What happened
According to a Reuters exclusive (13 October 2026, citing six people familiar), the Federal Reserve, OCC and FDIC have begun questioning every bank under their supervision — regardless of size — on AI governance, including whether they operate Chinese-developed AI technology, whether they use AI agents in cyber defence, what authority limits and audit trails apply to autonomous agents, whether humans stay in key decisions, and whether a tested emergency shutdown ('kill switch') exists for AI systems. The inquiries are fact-finding to support an expected request for information and future rulemaking, following the April 2026 SR 26-2 model-risk guidance rewrite that explicitly left generative and agentic AI out of scope.
Why it matters
This is the first time major US financial regulators have written controllability of AI agents (including shutdown capability, data-boundary controls and vendor decoupling from Chinese AI tech) into the standard examination script, so compliance now requires demonstrable evidence at every routine examination. It signals where binding agentic-AI rules are heading for the entire US banking sector and follows AI-enabled attacks on South Korean banks using agentic tools.
Action needed
Financial institutions should prepare an agent authority matrix, approval records, decision logs, enforced permission boundaries, a named human checkpoint and a tested shutdown path per AI agent, and examine exposure to Chinese-developed AI technology, before the next exam cycle.