Banking watchdogs ramp up AI scrutiny as stability fears mount, say sources

NEW YORK/LONDON – Banking regulators are stepping up efforts to contain growing AI risks, six people familiar with the matter said, with some pointing to the potential for cyberattacks on banks or rogue agents undermining global financial stability.

The regulatory scrutiny, fresh details of which are reported here for the first time, reflects growing recognition that advances in frontier AI may require costly investments in cyber recovery, greater attention to dependencies on external technology providers and, in some jurisdictions, more formal regulatory guidance, sources said.

Three top regulators in the US, including the Federal Reserve, are quizzing banks about their use of advanced AI models, two of the people told Reuters, adding to prior scrutiny.

Questions include whether they deploy Chinese-developed technology, use AI agents in cyberdefence and can control increasingly autonomous systems, three of the people said.

In Europe, supervisors, including the Bank of England (BOE) and the European Central Bank (ECB), are pressing banks to improve recovery plans, concerned that rapid advances in artificial intelligence could cause serious harm and disruption in financial markets sooner than previously feared, three people with knowledge of their thinking said.

A senior executive at a large European bank said they, too, are worried about potentially major damage to banking and financial markets “within six months”.

The debate over AI oversight has intensified amid warnings from the industry after recent incidents, with JPMorgan chief executive Jamie Dimon urging corporate leaders to join a US-focused industry group to address AI risks, Reuters reported.

US cybersecurity company CrowdStrike said in October that a person in China likely used a Chinese-developed AI agent and Anthropic’s Claude Code in a hack on South Korean banks. Rogue AI agents developed by OpenAI were meanwhile involved in a breach of the AI platform Hugging Face, Reuters reported.

Anthropic researchers have warned that increasingly powerful AI systems could eventually escape human control and even pose an existential threat, prompting calls for stricter regulation.

Banks are competing to adopt agentic AI, which can accomplish tasks with minimal human supervision, while also grappling with challenges in new models, including IT weaknesses flagged by Anthropic’s Mythos tool.

Michael Woodbridge, London-based cybersecurity partner at Grant Thornton, said: “The adoption of AI is often outpacing the ability to put the controls in place.”

US concerns aim at agentic AI

The US regulatory inquiries centre on how banks use agentic AI in areas such as cybersecurity, focusing on whether AI agents are being used to identify, prioritise and respond to threats.

Questions from the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC) and the Fed focus on what limits are placed on systems, how their actions are monitored and approved and whether banks can clearly track and audit AI agent decisions, two of the people said.

They are also asking what safeguards exist to prevent agents from exceeding their authority, whether humans remain involved in key decisions and how banks can shut down autonomous systems.

The OCC, the Fed and the FDIC declined to comment.

Through their questions, regulators are probing more specific issues tied to advanced AI models, including the use of autonomous AI agents, foreign-developed models and new cyber risks, the three people with knowledge of their thinking said.

The written and verbal inquiries to large, mid-size and smaller banks show regulators are focusing on vulnerabilities from banks’ use of AI and their preparedness to act, they said.

Regulators are still gathering information and are not yet being prescriptive about what lenders should be doing, they added.

Europeans worry about recovery

Supervisors in Britain are separately encouraging the largest banks to examine so-called bare metal recovery plans, two of the people familiar with their thinking said.

These systems are entirely independent of a bank’s main tech set-up and can kick in if primary operating systems are compromised.

But building and maintaining such state-of-the-art recovery is expensive, the people said.

Rather than introduce new requirements, the British authorities intend to work collaboratively with the industry, they added.

The BOE declined to comment.

In July, the ECB gave lenders an end-October deadline to produce plans to counter AI-enabled cyberthreats, including improved backup and recovery.

Asked about its strategy for regulating AI, the ECB referred to its July letter and a June speech by board member Frank Elderson, who stressed the need to create a sense of urgency, not alarm, about the threats.

The need for supervisory action has taken on added urgency after European banks and regulators expressed frustration at getting limited access to Mythos in 2026, amid concerns that US banks will be given first sight to test frontier models.

Like their US counterparts, British supervisors are also asking banks to use frontier AI to identify vulnerabilities and accelerate patching, two people said, with one adding that lenders were so far doing a good job.

The third person said euro zone banks were also being asked to map how AI is being used across their businesses and third-party providers to understand key dependencies and ensure they can switch off and restart systems in a controlled manner.

Significant gaps remained at some firms, they added.

Sukand Ramachandran, managing director and senior partner at Boston Consulting Group, said: “To protect against attacks, rapid recovery matters as much as prevention.”

Without separately held clean, secure copies of critical data, “a serious attack could lock customers out of their accounts and disrupt payments across the wider economy”, he added. REUTERS