Banking regulators target AI risks amid financial stability fears

NEW YORK CITY, New York: Banking regulators in the U.S. and Europe are intensifying scrutiny of artificial intelligence risks as increasingly autonomous systems raise concerns about cyberattacks and potential disruption to global financial stability, according to six people familiar with the matter. The increased scrutiny could require banks to invest more heavily in cyber recovery, examine their dependence on outside technology providers and, in some jurisdictions, comply with more formal regulatory guidance. Three major U.S. regulators, including the Federal Reserve, are questioning banks about their use of advanced AI models, two people told Reuters. The inquiries include whether banks deploy Chinese-developed technology, use AI agents for cyber defense and can control increasingly autonomous systems, three people said. In Europe, supervisors including the Bank of England and the European Central Bank are pressing banks to strengthen recovery plans amid concerns that rapid advances in AI could disrupt financial markets sooner than previously expected. A senior executive at a large European bank said they were also concerned about potentially major damage to banking and financial markets within six months. "The adoption of AI is often outpacing the ability to put the controls in place," said Michael Woodbridge, London-based cybersecurity partner at Grant Thornton. Banks are increasingly adopting agentic AI, which can perform tasks with minimal human supervision. U.S. inquiries are focusing particularly on how banks use such systems in cybersecurity, including whether AI agents identify, prioritize, and respond to threats. The Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the Federal Reserve are asking what limits banks place on the systems, how their actions are monitored and approved, and whether AI decisions can be clearly tracked and audited. Regulators also want to know what safeguards prevent agents from exceeding their authority, whether humans remain involved in important decisions, and how banks can shut down autonomous systems. The OCC, Fed and FDIC declined to comment. Regulators are still gathering information and have not yet prescribed what lenders should do, according to the people familiar with their thinking. British supervisors are separately encouraging the largest banks to examine "bare metal" recovery plans, which operate independently of their main technology systems and can be activated if primary systems are compromised. The Bank of England declined to comment. The ECB gave lenders an end-October deadline in July to produce plans to counter AI-enabled cyber threats, including improvements to backup and recovery systems. Eurozone banks are also being asked to map how AI is used across their businesses and third-party providers, identify key dependencies, and ensure systems can be shut down and restarted in a controlled manner. Significant gaps remain at some firms, one person said. "To protect against attacks, rapid recovery matters as much as prevention," said Sukand Ramachandran, managing director and senior partner at BCG. Without separate, clean, secure copies of critical data, "a serious attack could lock customers out of their accounts and disrupt payments across the wider economy," Ramachandran said.