confined to interest rates or credit quality alone. Increasingly, they sit at the intersection of geopolitics, cyber warfare, fraud ecosystems, regulatory expectations, and rapidly evolving technologies that are reshaping how financial institutions operate and how they are attacked.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.