The examiner guidance creates no new requirements for banks, but directs supervisors to scale scrutiny to what an AI system can do without a human rather than to how advanced it is.
The Office of the Comptroller of the Currency (OCC) has placed autonomous payment agents in the highest of four illustrative risk tiers in a new framework which sets out how its examiners will assess banks’ use of artificial intelligence, which the agency now refers to as ‘super intelligence’ (SI), following US President Donald Trump‘s reclassification of the technology from artificial intelligence (AI).
The 22-page framework, issued on 4 November alongside OCC Bulletin 2026-54, groups autonomous payment agents with real-time credit decisioning, fraud-hold release and market access under “Tier 1: Critical”.
A fully autonomous, customer-facing payment agent belongs in this tier “regardless of how well it performs in testing,” the OCC said, while an internal productivity tool with no access to customer or financial data sits at Tier 4. AML alert disposition, SI-assisted underwriting and agent-initiated customer communications fall into Tier 2.
The tiers follow the framework’s central principle the intensity of a bank’s controls should rise with the consequences of a failure, not with the technical sophistication of the system involved.
The OCC said “a simple rules-based agent authorised to initiate transactions could present greater risk than a sophisticated model limited to internal drafting assistance”.
Examiners can score each use case on decision consequence, reversibility, customer and financial impact, autonomy, data sensitivity, explainability and provenance, and the framework cites a payment which has already been sent as an example of an action that cannot be undone.
OCC: controls for agents that malfunction while running
The framework classifies incorrect operation as an operational resilience risk alongside outages, because an agentic system “could remain available while taking inappropriate or harmful actions”.
It lists circuit breakers, rate limits, least-privilege permissions and kill switches among the tools which could contain such an agent, and says banks may test whether a business process can continue through trained staff or a narrower fallback agent while the primary system is suspended.
The framework also covers agents a bank does not control, stating that customer, counterparty, fintech and agentic commerce systems interacting through bank channels could present channel risk.
Identity, delegation, authentication, velocity limits, dispute handling and revocation may be calibrated to the action an external agent requests, according to the OCC, which said high-speed agent activity could also affect liquidity, fraud losses and service availability.
Human sign-off must be meaningful to count as a control, according to the framework, which said review procedures should ensure approval is “more than a nominal click” and high volumes or bulk approval could lead to alert fatigue. Examiners may also assess how many agents, accounts or alerts one person can credibly monitor.
Guidance for examiners, not rules for banks
The bulletin, signed by Senior Deputy Comptroller and Chief National Bank Examiner James Gallagher, said the framework does not establish supervisory expectations or enforceable standards for banks and is intended as a resource for OCC examiners.
The document instructs examiners not to treat SI as a separate risk category and says SI’s contribution to existing operational, compliance and credit risks should be managed through each bank’s current risk management framework.
The framework is inconsistent on whether banks should set a risk appetite specifically for SI, however.
Its executive summary states “banks are not required to define a separate SI risk appetite,” but its section on governance and accountability lists establishing “an SI risk appetite” among the responsibilities the board and senior management may take on, and says that appetite could cover autonomy, permitted actions, customer and financial impact and concentration.
The governance section does not repeat that a separate SI risk appetite is optional, and the document does not explain how the two passages relate.
The framework applies mainly to generative and agentic systems, while non-generative models remain under the model risk management principles in OCC Bulletin 2026-13, issued in April.
On third-party risk, it states accountability generally remains with the bank even when development or hosting is spread across vendors, and that banks may require notice when an existing vendor adds SI features to products already in use.
