U.S. banking regulators, including the Federal Reserve, are questioning banks about advanced AI models and safeguards as officials assess cyber risks and possible threats to financial stability, six people familiar with the matter told Reuters on October 13. The inquiries cover whether banks use Chinese-developed technology, deploy AI agents in cyber defence and can control increasingly autonomous systems. Regulators are still gathering information and have not prescribed specific actions.

The Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation and the Fed are asking how banks limit, monitor and approve AI agents that identify, prioritize or respond to cyber threats. They are also asking whether banks can audit agents’ decisions, prevent them from exceeding their authority, keep humans involved in key decisions and shut autonomous systems down. The questions have gone to large, mid-size and smaller banks, according to people familiar with the inquiries.

In Europe, supervisors including the Bank of England and European Central Bank are pressing banks to improve recovery planning. Britain’s largest banks are being encouraged to examine “bare metal recovery” plans: independent systems that can restore operations if a bank’s main technology is compromised. Such systems are expensive to build and maintain, and UK authorities plan to work with the industry rather than introduce new requirements, the sources said. The ECB set an end-October deadline in July for lenders to submit plans against AI-enabled cyber threats, including improved backup and recovery.

The scrutiny follows warnings about risks from AI incidents. CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent and Anthropic’s Claude Code in a hack on South Korean banks. Reuters also reported that OpenAI-developed rogue agents were involved in a breach of Hugging Face. A senior executive at a large European bank said the damage to banking and financial markets could be major “within six months.”

European supervisors are also asking banks to map AI use across their businesses and outside providers, identify dependencies, and ensure systems can be switched off and restarted in a controlled way; some firms still have significant gaps, sources said. UK supervisors are asking banks to use frontier AI to find vulnerabilities and speed up patching. BCG’s Sukand Ramachandran said recovery matters as much as prevention, warning that without separate, clean copies of critical data, a serious attack could lock customers out of accounts and disrupt payments across the wider economy.

U.S. banking regulators, including the Federal Reserve, are questioning banks about advanced AI models and safeguards as officials assess cyber risks and possible threats to financial stability, six people familiar with the matter told Reuters on October 13. The inquiries cover whether banks use Chinese-developed technology, deploy AI agents in cyber defence and can control increasingly autonomous systems. Regulators are still gathering information and have not prescribed specific actions.

The Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation and the Fed are asking how banks limit, monitor and approve AI agents that identify, prioritize or respond to cyber threats. They are also asking whether banks can audit agents’ decisions, prevent them from exceeding their authority, keep humans involved in key decisions and shut autonomous systems down. The questions have gone to large, mid-size and smaller banks, according to people familiar with the inquiries.

In Europe, supervisors including the Bank of England and European Central Bank are pressing banks to improve recovery planning. Britain’s largest banks are being encouraged to examine “bare metal recovery” plans: independent systems that can restore operations if a bank’s main technology is compromised. Such systems are expensive to build and maintain, and UK authorities plan to work with the industry rather than introduce new requirements, the sources said. The ECB set an end-October deadline in July for lenders to submit plans against AI-enabled cyber threats, including improved backup and recovery.

The scrutiny follows warnings about risks from AI incidents. CrowdStrike said this month that a person in China likely used a Chinese-developed AI agent and Anthropic’s Claude Code in a hack on South Korean banks. Reuters also reported that OpenAI-developed rogue agents were involved in a breach of Hugging Face. A senior executive at a large European bank said the damage to banking and financial markets could be major “within six months.”

European supervisors are also asking banks to map AI use across their businesses and outside providers, identify dependencies, and ensure systems can be switched off and restarted in a controlled way; some firms still have significant gaps, sources said. UK supervisors are asking banks to use frontier AI to find vulnerabilities and speed up patching. BCG’s Sukand Ramachandran said recovery matters as much as prevention, warning that without separate, clean copies of critical data, a serious attack could lock customers out of accounts and disrupt payments across the wider economy.