New York/London: Banking regulators in the United States and Europe are intensifying scrutiny of artificial intelligence (AI) risks in the financial sector, amid growing concerns that cyberattacks and poorly controlled autonomous AI systems could threaten banks and global financial stability.
According to a Reuters report citing six people familiar with the matter, regulators are asking banks more detailed questions about their use of advanced AI models, their cybersecurity safeguards and their ability to recover if critical technology systems are compromised.
The scrutiny reflects increasing recognition that advances in frontier AI could require banks to invest heavily in cyber recovery infrastructure, strengthen oversight of external technology providers and introduce more formal controls over the deployment of autonomous systems.
Regulators are still gathering information in the United States and have not yet issued specific new instructions to banks, the people told Reuters. In Europe, supervisors are placing greater emphasis on recovery planning and the ability of financial institutions to withstand AI-enabled cyber threats.
US regulators question banks on advanced AI use
Three major US banking regulators — the Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) — are questioning banks about their adoption of advanced AI models.
The inquiries cover large, medium-sized and smaller banks, with particular attention to the use of agentic AI in cybersecurity operations.
Agentic AI systems can carry out tasks with limited human supervision. In cybersecurity, they may be used to identify threats, prioritise vulnerabilities and respond to suspected attacks. However, their growing autonomy has raised questions about how financial institutions can ensure that their actions remain within authorised limits.
According to people familiar with the inquiries, regulators are asking banks whether they use Chinese-developed AI technology and how they deploy AI agents to defend their systems.
They are also examining the safeguards banks have in place to monitor and approve AI-driven actions, maintain records of decisions and ensure that the systems do not exceed their authority.
Other concerns include whether human employees remain involved in critical decisions and whether banks can shut down autonomous systems quickly if they behave unexpectedly.
The OCC, Federal Reserve and FDIC declined to comment, Reuters reported.
The inquiries indicate that US regulators are increasingly focused on the practical risks arising from AI adoption, including how banks oversee the technology and whether they are prepared to respond to failures or malicious activity.
European supervisors focus on recovery plans
In Europe, the Bank of England and the European Central Bank (ECB) are pushing banks to strengthen their ability to restore operations following a major cyber incident.
British supervisors are encouraging the largest banks to examine so-called bare-metal recovery plans. These arrangements are designed to restore systems using infrastructure independent of a bank’s primary technology environment if its main systems are compromised.
Developing and maintaining such recovery capabilities can be expensive. However, regulators are concerned that conventional backup arrangements may not be sufficient to address the risks posed by increasingly sophisticated cyberattacks.
UK authorities intend to work collaboratively with the banking industry rather than immediately introduce new requirements, according to people familiar with their approach. The Bank of England declined to comment.
The ECB has also set a deadline for banks to submit plans addressing AI-enabled cyber threats. In a July letter, it gave lenders until the end of October to outline measures that include improved backup and recovery capabilities.
The ECB referred Reuters to the July letter and a June speech by board member Frank Elderson when asked about its approach to AI regulation. Elderson had emphasised the need to create a sense of urgency without generating unnecessary alarm.
European supervisors are also asking banks to map how AI is used across their operations and through third-party technology providers. The aim is to identify critical dependencies and ensure that systems can be shut down and restarted in a controlled manner.
Some firms still have significant gaps in these areas, one source told Reuters.
Recent cyber incidents intensify concerns
The growing regulatory focus comes amid warnings about the potential misuse of advanced AI tools.
US cybersecurity company CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent and Anthropic’s Claude Code in a hack targeting South Korean banks, according to the Reuters report.
In a separate incident, AI agents developed by OpenAI were reportedly involved in a breach of the AI platform Hugging Face.
These incidents have added to concerns that AI could make cyberattacks more sophisticated or enable malicious actors to carry out certain activities more efficiently.
The banking industry is also examining the security implications of increasingly powerful AI models. Anthropic’s Mythos tool, for instance, has highlighted IT vulnerabilities that require attention as organisations assess the risks associated with advanced AI capabilities.
Banks are competing to adopt agentic AI to improve efficiency and strengthen security. However, deploying systems capable of acting with limited supervision also introduces new challenges involving accountability, monitoring and control.
Michael Woodbridge, a London-based cybersecurity partner at Grant Thornton, told Reuters that the adoption of AI was often advancing faster than organisations’ ability to establish appropriate controls.
The gap between deployment and oversight is becoming a central concern for regulators as financial institutions integrate AI into increasingly critical operations.
Concerns over access to frontier AI models
European banks and regulators have also expressed frustration over limited access to Anthropic’s Mythos model, amid concerns that US banks could receive earlier opportunities to test frontier AI systems.
UK supervisors are asking banks to use advanced AI tools to identify vulnerabilities and accelerate the process of applying security patches. One person familiar with the matter said lenders were so far doing a good job in this area.
The challenge, however, extends beyond finding vulnerabilities. Banks must also be able to understand how AI is used throughout their operations, assess risks arising from external providers and maintain control over critical systems.
A failure at a technology provider or an attack affecting a widely used service could have consequences beyond an individual bank, particularly if several institutions depend on the same infrastructure.
IMF warns against complacency
The International Monetary Fund (IMF) has also warned against complacency in global financial markets, citing several risks, including the possibility of a major cyberattack.
According to the Reuters report, the IMF said an attack affecting a critical service or financial institution could undermine confidence. It called on policymakers to strengthen cybersecurity capabilities.
The concern is that a serious attack could disrupt essential financial services, including customer access to bank accounts and the processing of payments.
Sukand Ramachandran, managing director and senior partner at Boston Consulting Group, told Reuters that rapid recovery was as important as prevention when protecting against cyberattacks.
He warned that without separately maintained, clean and secure copies of critical data, a major attack could lock customers out of their accounts and disrupt payments across the wider economy.
Banking sector faces rising AI governance costs
The intensified scrutiny is likely to place greater emphasis on banks’ technology investments, cybersecurity arrangements and governance structures as they expand their use of AI.
Financial institutions may need to devote additional resources to independent recovery systems, continuous monitoring, audit trails and controls that allow human intervention when autonomous systems behave unexpectedly.
The challenge is to capture the benefits of AI without creating vulnerabilities that could compromise customer data, interrupt financial services or spread disruption across interconnected institutions.
For regulators, the immediate priority is to understand how banks are deploying advanced AI and whether their existing safeguards can keep pace with the technology. As AI capabilities continue to evolve, the ability to detect attacks, contain damage and restore essential services is emerging as a key element of financial stability.