Banking supervisors in the United States and Europe are increasing scrutiny of artificial intelligence as concerns grow over cyberattacks, autonomous agents and potential disruption to financial services, Reuters reported on October 13, citing six people familiar with the matter.
In the US, the Federal Reserve, Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation are questioning banks about safeguards for agentic AI. Their inquiries cover limits on agents’ authority, human oversight, monitoring, audit trails and the ability to shut down autonomous systems, according to sources cited by Reuters. The agencies declined to comment.
The inquiries remain an information-gathering exercise rather than prescriptive instructions, the sources said. In Britain, supervisors are encouraging major banks to examine independent recovery systems that could operate if their primary technology infrastructure is compromised. UK authorities intend to work collaboratively with banks, rather than introduce new requirements, according to the report.
The European Central Bank gave lenders an end-October deadline to submit plans addressing AI-enabled cyber threats, including backup and recovery improvements, Reuters reported.
“To protect against attacks, rapid recovery matters as much as prevention,” Sukand Ramachandran, managing director and senior partner at BCG, told Reuters.
The latest scrutiny follows public warnings from European supervisors earlier this year. In a June 3 speech, ECB executive board member and supervisory board vice-chair Frank Elderson said more than 85% of banks under European banking supervision already used AI, according to the institution’s annual technology data collection. He acknowledged its benefits for operations, risk management and IT security, while warning that advanced models could also improve attackers’ capabilities.
Elderson described the challenge as an issue requiring ownership by banks’ management bodies. He called for adequate resources, timely patching and stronger cyber hygiene. He also highlighted dependencies on cloud providers, telecommunications networks, payment systems and utilities, warning that disruption to shared infrastructure could affect multiple institutions.
Existing supervisory work provides a backdrop to those concerns. The ECB’s 2024 cyber resilience stress test covered 109 banks, with 28 undergoing a deeper assessment of their response and recovery capabilities. By June 2026, almost three-quarters of the findings had been addressed, Elderson said. He stressed that maintaining operational resilience requires sustained investment in people, systems and governance as the threat landscape changes.
