Banking regulators tighten AI oversight as concerns grow over cyberattacks, autonomous systems and threats to global financial stability and banking operations.
Financial regulators in the United States and Europe are stepping up scrutiny of artificial intelligence as concerns grow that rapid technological advances could expose banks to cyberattacks and threaten the stability of financial markets.
Six people familiar with the matter told Reuters that authorities are examining how financial institutions use advanced AI models, manage technology-related risks and prepare for disruptions involving increasingly autonomous systems.
The move reflects concerns that banks may need to strengthen cybersecurity, improve recovery capabilities and address vulnerabilities arising from their dependence on external technology providers, according to the sources.
In the United States, the Federal Reserve and two other major banking regulators are questioning financial institutions about their use of advanced AI, including Chinese-developed models and autonomous agents deployed in cybersecurity operations.
Regulators are also seeking assurances that banks can effectively monitor and control AI systems capable of performing tasks with limited human supervision.
In Europe, the Bank of England and the European Central Bank are urging lenders to strengthen their recovery arrangements amid fears that advances in AI could disrupt financial institutions and markets sooner than anticipated.
A senior executive at a major European bank told Reuters that the possibility of significant damage to the banking sector and financial markets within six months was a concern.
The heightened scrutiny follows warnings from industry leaders and a series of cybersecurity incidents that have raised questions about the risks associated with increasingly sophisticated AI tools.
JPMorgan Chief Executive Jamie Dimon has urged corporate executives to participate in a US-focused industry initiative aimed at addressing AI-related threats, Reuters previously reported.
US cybersecurity firm CrowdStrike said this month that an individual in China likely used a Chinese-developed AI agent alongside Anthropic’s Claude Code in an attack targeting South Korean banks. Separately, AI agents developed by OpenAI were reportedly involved in a security breach affecting the AI platform Hugging Face, according to Reuters.
Researchers at Anthropic have also warned that increasingly powerful AI systems could become difficult to control and potentially pose existential risks, adding to calls for stronger safeguards and regulatory oversight.
Despite these concerns, banks are accelerating their adoption of agentic AI, which can carry out tasks with minimal human intervention. Anthropic’s Mythos tool has also drawn attention to potential vulnerabilities in existing information technology systems.
“The adoption of AI is often outpacing the ability to put the controls in place,” said Michael Woodbridge, a London-based cybersecurity partner at Grant Thornton.
In the United States, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation and the Federal Reserve are seeking information on how banks use AI agents to identify, assess and respond to cybersecurity threats.
Two people familiar with the inquiries said regulators want to understand the restrictions placed on these systems, how their activities are monitored and authorised, and whether banks can trace and audit decisions made by AI agents.
Authorities are also examining safeguards designed to prevent AI systems from exceeding their authorised functions, the extent of human oversight in critical decisions and whether banks can quickly disable autonomous tools when necessary.
The three US regulators declined to comment.
The inquiries cover large, medium-sized and smaller lenders, with authorities using written and verbal requests to assess banks’ exposure to foreign-developed AI models and emerging cybersecurity threats.
However, regulators are still gathering information and have yet to issue specific instructions on how banks should respond, the sources said.
In Britain, supervisors are encouraging major lenders to assess so-called bare-metal recovery arrangements. These systems operate independently of a bank’s primary technology infrastructure and can be activated if its main systems are compromised.
Such arrangements could help financial institutions restore essential services following severe cyberattacks, although establishing and maintaining them can be expensive.
British authorities are seeking to work with the banking industry rather than immediately introduce additional regulatory requirements, the sources said. The Bank of England declined to comment.
The European Central Bank, meanwhile, has given lenders until the end of October to submit plans addressing AI-enabled cyber threats, including measures to strengthen backup and recovery capabilities.
In response to questions about its regulatory approach, the ECB referred to a communication issued in July and a speech delivered in June by board member Frank Elderson, who called for an urgent but measured response to emerging AI threats.
Pressure for tighter oversight has also grown amid concerns among European banks and regulators about limited access to Anthropic’s Mythos model for testing security vulnerabilities. The concerns centre partly on the prospect that US financial institutions could gain earlier opportunities to assess advanced AI systems.
British supervisors are also encouraging banks to use advanced AI models to identify security weaknesses and accelerate the deployment of software fixes. One source said lenders were making good progress in this area.
Eurozone banks are additionally being asked to map AI use across their operations and third-party providers. The exercise is intended to help supervisors identify critical dependencies and assess whether institutions can safely shut down and restart affected systems.
Despite these efforts, significant weaknesses remain at some financial institutions, one source said.
Sukand Ramachandran, a managing director and senior partner at Boston Consulting Group, said the ability to recover quickly from cyberattacks was just as important as preventing them.
He warned that without separate, secure copies of critical data, a major cyberattack could prevent customers from accessing their accounts and disrupt payment systems across the wider economy.
