Fed, OCC and FDIC Ask Banks How They Would Shut Down AI Agents

If your bank runs AI agents, your supervisor now wants to know what each one may do, who approved it, how you would trace its decisions and how you would switch it off. The agencies' own model risk guidance gives you no framework to answer from. The Federal Reserve, the OCC and the FDIC are putting those questions to large, mid-size and smaller US banks, in writing and in conversation, according to a Reuters exclusive published October 13 that cites six people familiar with the matter. Six months earlier, the same three agencies wrote generative and agentic AI out of their revised model risk guidance. The gap between those two facts is where your next exam conversation will happen.

The supervisors are still gathering information and are not yet prescriptive, Reuters reports, and all three agencies declined to comment. That makes this the cheapest moment you will get to build the answers.

What Exactly Are US Bank Supervisors Asking?

Supervisors are asking seven things, and five of them are about control of autonomous systems. Per the Reuters report, the questions cover:

1. Whether the bank uses Chinese-developed technology.
2. Whether it uses AI agents in cyber defense, including to identify, prioritize and respond to threats.
3. What limits apply to its systems, and how their actions are monitored and approved.
4. Whether it can track and audit the decisions its AI agents make.
5. What safeguards stop an agent from exceeding its authority.
6. Whether humans stay involved in key decisions.
7. How it would shut down autonomous systems.

Read the list as an exam script. Questions three through seven map onto evidence a CRO can produce or cannot: an authority matrix per agent, an approval record, a decision log, a permission boundary that is enforced in code, a named human checkpoint and a tested shutdown path. You either have each of those in a folder or you write it while the examiner waits.

The inquiries reached banks of every size, which matters for a community bank that assumed agentic AI scrutiny was a problem for the largest institutions. If you bought a fraud, collections or service platform that now ships agents, the question is already yours.

---

Why Does SR 26-2 Leave Banks Without an Answer?

SR 26-2 is the April 2026 interagency rewrite of model risk guidance, and it explicitly excludes the systems these questions are about. The Fed issued SR 26-2 on April 17, 2026, superseding SR 11-7, the 2011 guidance that model risk teams have been built around for 15 years. The OCC's companion Bulletin 2026-13 is blunt about scope: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."

The same bulletin says the agencies plan to issue, "in the near future," a request for information on model risk management with particular attention to banks' use of AI. A law firm summary from Goodwin in May read that as a signal that formal guidance is coming. Six months after April, the Reuters report describes supervisors still collecting answers bank by bank, which is how examiners build a baseline before an RFI turns into expectations.

Two details make the carve-out more awkward than it looks:

• The Fed says SR 26-2 is "expected to be most relevant to banking organizations with over $30 billion in total assets," while the OCC version is "applicable to all community banks, subject to the limitations discussed in the guidance." Smaller banks got lighter model risk guidance and the same agent questions.
• An analysis by CIMCON notes that SR 26-2 creates no new enforceable requirements and that banks are expected to cover what it leaves out with their own risk management and governance practices. Agents fall outside this letter and still inside your governance program.

The OCC's own messaging pulls in two directions. Its Spring 2026 Semiannual Risk Perspective, released May 7, says banks using AI tools for cyber operations and vulnerability monitoring are better positioned against AI-enabled attacks. Goodwin's summary adds that the report says banks "may consider expanding their use of [generative AI] and agentic AI for material financial decisions," under guardrails and human oversight. The supervisor is encouraging agents and asking how you control them in the same year. If you expand agent use on the strength of the first message, expect to be asked for evidence on the second.

What Is Driving the Questions Now?

The backdrop Reuters gives is AI-enabled cyberattacks on banks, and one has just happened. CrowdStrike said this month that a campaign against South Korean financial institutions, which ran from late September into early October, likely involved a China-based suspect using ARTEX, an open-source penetration testing tool developed in China, together with Anthropic's Claude Code, iTnews reported on October 8. At least nine South Korean banks have disclosed or been reported as targeted. CrowdStrike made its attribution with "moderate confidence," and ARTEX can connect to Claude, ChatGPT and DeepSeek.

Read against that case, the US list has a clear shape. Question two (do you use agents in cyber defense?) is about whether you can keep pace. Question one (do you run Chinese-developed technology?) is about provenance. Questions three through seven are about whether your own agents could be turned, misdirected or simply fail in a way you cannot stop.

Europe moved first and harder. The ECB's top supervisor, Claudia Buch, sent every directly supervised bank a letter in July asking for a plan against AI-enabled cyberattacks by October 31, American Banker reported. Each plan has to name concrete steps, the person accountable for each, the money and staff behind it and the deadlines. The ECB pushed its annual IT risk questionnaire from September to February 2027 to make room. Reuters adds that euro zone banks are being asked to map AI use across their businesses and third-party providers and to show they can switch systems off and restart them in a controlled way, and that significant gaps remain at some firms. In the UK, per the same report, the Bank of England is encouraging its largest banks to examine "bare metal" recovery: systems fully independent of the bank's main technology that can take over if the primary estate is compromised.

The US agencies are asking the shutdown question without yet requiring a plan. The ECB has already shown what the written version looks like.

---

Where Do Banks' Answers Usually Break?

The answers break on third-party agents, on decision logs and on the shutdown path, roughly in that order.

Third-Party Agents

An agent inventory is a register of every system that can take an action on the bank's behalf without a human executing each step, including the ones a vendor switched on inside a product you already license. Most banks can list the agents their own engineers built. Few can list the ones that arrived in a CRM, contact centre or fraud platform release. The interagency third-party risk management guidance from June 2023 already covers those relationships across their full life cycle, from planning to ending the relationship, so expect a supervisor to treat a vendor-built agent as yours to inventory. Singapore made the same move explicit last week, and our read of MAS's final AI guidelines shows what an inventory requirement that reaches into SaaS looks like in writing.

Decision Logs

"Track and audit AI agent decisions" asks for more than an access log. A platform log records that a tool was called, and an examiner will want to reconstruct why: the input, the instructions in force, the model version, the action taken and who approved it. Our agent audit logging buyer's guide walks through the event set that answers that, and why most vendor logs miss it.

Human Involvement

Saying a human approves each action is easy. Showing that the approval involves an actual review is harder, and the evidence on approval gates is unflattering: most of them rubber-stamp.

Shutdown

"How would you shut it down?" has a policy answer and a tested answer, and a follow-up question from the examiner will tell them which one you gave. When OpenAI's own automatic shutdown failed for 2.5 hours after a DNS escape, the lesson was that a kill switch inside the agent's own runtime is the one most likely to fail when you need it. A credible answer revokes the agent's credentials and network egress from outside the agent, and someone has timed it.

Model Provenance

Question one is easy for a bank that only calls US-hosted frontier APIs and hard for one whose vendors embed open-weight models. A product built on Qwen or Kimi K3 can arrive with no mention of the model in the contract. We traced one such case in legal AI, where a vendor's new model turned out to run on Qwen. As Reuters reports it, the question asks whether you use Chinese-developed technology and says nothing about prohibiting it, so the first thing to establish is whether you can answer at all.

Is It Too Early to Act?

The best case for waiting is real: the agencies are fact-finding, SR 26-2 imposes nothing enforceable, and an RFI could reshape expectations in ways that make early work obsolete. A mid-size bank with a stretched model risk team could reasonably decide to answer the questions verbally and wait for the text.

The case against waiting is that the answers you give now become your baseline. An examiner who writes down "no inventory of vendor agents" in October 2026 will ask what changed at the next visit. Most of the work here (an inventory, an authority matrix, a shutdown runbook) also holds up whatever the RFI says, because MAS and the ECB have already asked for versions of the same evidence.

What to Do Before Your Next Supervisory Conversation

This Week:

1. Have your model risk head and CISO write one-paragraph answers to the seven questions above, as they stand today. Where an answer is "we would have to check," that is your gap list.
2. Ask procurement for every contract signed or renewed since January 2025 with a vendor that markets "agents," "copilots" or "autonomous" features. That list seeds the third-party half of the inventory.

This Month:

1. Build the agent inventory: for each agent, its owner, its business process, what it can read, what it can change, which model it runs on and who built that model.
2. For each agent that can move money, change a customer record or touch a production system, document its authority limits and the human approval point, and pull one week of decision logs to confirm they show why it acted.
3. Run a shutdown drill on your highest-risk agent. Revoke its credentials and egress from outside the agent, time it, and write down what broke downstream.

Before the RFI Lands:

1. Send each material AI vendor a model provenance request: base model, developer, country of origin and hosting location, with a contractual duty to notify you of changes.
2. Decide which framework covers agents in your bank in the meantime (an extension of your model risk policy, your third-party risk program or a standalone standard) and get the board risk committee to approve it, so the next supervisor who asks gets a document with a date on it.

The Bigger Picture

SR 11-7 shaped how US banks governed models for 15 years, and its replacement chose to leave agents for later. The agencies are now collecting answers on agents informally, bank by bank, ahead of an RFI and before any guidance exists. Whatever your bank tells its supervisor this quarter is the starting point that guidance will be measured against.

Start with the seven questions and a blank page for each.

Continue Reading

• MAS Makes Banks Find the AI Hidden in Their SaaS by October 2027
• Agent Audit Logging: Platform Logs Miss the Decision You Must Prove
• Human-in-the-Loop for AI Agents: Most Approval Gates Rubber-Stamp
• OpenAI's Agent Kill Switch Failed for 2.5 Hours After a DNS Escape
• Banks' 1,721% Agent Orchestration Jump Starts From 108 Mentions
• NAIC's Draft AI Exam Lets Insurers Set Their Own Materiality Bar
• Britain Regulated Four Clouds. Not the Models Inside.