The Office of the Comptroller of the Currency (OCC) published Bulletin 2026-54 on November 4, a supervisory framework that helps its examiners evaluate how national banks and federal savings associations use artificial intelligence. According to the OCC, the document is a resource for examiners and creates no new supervisory expectations, enforceable standards or prescriptive requirements for banks. Analyses by the fintech vendor Q2 and the consultancy Elevate say its illustrative risk tiers place autonomous payment agents and fraud-hold release in the highest, critical tier.
A new name. The OCC now calls the technology super intelligence (SI). The bulletin says the term covers the systems previously described as artificial intelligence under US law, following Executive Order 14434. Elevate stresses that it is not a new technology category.
Consequences over sophistication. The bulletin says a bank's risk classification of AI use cases may be based on potential consequences, transfer of agency and the degree of human oversight, rather than the technical sophistication of the system. Control intensity could increase with the potential consequences of an agent's failure or misuse. Both Q2 and Elevate highlight the framework's example: a simple rules-based agent authorised to initiate transactions can present more risk than a sophisticated model limited to drafting.
Where fraud tools land. According to Elevate, Tier 1 (Critical) includes autonomous payment agents, real-time credit decisioning, fraud-hold release and market access. Tier 2 (High) includes AI-assisted underwriting, agent-initiated customer communications and anti-money laundering alert disposition. Elevate notes the tiers are offered as an example for examiners, not a mandated model.
Why it matters
Closing a gap. Q2 and Elevate both point out that Bulletin 2026-13, the revised model risk guidance issued in April, left generative and agentic AI out of scope. Elevate says the two bulletins together now cover the full range of models a bank operates. It also warns that, although the framework is not binding, a bank that cannot answer its questions may face findings in existing areas such as operational, compliance and third-party risk.
Oversight must be real. Q2 quotes the framework saying human review should be "more than a nominal click" and that bulk approval "could reduce review quality and contribute to alert fatigue". Examiners are also told not to treat AI as a separate risk category, and banks need no separate AI risk appetite, according to the OCC.
- Map what each AI agent may do, what data it can reach and who can trigger it.
- Treat agents that move money or release fraud holds as the highest-consequence uses.
- Make sure a material decision can be reconstructed from inputs, outputs, approvals and actions, as Q2 describes.
- Ask vendors where the evidence of their agents' actions is stored.
A note on sources. Q2 sells a fraud platform and presents its own product as a fit for the framework, so its advice should be read as vendor commentary. The OCC says it will update the guide as the technology and supervisory understanding mature.
Leave a Reply