US OCC Issues Bank AI Supervisory Framework, Citing Autonomous Payment Agents as Tier 1 Risk

According to media reports and official documentation from the US OCC, the agency has released its first banking AI supervisory framework. Designed for bank examiners, the document outlines how to integrate AI into existing risk management systems rather than establishing a separate AI risk category, focusing on permissions, tool access, and autonomous actions. The framework organizes supervision around core pillars such as business purpose, risk, controls, oversight, operational resilience, and validation effectiveness. OCC introduced an illustrative four-tier classification: Tier 1 covers autonomous payment agents, real-time credit underwriting, and unfreezing fraud alerts; Tier 2 includes AI-assisted lending and proactive customer contact; Tier 3 spans human-reviewed credit summarization; and Tier 4 includes internal Q&A tools. This tiering centers on degree of autonomy and reversibility of errors. Regarding control mechanisms, the OCC emphasizes that human oversight must not be superficial or lead to alert fatigue, distinguishing between Human-in-the-Loop and Human-on-the-Loop models. To mitigate runaway agent execution, the framework recommends rate limits, least privilege access, circuit breakers, and kill switches. For external or third-party vendor agents, the OCC notes that primary risk management responsibility remains with the deploying bank.

Key takeaways

• The US OCC released a banking AI framework citing autonomous payment and real-time underwriting agents as Tier 1 risk examples.
• Risk assessment prioritizes autonomy, capacity for direct action, and reversibility of failure over technical complexity.
• Recommended control mechanisms include rate limiting, least privilege, circuit breakers, and emergency kill switches.
• The OCC reiterated that banks retain primary responsibility for risk management even when utilizing external or vendor-hosted agents.