The Office of the Comptroller of the Currency (OCC) has published supervisory guidance for examiners evaluating how lenders deploy super intelligence (SI) and agentic SI across day-to-day banking operations.
Regulators confirmed that SI will not form an isolated supervisory category, noting institutions will not be required to maintain an independent risk appetite for the technology.
Go deeper with GlobalData
Access deeper industry intelligence
Experience unmatched clarity with a single platform that combines unique data, AI, and human expertise.
Instead, examiners will scrutinise deployments through 16 framework components structured across six core pillars: purpose, risk, control, oversight, resilience, and assurance.
Under defined purpose and permitted use, lenders must formally document operational boundaries, identifying permitted actions, accessible systems, and constraints regarding what tools are “not designed to do”.
For Risk classification and criticality assessment, institutions are expected to categorise use cases based on the potential “consequences of failure and transfer of agency”, weighing reversibility, decision autonomy, and data exposure.
Human-in-the-loop and human-on-the-loop controls requires calibrated oversight mechanisms, ensuring personnel retain the “practical ability to intervene” before or during automated execution.
Under governance & accountability, executive boards must assign distinct operational owners and enforce approval checkpoints across “meaningful lifecycle gates”.
Addressing technical opacity, model risk management extensions notes that non-deterministic systems lacking “directly traceable decision logic” may require alternatives to traditional champion-challenger benchmarks, including reference sets, alternative benchmarks, and expert reviews.
Data governance demands scrutiny of lineage, representativeness, and risks linked to “synthetic generation”.
In parallel, Privacy addresses external processing environments that are “not fully transparent to the bank”, alongside unapproved data retention and attribute inference.
Under compliance, the OCC cautioned that an agent’s speed, opacity, and autonomous “capacity to act” complicate oversight, even though underlying statutory obligations remain unchanged.
Third-party & vendor risk highlights operational exposures “not fully addressed by conventional service-level and information-security reviews”, mandating targeted diligence when external models influence customer outcomes.
Operational resilience requires fail-safes against “incorrect operation” and agents taking “inappropriate or harmful actions”, demanding structured containment, fallback, and remediation protocols.
Under Cybersecurity, the framework treats the “breadth of agent permissions” and connected tooling as an expanded attack surface, susceptible to prompt injection and compromised non-human identities.
Performance monitoring mandates real-time production observability calibrated to detect “low-frequency events that could cause material harm”.
Addressing stochastic variation, Testing must account for “non-determinism” and “continual redevelopment” rather than relying on single expected outcomes.
Documentation & auditability directs lenders to maintain verifiable records capable of reconstructing outputs, particularly when models “cannot produce a rule-based rationale”.
For internal audit & independent challenge, supervisory teams must maintain organisational segregation to deliver an “effective challenge” against both developers and validation units.
Finally, reporting & transparency requires structured escalation pathways tracking significant modifications, control exceptions, and instances of “customer harm”.
The guidance incorporates a graduated risk-tiering methodology, calibrating compliance from low-risk internal productivity tools at Tier 4 up to Tier 1 for any “fully autonomous, customer-facing payment agent”.
