If you run AI at an OCC-supervised bank, your next examiner will rank each use case by what happens when it goes wrong. A simple agent that can move money can draw more scrutiny than a sophisticated model that drafts memos. That is the core of OCC Bulletin 2026-54, "Super Intelligence: Supervisory Framework," published November 4, 2026. The OCC says the guide sets no new expectations for banks. In practice, it tells you what evidence an examiner will ask for: a current AI inventory that includes features your vendors switched on, a tier for every use case, owners who answer for each one, and proof you can stop an agent that is running and wrong.
The bulletin applies to national banks, federal savings associations and federal branches and agencies, and the OCC says examiners can use it for community banks, scaled to size, complexity and risk profile. It fills the hole April's model risk rewrite left open. The rest of this piece covers what the framework says, what it leaves out, and what to have ready before the next exam.
What Did the OCC Actually Publish on November 4?
The OCC published an examiner resource, and nothing in it binds a bank directly. The bulletin says the guide "does not establish supervisory expectations for banks," that banks are not expected to use it to assess themselves, and that it creates no enforceable standards. The accompanying news release (NR 2026-97) says examiners "should not treat SI as a separate and distinct risk category," and banks do not need a separate risk appetite for it. The OCC plans to update the guide as the technology and its own understanding change.
"Super Intelligence" (SI) is the OCC's term for the AI and "agentic SI" a bank uses in normal business; Decrypt links the wording to a White House preference. Decrypt reports that the scope runs from conventional AI to autonomous agents, across payments, fraud detection and customer service, and extends to outside AI agents reaching the bank through its own channels.
The examiner guide itself is a 22-page PDF. The tier examples below come from the Forvis Mazars summary and Decrypt's coverage. Read the PDF yourself before you quote a tier to your board.
How Does the Framework Tier Bank AI Use Cases?
Risk turns on three things: the consequence of a failure, how much agency the system has been handed, and how much human oversight remains. The bulletin's highlights say classification may depend on those factors "rather than the technical sophistication" of the system, and that control intensity may rise with the potential consequences of an agent's failure or misuse.
Forvis Mazars describes four illustrative tiers in the guide:
| Tier | Profile | Examples cited |
|---|---|---|
| 1 Critical | Direct action, low or no reversibility, high financial or customer impact, autonomous or partly autonomous | Autonomous payment agents, real-time credit decisioning, fraud-hold release, market access |
| 2 High | Direct action or heavily weighted decision support, human on the loop | AI-assisted underwriting, agent-initiated customer messages, AML alert disposition, code changes touching data access |
| 3 Moderate | Decision support with a mandatory human in the loop, reversible | Document summaries for credit memos, agent-assisted research |
| 4 Low | No customer or financial data, no direct action, fully human-controlled | Internal productivity tools, general code assistance, employee Q&A |
The example that matters most is the one both summaries repeat: a rules-based agent allowed to initiate transactions can carry more risk than a sophisticated model that only drafts internal documents. If your governance committee spends its time on the large model deployments and waves through small workflow bots that touch payments, you have your attention pointed the wrong way.
Decrypt lists the safeguards the guide suggests: identity verification, delegated permissions, transaction limits, monitoring, and the ability to suspend or revoke access. For higher tiers it adds tighter autonomy limits, independent testing and human approval before consequential actions, plus circuit breakers, rate limits and emergency shutdown for systems that keep running while making harmful decisions.
Why Does This Arrive Now?
It covers the generative and agentic AI that April's model risk guidance excluded. OCC Bulletin 2026-13, the joint OCC, Fed and FDIC revision issued April 17 (the Fed's SR 26-2), says plainly that generative and agentic AI models "are novel and rapidly evolving" and "are not within the scope of this guidance." That left model risk teams with a revised rulebook for credit scorecards and nothing federal for the agents their business lines were deploying. Forvis Mazars notes the agencies plan to seek input on model risk guidance that covers generative and agentic AI, so that boundary may move again.
State examiners got there first. The Conference of State Bank Supervisors released an optional AI supervisory framework for state-chartered banks and state-licensed institutions in September, per the ABA Banking Journal. The OCC guide covers the national charters that one never reached. If you are a state member or nonmember bank, Forvis Mazars suggests you also watch what the Fed and FDIC say next.
The timing also follows a bad month for outside agents. On October 22, IBTimes, citing Axios and Reuters, reported that Morgan Stanley had begun blocking third-party agents, JPMorgan was blocking agents that use customers' credentials, Citi does not let outside agents log in to customer accounts, and Bank of America was restricting access. Schwab's CEO said the firm blocks attempts by major agents in the "tens and twenties" each week. Morgan Stanley's spokesperson said the bank had not seen "rogue AI agents accessing our platforms," and the claim that agents acted beyond instructions rests on Axios's reporting. Decrypt notes the OCC did not connect its framework to those reports. We covered the blocking in detail in Schwab and JPMorgan Block AI Agents Using Customer Logins.
What Will Examiners Ask to See?
Expect evidence requests under six headings, each of which reduces to one question you should be able to answer with a document. Forvis Mazars maps the guide's six pillars (16 components in all) this way:
- Purpose: what each agent is permitted to do, with which data and systems, and whether you can test that.
- Risk: which use cases act and which only advise.
- Control: whether a reviewer can actually override or halt the system.
- Oversight: who answers when it fails.
- Resilience: whether you can stop an agent that is running and wrong.
- Assurance: whether you can reconstruct a material decision after the fact.
Two lines in that summary should change how your inventory works. The first: "Activity outside an approved purpose may be treated as a control failure even when the output appears reasonable." A correct answer from an agent doing something nobody approved still counts against you. The second is about vendors: "Accountability generally remains with the bank." The AI your core processor, CRM or fraud vendor added in a release note last quarter belongs in your inventory, and Forvis Mazars says to check those contracts for change notice, incident notification, data use and liability terms.
Human review is the other trap. Forvis Mazars says review should be substantive, and it names bulk approvals and alert fatigue as what quietly hollows it out. If your Tier 2 control is an analyst clearing hundreds of AML dispositions a shift, an examiner can reasonably ask whether a human is reviewing anything at all. Our earlier look at why most agent approval gates rubber-stamp has the design patterns.
Where Customer Agents Change the Picture
Outside agents now sit inside the framework's scope, and banks are shifting the liability for them to customers by contract. Wells Fargo's revised online access agreement, effective November 24, 2026, lists among its topics "your responsibilities for artificial intelligence agents, if and when we permit the use of such agents." It treats transactions by a customer's delegates, "including the transactions of their AI Agents," as authorized until the customer notifies the bank, and says the customer is "solely responsible for supervising" its authorized representatives and delegates. The agreement's consumer electronic fund transfer liability section still follows Regulation E for consumer accounts.
Moving liability by contract leaves the controls with the bank. The safeguards the OCC guide lists (identity verification, delegated permissions, transaction limits, the ability to revoke access) can only be built at the bank's own channel. So a bank that permits customer agents still needs to show an examiner how it knows an agent is acting, what that agent may do, and how fast it can cut one off. A bank that blocks them needs to show the block works. Schwab's planned MCP connections, which allow balance retrieval and research but no transactions, keep outside agents out of Tier 1 by design.
What to Do Before Your Next Exam
Start with the inventory, because every other request depends on it. A tier, an owner and a shutdown test all attach to an inventory line.
This Week:
- Pull your current AI inventory and add a column for "acts or advises." Every row that can move money, change a credit decision, release a hold or message a customer gets flagged as a Tier 1 or Tier 2 candidate.
- Ask procurement for the last 12 months of release notes from your top ten technology vendors and list every AI feature they shipped. Each one that is switched on goes into the inventory, with the vendor named as a third party.
- Download the framework PDF and have someone read the tier definitions from the source.
This Month:
- Run one live shutdown drill on your highest-tier agent. Time how long it takes from detection to the agent losing its permissions, and write down who had to be called. If the answer involves a vendor ticket, that is your finding.
- Pick one material decision an agent made last quarter and try to reconstruct it from logs alone: inputs, tools called, approvals, output. Internal audit should do this, not the team that built it.
- Sample 50 human approvals on a Tier 2 workflow and check how long each review took. Approvals that take a second or two are the click-through review Forvis Mazars warns about.
Before Renewal:
- Add change notice, incident notification within a fixed window, data-use limits and liability allocation for AI features to every vendor contract that touches customer or financial data.
- Decide your position on customer AI agents in writing: permit with scoped access, read-only only, or block. Then check that your access agreement and your fraud controls say the same thing.
If you hold a governance registry such as Credo AI or ServiceNow AI Control Tower, map its fields to the six pillars now, so answering the exam request takes an export.
The Bottom Line
The OCC now grades bank AI the way examiners grade credit exposure, and scales the scrutiny to match. The guide binds no bank, but it is written for the people who will sit in your conference room, so its questions are the ones to prepare for. It follows the joint supervisory questions regulators sent banks in October. Abroad, the Bank of England and FCA survey and the MAS inventory rules point the same way: regulators want to know what your AI can do without a person in the way, and who pays when it is wrong.
Run the shutdown drill on your Tier 1 agent before an examiner asks you to.
Continue Reading
- US Regulators Ask Banks to Explain Their AI Agent Safeguards
- Schwab and JPMorgan Block AI Agents Using Customer Logins
- MAS Makes Financial Firms Inventory AI Across Their SaaS Tools
- Bank of England and FCA Find UK AI Agents Rarely Act Alone
- Human-in-the-Loop for AI Agents: Most Approval Gates Rubber-Stamp
- OpenAI's Agent Kill Switch Failed for 2.5 Hours After a DNS Escape
- Best MLOps for Regulated AI: Domino, Then a Sign-Off Layer