What happened
On 4 November 2026 the OCC issued Bulletin 2026-54 (news release 2026-97), a 22-page supervisory framework to guide its bank examiners in evaluating banks' use of 'Super Intelligence' (SI) and agentic SI in normal-course business activities. The framework groups 16 components into six pillars (Purpose, Risk, Control, Oversight, Resilience, Assurance) and adds an illustrative consequence-based control-risk tiering (Tier 1 Critical = autonomous payment agents, real-time credit decisioning, fraud-hold release, market access; Tier 4 Low = internal productivity tools) plus a technical dictionary. It defines SI as the technologies formerly called AI (15 USC 9401(3)) per Exec. Order No. 14434, and explicitly covers generative and agentic systems that the April 2026 interagency model-risk guidance (Bulletin 2026-13) excludes. Critically, the bulletin states it 'does not establish supervisory expectations for banks,' sets no separate SI risk category or risk appetite, and is not for bank self-assessment — it is an examiner resource subject to the materiality/proportionality of each use case.
Why it matters
This is the first US federal bank-regulator framework specifically addressing agentic/GenAI systems in banking (credit decisioning, payments, AML/sanctions, fraud, customer interactions). It operationalizes the principle that scrutiny turns on the consequences of an automated action (autonomy, reversibility, financial/customer impact) rather than on model sophistication — a rules-based agent that can move money is riskier than a complex model used for drafting. It fills the gap left by the April model-risk guidance and is likely a template that the Federal Reserve and FDIC (which supervise state-chartered banks) may mirror. Banks doing AI work need to anticipate examiner questions on inventory/purpose, substantive human oversight, resilience (kill switches, tested fallbacks), third-party/vendor accountability, and independent assurance/reconstructability of material decisions.
Action needed
For OCC-supervised institutions (and any bank anticipating Fed/FDIC follow-on): map every SI/agentic use case to the six pillars; build a consequence-based tiering of AI systems by autonomy and reversibility; confirm human review of high-consequence actions is substantive (not bulk-approval click-through); verify kill switches and tested fallbacks for agents that can act while 'available'; review vendor contracts for change notice, incident notification, data use and liability; ensure internal audit can reach underlying evidence and that board reporting reconciles to the AI inventory and incidents. Monitor for the promised follow-up seeking input on model-risk management that considers generative and agentic AI.