The new OCC AI bank supervision framework asks a question that matters more than whether a bank uses the most advanced model: what can an automated system actually do, and what happens if it gets a decision wrong? Issued on November 4, 2026, the examiner guidance directs attention toward the consequences of an AI system's actions, its autonomy and the human oversight around it. It does not impose a new set of binding rules on banks.
The Office of the Comptroller of the Currency's bulletin describes the document as a resource for its examiners evaluating what the agency calls “super intelligence,” or SI, including agentic systems. The regulator explicitly says banks are not expected to use the document to assess their own systems and that it creates no enforceable standards or new regulatory expectations. That qualification is essential to understanding the announcement.
What the OCC AI bank supervision framework changes
The immediate change is in how federal bank examiners are instructed to think about emerging systems, not a new legal obligation for financial institutions. The OCC says examiners should adapt their reviews to the materiality of a use case and consider the potential consequences of failure or misuse. It also says examiners should not classify SI as an entirely separate risk category or demand that banks establish a separate SI risk appetite.
This approach places new technology within familiar banking disciplines: governance, operational risk, compliance, model risk management and controls over who can authorize an action. The framework can supplement existing examination practices without replacing them. Whether a specific bank's deployment is appropriate remains a question of the activity, its risk and the applicable rules.
The agency's November 4 news release says it plans to update the guidance as technology and supervisory understanding evolve. The release does not identify a deadline for banks to implement a new AI program, because this is guidance to examiners rather than a compliance mandate.
Why a simple agent can be riskier than a powerful model
Consider two hypothetical banking tools. One sophisticated model summarizes internal research for an employee who checks its work before making any decision. Another comparatively simple agent can initiate a payment after interpreting a customer request. Even if the second model is technically less advanced, a mistake or malicious instruction could have more immediate financial consequences.
That is an illustration of the OCC's risk-based principle, not a description of any identified bank's systems. A system's technical capability is only one factor. Its authority to move money, alter records, disclose sensitive information or trigger an external workflow can matter more than benchmark performance.
Independent Reuters reporting likewise highlighted the regulator's emphasis on outcomes and human oversight rather than treating every advanced model as equally risky. The distinction helps banks and their customers ask a practical question: is a system merely recommending an action, or has it been given permission to carry one out?
Three dimensions of control that deserve scrutiny
Consequences: What is the plausible harm if the system produces an incorrect answer or takes an unauthorized action? A drafting assistant may require review for accuracy; an agent with payment privileges may need transaction limits, authentication checks and rapid intervention mechanisms.
Autonomy: How much of a workflow can the system execute without a person approving each step? A tool that drafts a transfer request is different from one that submits it. The precise boundaries of delegated authority should be observable and testable.
Oversight: Can employees detect errors, halt activity, reconstruct what happened and correct the outcome? Human review is meaningful only when reviewers have the information, time and authority to intervene. These examples are an explanatory framework derived from the OCC's stated priorities, not a checklist newly mandated by the agency.
These concerns overlap with issues described in Unhyd's guide to Model Context Protocol security, which distinguishes an AI assistant's ability to retrieve information from its permission to invoke tools. A similar distinction becomes consequential when a bank connects an assistant to systems capable of changing financial records.
What the guidance does not establish
The document is not a finding that a particular bank's AI has failed. It does not prohibit agentic banking tools, approve a named product, certify a model as safe or replace existing laws. Nor does it mean all AI use cases must undergo identical scrutiny. The OCC specifically tells examiners to account for a bank's size, complexity and risk profile, including at community banks.
Its terminology also requires care. The agency uses “super intelligence” as a regulatory label covering technologies previously encompassed by artificial intelligence and their advancing capabilities. The publication should not be read as proof that banks have deployed systems possessing hypothetical superhuman general intelligence.
The agency's decision not to create a separate risk category can be read as an attempt to avoid regulatory duplication. Yet it also raises a practical implementation question: how consistently will examiners apply familiar controls to unfamiliar combinations of language models, connected tools and delegated decision-making? The OCC says it expects to revise the framework, so that answer may develop through supervisory practice rather than a single announcement.
What bank customers and technology teams should watch
For customers, the most relevant questions are whether an AI-assisted service can initiate transactions, how authorization is obtained and how mistakes can be disputed or corrected. The November 4 framework does not itself create new consumer remedies. Existing account agreements and applicable consumer-protection rules still matter.
For bank technology teams, the useful takeaway is to document the distinction between assistance and execution. Controls that may be relevant include limits on tool permissions, logging, independent transaction validation, escalation procedures and the ability to disable an agent. The appropriate design depends on the application; these are possible safeguards, not requirements asserted by this new bulletin.
Unhyd previously examined six banks' voluntary principles for agentic commerce. Those principles concern trust in AI-mediated shopping and payments, while the OCC document concerns how federal examiners assess bank activities. The overlap is the underlying issue of agency: when software acts for a person or institution, accountability cannot be delegated away with the task.
The significance of the November 4 guidance is therefore not that Washington has imposed a new AI rulebook on banks. It is that a major U.S. banking supervisor has formally put the consequences of automated action, delegated authority and effective oversight at the center of its examination approach. Whether that produces safer real-world deployments will depend on how the principles are applied.
