Banking regulators in the United States and Europe are intensifying scrutiny of artificial intelligence (AI) use in the financial sector amid concerns over emerging risks to stability and cybersecurity, according to multiple sources familiar with the matter.
U.S. authorities, including the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC), have been engaging banks on their deployment of advanced AI models, particularly agentic AI systems capable of operating with minimal human oversight. These regulators are seeking detailed information on controls around AI decision-making, limits imposed on autonomous agents, auditing capabilities, and how banks manage the potential for AI systems to exceed their authority or require shutdown. Attention is also being directed toward banks' use of foreign-developed AI technologies, such as those originating from China, amid cybersecurity concerns.
European supervisors, including the Bank of England (BOE) and the European Central Bank (ECB), have pressed banks to bolster their IT recovery plans, emphasizing the importance of “bare metal” recovery systems—standalone infrastructures capable of restoring operations independent of primary technology platforms. The ECB set an end-October deadline for banks to submit plans addressing AI-enabled cyber threats, focusing on measures like improved backups and recovery. British regulators are engaging collaboratively with banks to enhance resilience without imposing new formal requirements.
The heightened oversight reflects a growing recognition that rapid advancements in frontier AI models could introduce novel vulnerabilities. Industry experts caution that AI adoption often outpaces the implementation of adequate safeguards. A senior executive at a major European bank expressed concerns about the potential for significant disruption to banking and financial markets within six months if controls are not adequately strengthened.
Recent incidents involving AI-driven cyberattacks have increased industry awareness of the risks. For example, a U.S. cybersecurity firm reported that a Chinese actor likely used AI agents developed domestically alongside tools from Anthropic and OpenAI in attacks targeting financial services platforms. Anthropic researchers have warned that increasingly autonomous AI might eventually evade human control, posing severe challenges to regulatory and security frameworks.
Regulators are currently gathering data to understand the scope of AI use and risks but have not yet issued prescriptive rules. European supervisors are also requiring banks to map their AI use across business units and third-party providers to identify critical dependencies and ensure the capacity for controlled system shutdowns and restarts. However, significant capability gaps persist at some institutions.
Industry consultants emphasize the dual importance of prevention and rapid recovery in defending against AI-enabled cyber threats. Without secure, isolated copies of key data, a coordinated attack could lock customers out of their accounts and disrupt essential payment systems, with broad repercussions for the wider economy.
While regulators in both the U.S. and Europe acknowledge the need for urgency, they aim to balance caution with progress, seeking to manage the risks of AI as the financial sector increasingly integrates these advanced technologies.