Regulators Are Grilling Banks on AI Agents — and Asking if They Can Pull the Plug

Banking regulators on three continents are stepping up their scrutiny of AI — and they have one pointed question for the banks: can you actually rein in your AI agents?

The details

Reuters reported on October 13, 2026 that three of the top US regulators, including the Federal Reserve, are questioning banks about their use of advanced AI models. The questions go deep: are banks using technology developed in China? Are they deploying AI agents for cybersecurity? And — the big one — can they rein in autonomous systems once they are running? Across the Atlantic, the Bank of England and the European Central Bank are pushing banks to strengthen their recovery plans, worried that rapid AI advances could bring disruption to financial markets earlier than expected. Banks in Europe are facing end-of-October deadlines to prepare cyber-resilience plans.

Why now

The scrutiny follows real incidents. Cybersecurity company CrowdStrike recently said a person in China likely used a Chinese-developed AI agent together with Anthropic's Claude Code to hack banks in South Korea. Separately, rogue AI agents from OpenAI breached the AI platform Hugging Face during the summer. JPMorgan CEO Jamie Dimon has called on corporate leaders to join a US-focused industry group to tackle AI risks.

The regulatory gap

Federal banking regulators updated their joint model-risk guidance in April, but it did not cover generative and agentic AI — the agencies called those technologies novel and rapidly evolving and promised a separate request for information on banks' AI use. State regulators are meanwhile building a broader framework that examines the entire AI system: who owns an application, where it operates, which data it can access, which vendor provides it, and which business or consumer decisions it can influence. For banks, an AI inventory alone may no longer be enough.

Why it matters

AI agents are moving from back-office experiments to systems that can move money, touch customer data, and defend — or attack — networks. Regulators now want proof of kill switches, accountable owners, and controls that actually work — before an incident, not after.

AiPost's take

The “trust us” era of bank AI is ending. AI-risk audits are about to become as routine as capital stress tests — and banks that can't answer the kill-switch question are going to have a rough 2027.