Banking Examiners Are Now Asking Banks to Prove AI Agents…

Banking Examiners Are Now Asking Banks to Prove AI Agents Can Be Audited

What happened

Reuters reported on October 13, 2026, in "EXCLUSIVE: Banking watchdogs ramp up AI scrutiny as stability fears mount, sources say" that U.S. banking supervisors are questioning institutions directly about AI systems. Examiners ask how systems stay within limits, who approved them, and how decisions can be traced. Examiner questions are now reportedly reaching into agent-specific controls. They cover what tasks each system can perform and which actions require human sign-off. They also ask who is accountable when something goes wrong and whether logs exist to reconstruct AI actions. This reporting follows a pattern of supervisory concern documented earlier in Banks Set Five-Layer AI Control Benchmark as Supervisory Pressure Grows and the BIS Warns AI Strains Core Bank Supervisory Expectations on Model Governance advisory. Banks responding to examinations must situate AI agent governance within existing frameworks. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) already requires this for consequential models.

·Examiners are treating AI agent governance as a live supervisory topic, not a future risk. Banks that cannot produce agent decision logs, approval records, or accountability assignments during an examination face findings under existing model risk and operational resilience expectations.
·The questions regulators are asking map directly to controls that many banks have not yet built. Documenting which AI agents can act without human approval and what limits exist is now an examination-ready requirement. So is identifying who owns each deployment. These are not aspirational program goals.
·Supervisory scrutiny of AI agents in banking is intensifying across multiple bodies simultaneously. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) and parallel European Central Bank pressure following the ECB Requires Bank AI Cyber Action Plans by October 31, 2026 signal a coordinated supervisory direction, not an isolated inquiry.

☐Produce a list of every AI agent currently in use at your institution, including the systems it can access, the actions it can take without human approval, and the name of the business owner responsible for each one.
☐Verify that your AI agent deployments generate logs sufficient to reconstruct what each agent did, when, and on whose authority. Ask your technology team whether those logs are retained in a format examiners can access.
☐Review whether your current model risk management framework explicitly covers AI agents, or whether agents have been deployed outside that framework. Flag any agent systems that have not gone through a formal approval process.
☐Map which agent actions currently require a human to approve before they execute. Document that mapping and confirm it reflects actual system behavior, not just policy intent.
☐Assign a named accountable owner to each agent deployment and record that assignment in your model or AI system inventory so it is available on request during an examination.

Banking compliance teams should monitor whether U.S. banking agencies formalize these examination questions into written supervisory guidance or updated model risk management standards. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) is the current anchor document. Examiners are already applying it to agentic systems beyond its original scope. The Risk-Based Framework for Bank AI Agent Authority Sets a Governance Benchmark and the JPMorgan and HSBC Embed AI Governance Into Firm-Wide Risk Structures coverage offer leading-edge benchmarks for what well-prepared institutions are building now.