Global Banking Regulators Increase Oversight of Agentic AI Systems

Global banking regulators are increasing their oversight of artificial intelligence, specifically targeting autonomous agentic systems and cyber-recovery protocols to prevent systemic financial instability. While the push is currently in an information-gathering phase, watchdogs in the U.S. and Europe are signaling that existing risk-management frameworks may be insufficient for evolving AI technologies.

"The adoption of AI is often outpacing the ability to put the controls in place," said Michael Woodbridge, London-based cybersecurity partner at Grant Thornton.

U.S. Focus on Agentic Oversight

In the United States, the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) have begun questioning major financial institutions regarding their integration of agentic AI. These systems are defined by their ability to execute complex, multi-step tasks with minimal human intervention, moving beyond simple predictive modeling into autonomous decision-making.

Regulators are prioritizing specific areas of concern:

• Human Oversight: Ensuring that autonomous systems remain subject to human review before executing high-stakes financial transactions.
• Auditability: Developing methods to trace and explain the logic behind AI-driven decisions for compliance purposes.
• Technology Provenance: Assessing the risks associated with utilizing AI models developed by third-party, foreign-based technology providers.

European Requirements for Cyber Resilience

Across the Atlantic, the Bank of England and the European Central Bank (ECB) are focusing on operational resilience against AI-enabled cyberattacks. Supervisors are pressuring banks to implement bare metal recovery plans. Unlike standard cloud-based backups, bare metal recovery involves maintaining independent, hardware-level infrastructure that can restore critical banking operations from scratch, bypassing primary systems that may have been compromised by an AI-driven exploit.

"To protect against attacks, rapid recovery matters as much as prevention," said Sukand Ramachandran, managing director and Senior Partner at BCG.

Regulatory Status and Next Steps

The current regulatory posture is characterized by inquiry rather than enforcement. Regulators have not yet issued prescriptive requirements or formal mandates for lenders, preferring to map the current usage of AI within the global banking sector. This diagnostic phase aims to determine whether existing capital and operational requirements can accommodate the risks posed by autonomous systems, or if new, specialized frameworks are required to maintain financial stability.