US bank supervisors are asking banks, in writing and in conversation, how they control AI agents. According to Reuters reporting, the Federal Reserve, OCC and FDIC want to know what limits apply to each system, who monitors and approves its actions, whether the bank can track and audit its decisions, what keeps an agent within its authority, whether people stay involved in key decisions, how the bank would shut autonomous systems down, and whether it uses Chinese-developed technology or AI agents in cyber defense. This guide sets out the seven questions, what examiners appear to be testing, the evidence a bank should be able to show, and how Madison, Lyzr’s agentic GRC product for US banks and credit unions, and Opencontroller help a bank answer.
TL;DR
- What is happening: Reuters reported on October 13, 2026 that the Fed, OCC and FDIC are questioning banks of all sizes about AI agents. Sources described it as information gathering, not new expectations.
- The seven questions: limits, monitoring and approval, audit trail, authority, human involvement, shutdown, and Chinese-developed technology and cyber defense use.
- How risk is judged: reported OCC examiner guidance (November 4, 2026) focuses on the consequences of AI-driven mistakes and the level of autonomy, not model sophistication.
- Why now: SR 26-2 places generative and agentic AI outside its scope, so banks answer under their own governance.
- The proof pack: an inventory, authority limits, approval points, decision logs, a tested shutdown path and a provenance record for each agent.
- Our answer: Madison holds agents, vendors and models as governed objects with owners and evidence, and answers examiner requests from the chain behind them. Opencontroller governs the agents at runtime.
Who is asking banks about AI agents, and is it a rule?
Not yet a rule. What exists is a mix of reported supervisory inquiries, one reported piece of examiner guidance and a state framework. None of them is an enforceable AI-agent regulation, and the April 2026 federal model risk guidance, SR 26-2, leaves generative and agentic AI outside its scope. Banks are being asked to explain their own governance. We cover that gap in SR 26-2 and the banking AI governance gap.
| Signal | Date | What it says | Status |
|---|---|---|---|
| Fed, OCC and FDIC inquiries to banks | Reported October 13, 2026 | Written and verbal questions to large, midsize and smaller banks about AI agents. Sources described it as “information gathering rather than a set of new expectations”. | Reported by Reuters from unnamed sources. Agencies declined to comment. |
| OCC guidance for examiners | Reported November 4, 2026 | Supervisors should not treat AI as distinct from other risks, and should look at the consequences of AI-driven mistakes and the level of autonomy. | Not legally binding. Reported from a copy Reuters saw; full text not verified. |
| CSBS AI Supervisory Framework | September 16, 2026 | Five documents for state examiners, including a worksheet that tiers a bank’s AI uses, and eight suggested questions. | Discretionary. Also a resource for banks to prepare. |
| SR 26-2 | April 17, 2026 | Generative and agentic AI are outside scope. Banks’ own risk management should govern them. | Supervisory guidance. |
| Interagency request for information | Promised, no date | A request for information on model risk management and AI. | Not issued as of late October 2026, per ComplexDiscovery. |
What are the seven questions regulators ask banks about AI agents?
The questions below follow Reuters’ reporting on the Fed, OCC and FDIC inquiries as relayed by two secondary summaries. They are not an official checklist. The third column is our reading of what each is really testing.
| # | Reported question | What it is testing | Evidence to show |
|---|---|---|---|
| 1 | Do you use Chinese-developed technology? | Provenance and dependency of the models and tools behind each agent. | A register of base model, developer and hosting location for each AI vendor and agent. |
| 2 | Do you use AI agents in cyber defense, such as threat identification and response? | Whether agents sit in high-consequence security roles and could themselves be exploited. | An inventory flag for security agents, their permissions, and how they are tested against misuse. |
| 3 | What limits apply to your systems, and how are their actions monitored and approved? | Defined scope and a real approval path. | A written permission scope per agent, approval points, and monitoring records. |
| 4 | Can you track and audit the decisions your agents make? | Traceability from request to action. | A retained log of actions and approvals per agent, retrievable on request. |
| 5 | What prevents an agent from exceeding its authority? | Technical enforcement, not only policy. | Controls enforced at the point of action, such as per-tool limits and spending ceilings. |
| 6 | Do people stay involved in key decisions? | Human accountability for high-impact actions. | Named approvers, separation of duties and escalation rules. |
| 7 | How would you shut down autonomous systems? | Containment speed and reliability when something goes wrong. | A tested shutdown path that works from outside the agent and preserves evidence. |
How do examiners judge the risk of an AI agent?
The reported OCC guidance for examiners points to consequences, not sophistication. As Reuters summarised it, supervisors should not treat AI as distinct from other risks, banks are not expected to set separate risk parameters for AI, and examiners should consider how a lender uses AI and the size and complexity of the lender. The example given is that a simple AI agent authorized to initiate transactions may be riskier than a sophisticated model used internally. Higher-risk uses may call for greater restrictions on autonomy or more direct human oversight.
State examiners have a related tool. The CSBS framework includes a worksheet that sorts a bank’s AI uses into three tiers, from internal use with human-reviewed outputs to direct consumer outcomes with limited human review. Its suggested questions ask whether the bank uses AI and where, whether AI comes from vendors or is embedded in vendor products already in use, whether it uses generative AI, whether it classifies uses by risk, and whether sensitive information passes through AI.
| CSBS tier | Characteristics | What it implies for AI agents |
|---|---|---|
| Tier 1 | Internal use, human-reviewed outputs, limited consumer impact and data sensitivity, low potential harm. | Light governance, still on the inventory. |
| Tier 2 | Consumer-facing or decision-support role, moderate data sensitivity, exception-based human oversight. | Defined scope, approval for changes, retained logs. |
| Tier 3 | Direct consumer outcomes, sensitive personal data, limited human review, significant reliance or material potential harm. | Tightest limits, human approval for high-impact actions, tested shutdown. |
What does a good answer on shutdown look like?
A wall switch nobody has tested is not an answer. A credible shutdown path has four properties:
1. Fast.
One action, taken in minutes, with a named person who is allowed to take it. Test it, and record the time.
2. Outside the agent.
It must work without the agent’s cooperation: revoke credentials and access from outside, so a misbehaving or compromised agent cannot refuse.
3. Reversible.
A pause that can be lifted after review is more likely to be used than a deletion that destroys the system.
4. Evidence kept.
Stopping must not erase logs, versions and configuration, because the first question afterwards is what happened.
What evidence should a bank have ready?
A Grant Thornton adviser told Reuters that the adoption of AI is often outpacing the ability to put controls in place. The way to close that gap before an examiner asks is to assemble a proof pack for each agent that can move money, change records or touch production systems, plus a lighter record for the rest.
Step 1: Inventory every agentList every agent, including vendor-built agents inside licensed software, with an owner, a risk tier and the data it reaches. See AI agent inventory for banks.
Step 2: Write down authority limitsFor each agent, record the tasks, transaction limits and tools it may use. Enforce them where the agent acts, not only in a policy.
Step 3: Name the approversDefine who approves changes and high-impact actions, with separation of duties so a requester cannot approve their own request.
Step 4: Keep decision logsRetain a record of what each agent did, why, and which person approved or stopped it, retrievable on request.
Step 5: Test the shutdown pathRun it, time it, and confirm it revokes access from outside the agent and keeps the evidence.
Step 6: Record provenanceAsk every material AI vendor for the base model, developer and hosting location, and record the answers. Write a board-approved framework that covers agents.
What are regulators outside the US saying?
The US questions sit alongside a wider pattern. The summary below comes from BankingNewsAI, a commercial aggregator that links to primary sources. We have not checked each item against the originals, so verify before citing. We did not research the Reserve Bank of India’s position and do not describe it here.
| Regulator | Reported signal |
|---|---|
| FCA (UK), October 19, 2026 | Agentic AI may need stronger controls because it can operate more independently. Recommends a central agent inventory and governance before deployment. |
| MAS (Singapore), October 7, 2026 | AI risk management guidelines apply to generative AI and AI agents, with board oversight, a use-case inventory and risk-proportionate controls. |
| HKMA (Hong Kong), October 2026 | Notes a shift from human-in-the-loop to human-on-the-loop oversight, and mentions possible kill switches and a central agent registry. |
| EU AI Act | Article 14 requires human oversight for high-risk systems, and deployers must keep logs. High-risk obligations for stand-alone systems are expected from December 2, 2027. |
Source: BankingNewsAI regulation page, last updated November 2, 2026. Aggregator, not a regulator.
How does Madison help a bank answer?
Madison is Lyzr’s agentic GRC product for US banks and credit unions. It holds regulation, obligations, policies, procedures, controls, tests, findings and evidence as one connected model, and it holds vendors, models and agents as governed objects on the same map, with owners and evidence attached. Third-party and AI oversight, and examinations and issues, are live now.
For a supervisory inquiry, the useful part is the chain: a request is answered from the chain behind it, with the citation trail attached, rather than assembled again under a deadline. Agents propose, a named person decides, and the decision is signed against the exact version.
The seven questions and how Madison approaches them
| Question | What the bank needs | How Madison approaches it |
|---|---|---|
| 1 · Chinese-developed technology | A provenance record for each AI vendor and model. | Vendors and models are held as governed objects with owners and evidence, so the answer sits with the vendor’s record. Ask any vendor, including us, for base model, developer and hosting details. |
| 2 · Agents in cyber defense | A flag and tier for security agents. | Agents are on the same map as the policies and controls they relate to, so security agents can be found, owned and tested like any other. |
| 3 · Limits, monitoring and approval | Written limits and an approval path. | Every consequential output is a recommendation waiting on a named person to accept, amend or reject. Madison reads from your systems and writes nothing back to your core banking system. |
| 4 · Track and audit decisions | A retrievable decision record. | Every decision is signed and recorded against the exact version approved, with the signer’s role at the time. Outputs trace back to the rule text they came from. |
| 5 · Staying within authority | Enforcement, not only policy. | Madison does not act on its own and does not decide whether the bank complies. It maps, traces, links and evidences. |
| 6 · Humans in key decisions | Named accountability. | Authority is bound to role. The record holds the role the signer held at the time. |
| 7 · Shutdown | A tested containment path. | Governed at the agent layer by a control plane such as Opencontroller (below). Madison shows which policies, procedures and controls the AI tool sits under, so the impact of stopping it is known. |
Beyond the seven questions: the chain an examiner follows
| What an examiner asks next | What Madison provides |
|---|---|
| Which policy covers this AI use? | The policy that carries the duty, with coverage gaps shown: a duty with no policy, or a policy with no control. |
| Which control tests it, and what did it find? | Tests, findings, remediation and evidence held on the same chain, in both directions. |
| Show me the history of this issue. | Requests, findings and matters in one register across every source. |
| Who signed off? | A named signature on an exact version. |
For the methods behind this, see how to map policies to controls with an agent.
How does Opencontroller help at runtime?
Madison holds the record of what the bank said it would do. Opencontroller by Lyzr is the control plane that governs the agents themselves while they run: it registers each agent, scopes what it can reach, requires approvals, records what it did and can stop it. It runs in your own cloud account and complements, rather than replaces, your GRC and model risk tools.
| Question | How Opencontroller by Lyzr helps |
|---|---|
| 1 · Provenance | Model access runs through a gateway with virtual keys per organisation, team or agent, each with its own allowlist, so approved model providers are a setting, not a hope. |
| 2 · Cyber defense agents | Discovery across clouds, clusters and devices finds unsanctioned AI clients and MCP configurations, and per-agent network egress policy limits where an agent can reach. |
| 3 · Limits and approval | Each agent carries its own permission set. A tool is granted to an agent, not ambient, and policy can read tool arguments, so a transfer limit and an approved destination list are expressible. Budgets reject calls when spent. |
| 4 · Audit | A signed audit trail covers agent lifecycle events, every model call and every tool execution, with approver identity on every promotion. Request traces use OpenTelemetry GenAI conventions. |
| 5 · Staying in authority | Enforcement is at the action: every model call, tool call and egress attempt passes a policy decision carrying the agent’s identity. Delegation records the user an agent acts for and limits chain depth. |
| 6 · Humans involved | Approvals for publishing, modifying, disabling and retiring an agent. The approver cannot be the requester, including owners and administrators. |
| 7 · Shutdown | Quarantine is a reversible incident stop: calls to the agent are refused at the gateway while versions, configuration and history stay intact, with no redeploy to reverse it. It applies to externally hosted agents too. |
From the Lyzr Agent Control Plane Capability Reference. A gateway governs traffic that passes through it, so making it the only path relies on egress enforcement and discovery, which is why they are deployed together.
For the registry concept in depth, read the AI agent registry guide and AI agents for mid-size banks.
Answer the seven questions before an examiner asks
Bring your policy library and your list of AI agents to a working session. We will show where each sits on the map, where coverage has gaps and how Opencontroller keeps the agents accountable.
Frequently asked questions
What are regulators asking banks about AI agents?
Reuters reported on October 13, 2026 that the Federal Reserve, the OCC and the FDIC have asked banks of all sizes, in writing and verbally, about AI agents. The reported themes are Chinese-developed technology, use of agents in cyber defense, limits and how actions are monitored and approved, whether decisions can be tracked and audited, what stops an agent exceeding its authority, where humans sit in key decisions, and how autonomous systems can be shut down.
Which regulators are asking about AI agents?
The reporting names the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation. State supervisors are also active: the Conference of State Bank Supervisors published a discretionary AI Supervisory Framework on September 16, 2026.
Are these questions a new rule or a checklist?
No. People familiar described the contacts as information gathering rather than a set of new expectations, and the agencies declined to comment. The seven themes are a reported pattern, not an official examination checklist. Treat them as a preview of what an examiner may ask.
What is the OCC’s examiner guidance on AI?
Reuters reported on November 4, 2026, from a copy it saw, that the OCC has issued its first guidance on how examiners review AI. It is described as not legally binding, as treating AI like other risks rather than as a separate category, and as focused on the consequences of AI-driven mistakes and on autonomy. We have not verified the full text.
What is a kill switch for AI agents?
A kill switch is a way to stop an agent quickly, from outside the agent itself, without losing its configuration or history. In practice it means refusing the agent’s calls at a control point, recording who stopped it and why, and being able to reverse the stop once the incident is understood.
What does consequence-based AI risk mean?
It means supervisors look at what happens if an AI system is wrong or acts beyond its limits, rather than at how sophisticated it is. Reuters’ description of the OCC guidance says a simple agent authorized to initiate transactions may carry more risk than a sophisticated internal model, and that higher-risk uses may call for tighter limits on autonomy or more direct human oversight.
Why are regulators asking about Chinese-developed AI?
It is one of the seven reported themes, and the reporting does not explain the reasoning in detail. Banks should be able to say which models and components their agents use, who supplies them and where they run. That depends on a current inventory of models, vendors and agents.
What is the CSBS AI Supervisory Framework?
It is a discretionary framework from the Conference of State Bank Supervisors, dated September 16, 2026. Banking Dive describes five documents, a three-tier worksheet and eight suggested questions. Nearly 80% of the 4,233 FDIC-insured institutions are state-supervised, so state examiners may use it.
How should a bank prepare for these questions?
Build a current inventory of agents with named owners, write down each agent’s permitted actions and limits, define approval points for consequential actions, keep an audit trail you can retrieve, test the shutdown path and keep the evidence together. The proof pack section of this guide sets out six steps.
Does SR 26-2 cover AI agents?
No. SR 26-2, dated April 17, 2026, states that generative and agentic AI models are outside its scope. That leaves governance to the bank’s own practices, which is why the questions about limits, oversight and shutdown matter.
How does Madison help with regulator questions about AI agents?
Madison is Lyzr’s agentic GRC product for US banks and credit unions. It treats vendors, models and agents as governed objects with owners and evidence, and answers examiner requests from the connected chain of regulation, policy, control, test and evidence behind them. Agents propose and people approve. Madison does not replace runtime controls on the agents themselves.
How does Opencontroller help with regulator questions about AI agents?
Opencontroller by Lyzr is the agent control plane. It registers each agent with an immutable ID and owner, authorizes each tool call, requires approvals with separation of duties, keeps a signed audit trail and can quarantine an agent reversibly. It runs in your own cloud account. Confirm current capabilities with Lyzr.
Book A Demo: Click Here
Join our Slack: Click Here
Link to our GitHub: Click Here
Got a use case in mind?
8 weeks from use case to agents running in production.
Platform, people and FDEs, all in. Bring your environment. We'll co-build and stay until it's live.
Talk to UsFree resource
101 AI Agents Use Cases
100+ production-ready AI agent use cases across Marketing, Sales, HR, Banking, Insurance, Operations and a lot more
Download now
