AI Agents and Super Intelligence: the American banking watchdog publishes its first supervisory framework

Coin Encyclopedia Improve your knowledge of cryptos

An AI agent is software that no longer just answers a question but carries out tasks for you: compare offers, fill out a form and now pay. The regulator does not prohibit anything, it gives its inspectors a reading guide.

The 22-page document, distributed under bulletin 2026-54 and signed by James Gallagher, head of the agency's examiners, is primarily aimed at those officials who audit banks on site. Reuters sees this as the first instruction of this type ever addressed to American banking inspectors. And the OCC warns that its text “does not establish any new prudential expectations” for establishments.

The central message is contained in one line. AI is not a separate risk category and banks do not have to define a separate risk appetite for it. It can be read through the grids that already exist (model management, technology, compliance, operational risk) and it is during these routine examinations that inspectors will have to ask the question of the software. A detail that will make you smile: the regulator never writes “artificial intelligence” but “Super Intelligence”, abbreviated SI, the vocabulary imposed by a presidential decree of October 2.

Three criteria structure the analysis, and none relates to the technical sophistication of the model. The text considers the potential consequences of a failure, the transfer of decision to the machine and the degree of human control that remains. Cross-reference them and you get four indicative risk tiers, based on Decrypt’s reading of the document. At the top are autonomous payment agents and real-time credit decisions, because a transfer that goes away doesn't come back.

On October 13, JPMorgan Chase cut off direct access to its customer accounts to external agents, led by Muse de Meta and Instinct. Jamie Dimon summed up the house doctrine two days later: “You don’t want rogue agents”. Morgan Stanley in turn blocked it, Bank of America and Citi restricted access.

The OCC framework endorses this distrust without ever mentioning these banks. It places agents operated by clients, fintechs or other companies in the chapter of operational resilience and expects banks to provide identity verification, delegated permissions, transaction limits and the ability to cut off access. In terms of safeguards, the document cites circuit breakers, flow limits and an emergency stop button. The problem is not theoretical. Researchers from Cornell and Yale showed last week that crypto payment agents had granted themselves spending limits higher than those intended by their designers.

While banks lock down, crypto opens the floodgates. Coinbase's x402 protocol, which allows an agent to settle an API in USDC, recorded 138 million payments on Base in one year according to Chainalysis. Cloudflare distributes wallets to its agents and Stripe has been sending to any wallet in more than 160 countries since Wednesday. These rails do not have an examiner or bulletin 2026-54.

Machine-translated from French