Bank regulators in the United States are asking hard questions about artificial intelligence this month, and the questions are not abstract. Three top U.S. regulators, including the Federal Reserve, are quizzing banks large and small about whether they use Chinese-developed technology, whether they deploy AI agents in cyber defense, and whether anyone can actually pull the plug if those systems start acting on their own.
According to cp24.com, the written and verbal inquiries have gone out to large, midsize and smaller banks alike, part of a broader effort reported by The Journal Record as regulators step up work to contain growing AI risks across the financial system. The core worry is agentic AI — software that can accomplish tasks with minimal human supervision — and whether banks have built in enough guardrails to keep it in check.
What Regulators Actually Want to Know
The questions go well beyond a simple yes-or-no on whether a bank has adopted AI. Regulators are asking what safeguards exist to prevent AI agents from exceeding their authority, whether humans stay involved in key decisions, and how autonomous systems can be shut down if something goes wrong, per the same cp24.com report. The inquiries also probe what system limits banks set internally, how agent actions get monitored and approved, and whether those decisions can be tracked and audited after the fact.
For now, the stance is more fact-finding than enforcement. Regulators are still gathering information and are not yet being prescriptive about what lenders should be doing, the outlet's sourcing indicates. The OCC, the Federal Reserve and the FDIC all declined to comment when asked about the inquiries, and even with that caution in mind, significant gaps reportedly remained in AI preparedness at some firms.
A Cyberattack Pattern Already Playing Out
The scrutiny lands against the backdrop of a real-world case that illustrates exactly what regulators fear. CrowdStrike said a hacker likely based in China used ARTEX, a recently released open-source tool developed in China, alongside AI tools including Anthropic's Claude Code, in a campaign against South Korean financial organizations, according to nytimes.com. That breach reportedly exposed the personal credit information of thousands of customers.
The episode speaks to a broader tension global watchdogs have flagged. Advanced AI is amplifying cyber threats that can undermine financial stability, the International Monetary Fund has warned, even as financial institutions increasingly rely on AI-supported tools to detect threats, prevent fraud and respond to incidents. The Bank for International Settlements has made a similar point: frontier AI models have substantially narrowed the window between the discovery of cyber vulnerabilities and their exploitation by criminals, according to a September speech posted on bis.org — even as those same models can strengthen banks' defenses through faster anomaly detection and automated response.
Europe Sets Deadlines, UK Pushes Bare-Metal Backups
European supervisors are moving on a parallel track, pressing banks to improve recovery plans and map their AI use across both internal operations and third-party providers. The European Central Bank gave lenders an end-of-October deadline, set in July, to produce plans countering AI-enabled cyber threats, including improved backup and recovery, per cp24.com's reporting. Euro-zone banks are also being asked to understand their key technology dependencies and ensure they can switch off and restart systems in a controlled manner.
Generative AI adoption is already widespread on the continent: nearly nine out of ten significant euro-area banks use it, according to a speech posted on ecb.europa.eu, though only 5% of surveyed asset managers said they had given AI autonomous or semi-autonomous authority over investment recommendations or trades. That same ECB material notes that frontier-model development is concentrated in the United States and China, and that a U.S. export-control directive in June led one provider to suspend European access to two advanced models — access to a general-use model was reportedly restored weeks later.
Across the English Channel, UK supervisors are encouraging the largest banks to examine bare-metal recovery plans — systems independent of a bank's main technology setup that can activate if primary operating systems are compromised, though building and maintaining them is expensive. The Bank of England, the Financial Conduct Authority and HM Treasury said in a joint statement that firms and financial-market infrastructures need to plan for and mitigate cybersecurity risks posed by frontier AI, including adopting automated, AI-enabled defenses that can operate at a speed comparable to AI-driven attacks. The authorities were careful to frame this as reinforcement rather than new rules, saying the statement is not intended to introduce new expectations.
Why the Urgency Now
UK supervisors are also asking banks to use frontier AI itself to identify vulnerabilities and accelerate patching, and one source told cp24.com that lenders were doing a good job on that front. Still, the overall posture from regulators on both sides of the Atlantic reflects a recognition that frontier AI may require costly cyber recovery investments, closer attention to dependencies on outside technology providers, and more formal guidance in some jurisdictions. The Bank of England itself declined to comment on the specifics of its engagement with banks.
For now, the message from regulators is less about dictating specific fixes and more about making sure banks can answer basic questions: who is watching the AI, and can someone turn it off.
