OCC Issues AI Guidelines for Banks in the United States

The Office of the Comptroller of the Currency (OCC), the top U.S. bank regulator, published a new framework guideline on November 4 to oversee artificial intelligence, which banks increasingly use in areas such as credit decisions, customer service, and fraud detection. According to an analysis by the law firm Ballard Spahr, while the guide does not introduce binding new rules for banks, it serves as a resource for examiners.

The "OCC Supervisory Framework for Bank Use of Superintelligence," published by the OCC, covers generative artificial intelligence that generates text and content, as well as agentic AI technologies that can take action without human intervention. The regulatory body refers to this technology as "superintelligence," a term used by the executive branch in an executive order signed by President Donald Trump on September 29. According to Ballard Spahr's analysis, the guide does not require banks to treat artificial intelligence as a separate risk category; instead, examiners review how AI alters existing risks such as fraud, privacy, cybersecurity, and third-party vendors.

The guide establishes four distinct risk levels based on the degree of autonomy of an AI system and emphasizes that controls should expand as risk increases. It also notes that simply clicking an "approve" button does not constitute a true human review, and that reviewers must possess the authority and knowledge to reject or halt actions. It is noted that banks remain responsible for customer satisfaction and the legal consequences of potential errors, while third-party vendors will be subject to stricter oversight regarding contracts and change notifications.