On November 4, 2026, the US Office of the Comptroller of the Currency (OCC) issued its first bank artificial intelligence examination framework, the OCC Supervisory Framework on Bank Use of Super Intelligence, under Bulletin 2026-54. The document is written for examiners, not a new rule addressed directly to banks: it sets no enforceable standards and does not require banks to adopt a separate AI risk appetite. Its test is clear — judge a system by the consequences when it goes wrong, not by how advanced the model itself is.
What Examiners Will Look At: Not How Advanced the Model Is, but What Failure Costs
The OCC asks examiners to treat Super Intelligence as a supplement to existing examination work, not as a separate risk category. In the document, "Super Intelligence" is the executive branch's uniform term, covering conventional artificial intelligence and autonomous agents — not only hypothetical systems beyond human capability. Examinations still draw on banks' existing model risk management, governance, technology, compliance and operational-risk practices, and then add one layer of questions for each specific use: if it fails, who bears the loss, can the action be reversed, and at which point can a person still stop it?
An example makes the standard clear: a simple agent authorized to initiate transactions directly may pose more risk than a technically complex model that only drafts internal documents. Systems that make real-time credit decisions or complete payments on their own sit at the higher end, while tools used only for internal efficiency sit at the lower end. Examination depth is adjusted according to a bank's size and business complexity.
What Banks Should Prepare First
For national banks and federal savings associations supervised by the OCC, the first task is to inventory agents that can "move money" on their own: which transactions they can initiate, where their permission boundaries are written down, who reviews actions beyond authorization, and whether transaction limits and monitoring are in place. Illustrative safeguards listed in the framework include identity verification, delegated permissions, transaction limits and continuous monitoring, plus the ability to suspend or revoke access when something goes wrong; for systems that keep making harmful decisions while running, it also mentions circuit breakers, rate limits and emergency shutdown. These are control points examiners may ask about, not new hard obligations in the document itself — banks must still implement them through existing law and safe-and-sound requirements.
External agents are another priority. Even if an agent is operated by a customer, a fintech or another business and is not directly controlled by the bank, it can create risk as soon as it reaches an account through a bank channel. Banks need to distinguish normal customer-authorized access from actions beyond authorization and keep traceable records; otherwise it is hard to tell whether an unusual transaction reflects the customer's intent or an agent overstepping.
This Document Is Not a New Law: Where Its Limits Lie
Its legal status must be kept clear: it creates no new regulatory requirements, and banks cannot use it as a self-assessment compliance checklist. Reuters noted that although the document is not legally binding, banks usually take such examination guidance very seriously, and changes in examination practice alone can have real effects. Its scope is limited to the US banking system supervised by the OCC; it cannot be applied directly to other countries and is not a global bank AI rule. Existing legal obligations still apply — the framework only tells examiners what extra questions to ask within the existing framework. What matters next is how the question list is used in actual examinations and whether the OCC updates the document as technology changes.
