Banking regulators in the U.S., Britain and the euro zone are stepping up scrutiny of how lenders use and control advanced artificial intelligence, including AI agents that act with little human oversight, Reuters reported Tuesday, citing six people familiar with the matter. For bank boards, the questions point to what examiners are likely to ask next: who can stop an autonomous system, and how fast the bank can recover if one is turned against it.

AI agents are software systems that can complete multistep tasks on their own with minimal human oversight, rather than only answering questions.

What Happened

In the U.S., the Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) are questioning banks about their use of advanced AI models, two of the people told Reuters. According to three sources, the questions cover whether banks use Chinese-developed technology, whether they deploy AI agents in cyber defense, and whether they can control increasingly autonomous systems. Two sources said regulators want to know how agent actions are limited, monitored and approved and whether decisions can be audited. Regulators are also asking whether humans stay involved in key decisions and how the systems can be shut down, Reuters reported.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

The inquiries have gone to large, midsize and smaller banks in writing and verbally, the sources said. Regulators are still gathering information and are not yet prescribing specific steps, Reuters reported. The three agencies declined to comment.

In Britain, supervisors are encouraging the largest banks to examine "bare metal" recovery, backup systems fully independent of a bank's main technology that can take over if primary systems are compromised, two people told Reuters. Sources said such setups are costly and that U.K. authorities plan to work with the industry rather than impose new requirements. Two sources said U.K. supervisors are also asking banks to use frontier AI to find vulnerabilities and patch faster. The Bank of England declined to comment.

The European Central Bank (ECB) in July gave euro zone lenders an end-October deadline to produce plans against AI-enabled cyber threats, including stronger backup and recovery, Reuters reported. One person said banks are being asked to map AI use across their businesses and outside providers and to be able to switch systems off and restart them in a controlled way. Asked about its strategy, the ECB pointed Reuters to its July letter and a June speech by board member Frank Elderson.

Why It Matters

None of these steps is a rule yet, but they show where supervision is heading. A U.S. bank that cannot explain how its agents are bounded, logged and stopped, or whether Chinese-developed tools sit in its stack, may find those gaps raised in examinations. In Europe, the emphasis on isolated recovery systems implies spending on infrastructure that sits idle until a crisis.

Concern is not limited to regulators. One senior executive at a large European bank told Reuters they worry about potentially major damage to banking and markets within six months, and sources said significant gaps remain at some firms. Michael Woodbridge, a cybersecurity partner at Grant Thornton in London, told Reuters that AI adoption "is often outpacing the ability to put the controls in place."

Context

Reuters tied the scrutiny to recent incidents, including CrowdStrike's finding this month that a person in China likely used a Chinese-developed AI agent and Anthropic's Claude Code in a hack on South Korean banks. Korean authorities had already linked breaches at seven financial firms to one attacker. Reuters also reported that European banks and regulators have been frustrated by limited access to Anthropic's Mythos model, which has surfaced IT weaknesses, and worry U.S. banks will see frontier models first.

What to Watch

The ECB's end-October deadline is the first hard marker. In the U.S., the question is whether the Fed, OCC and FDIC turn their information gathering into formal guidance or exam expectations. All accounts of the supervisory questioning come from unnamed sources; the regulators have not commented.