Banking regulators have intensified efforts to curb growing risks associated with artificial intelligence (AI). Some insiders point to a potential threat to global financial stability stemming from cyberattacks on banks or from autonomous AI agents.
This heightened scrutiny is driven by a growing understanding that progress in advanced AI may require significant investment in post-cyberattack recovery, closer attention to banks' reliance on external technology providers, and, in some jurisdictions, the introduction of more formal regulatory guidelines, sources reported.
Three leading US regulators, including the Federal Reserve, are questioning banks about their use of advanced AI models. These questions include the use of Chinese technologies, the application of AI agents in cybersecurity, and the ability to control increasingly autonomous systems.
In Europe, supervisory bodies such as the Bank of England and the European Central Bank (ECB) are requiring banks to improve their recovery plans. They are concerned that rapid progress in AI could cause serious damage and disruptions to financial markets sooner than previously anticipated.
A senior executive at a major European bank also expressed concern about potential severe damage to banking and financial markets within six months.
Discussions about AI oversight have intensified amid industry warnings following recent incidents. JPMorgan CEO Jamie Dimon called on corporate leaders to join an industry group focused on the US to address AI-related issues.
Cybersecurity firm CrowdStrike reported this month that an individual in China likely used a China-developed AI agent and Anthropic's Claude Code to hack South Korean banks. Furthermore, autonomous AI agents developed by OpenAI were involved in a leak from the Hugging Face AI platform.
Warning Against Complacency
Anthropic researchers warned that increasingly powerful AI systems could eventually escape human control and pose an existential threat, prompting calls for stricter regulation.
The International Monetary Fund (IMF) issued a warning against 'complacency' in global financial markets on Tuesday, citing risks including the possibility of a cyberattack. It noted that a major attack on a critical service or financial institution could undermine confidence and urged policymakers to strengthen cybersecurity capabilities.
Banks are rushing to implement agentic AI capable of performing tasks with minimal human oversight while simultaneously facing challenges presented by new models, including IT vulnerabilities highlighted by Anthropic's Mythos model.
Michael Woodbridge, a cybersecurity partner at Grant Thornton based in London, stated: 'The adoption of AI often outpaces the ability to implement necessary controls.'
US inquiries focus on how banks are using agentic AI in areas like cybersecurity and whether AI agents are being used to detect, prioritize, and respond to threats.
Questions from the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Fed concern the limitations placed on these systems, how their actions are tracked and approved, and whether banks can clearly monitor and audit the decisions of AI agents.
Regulators are also investigating what safeguards exist to prevent agent overreach, whether humans remain involved in key decisions, and how banks can shut down autonomous systems.
The OCC, Fed, and FDIC declined to comment.
Through their inquiries, regulators are exploring specific issues related to advanced AI models, including autonomous agents, models developed by foreign companies, and new cyber risks. Three sources added that written and verbal inquiries to large, medium, and small banks show that regulators are focusing on vulnerabilities arising from banks' use of AI and the readiness of these banks to act.
Sources also noted that regulators are still gathering information and have not yet issued directives on what creditors should do.
UK supervisory authorities are separately urging the largest banks to examine so-called 'bare-metal' recovery plans. These systems are completely independent of the bank's core technological infrastructure and can take over in case of compromise of core operating systems. Creating and maintaining such systems is costly.
Recovery and Prevention
Instead of introducing new requirements, UK authorities intend to work with the industry. The Bank of England declined to comment.
In July, the ECB gave creditors until the end of October to develop plans to counter AI-related cyber threats, including improved backup and recovery.
Responding to questions about its AI regulatory strategy, the ECB referred to its July letter and the June speech by board member Frank Eldersson, who emphasized the need to create a sense of urgency, not panic, regarding threats.
The need for supervisory action became more pressing after European banks and regulators expressed disappointment this year over limited access to Mythos, amid concerns that US banks would gain first access to advanced models for testing.
Similar to their US counterparts, UK supervisory authorities are also asking banks to use advanced AI to identify vulnerabilities and accelerate patch deployment. One source added that creditors are currently coping well.
A third source reported that Eurozone banks are also asking to map how AI is used in their business and by third-party providers to understand key dependencies and ensure they can shut down and restart systems in a controlled manner. Significant gaps persist in some firms.
Sukand Ramachandran, Managing Director and Senior Partner at Boston Consulting Group, stated: 'For defense against attacks, rapid recovery is as important as prevention.'
Ramachandran added that without separately stored clean and secure copies of critical data, 'a serious attack could lock customers out of their accounts and disrupt payments across the wider economy.'
In South Africa, the Financial Sector Conduct Authority warned in December 2025 that the concentration of AI capabilities in the hands of a few third-party providers means that a cyberattack on one provider could cascade across the financial sector, while Absa stated that its protection against advanced AI cyber threats is also based on AI.