The Office of the Comptroller of the Currency (OCC) issued a supervisory framework for examiners assessing banks’ use of super intelligence (SI) and agentic SI, linking examination intensity to the potential consequences and autonomy of each use case. SI encompasses technologies previously described as artificial intelligence. Examiners should assess SI within existing risk categories rather than treat it as a distinct category or require a separate SI risk appetite. The framework is an examiner resource, not a set of enforceable standards, and banks are not expected to use it to assess their SI risk management. Examinations should reflect each bank’s size, complexity and risk profile, as well as the materiality of its SI activities. Risk classification may turn on the consequences of failure, reversibility and degree of human oversight rather than technical sophistication. More consequential uses may warrant tighter limits on autonomy, stronger human oversight and more independent validation. An illustrative methodology places autonomous payment agents in Tier 1, the critical category, while internal productivity tools without customer or financial data exposure fall within Tier 4, the low category. The control considerations address risks that conventional oversight may miss. Human reviewers need practical capacity and authority to intervene, while testing and monitoring may need to detect fabricated outputs and behavioral changes following model or vendor updates. Resilience arrangements may address systems that remain available but act incorrectly, including containment, suspension and customer remediation. Reliance on external providers does not transfer the bank’s accountability for managing its risks.
US Office of the Comptroller of the Currency issues supervisory framework for banks’ use of super intelligence
The Office of the Comptroller of the Currency issued an examiner framework for banks’ use of super intelligence and agentic systems, with scrutiny calibrated to potential harm, autonomy and human oversight. SI should remain within existing risk categories, without a separate risk appetite, while more consequential uses may warrant stronger controls and validation. The framework guides examiners rather than establishing enforceable standards or requiring banks to assess themselves against it.