In October 2026 US bank regulators started asking banks direct questions about AI agents: what limits them, how their actions are approved and audited, whether humans stay in key decisions, and how to shut them down. No binding rule exists yet. Federal model-risk guidance (SR 26-2) explicitly excludes generative and agentic AI, so examiners are filling the gap.
That leaves banks, and the fintechs that sell to them, in an awkward spot: the questions are concrete, but the rulebook is not written. This post sets out what is actually on the record as of 16 October 2026, from the Federal Reserve, the Conference of State Bank Supervisors and Reuters' reporting, and then turns those questions into a design checklist for anyone building an agent that touches money, credit or customer data.
According to Reuters' report of 13 October 2026, citing six people familiar with the matter, the OCC, the FDIC and the Federal Reserve are asking banks, in writing and verbally:
Sources told Reuters the regulators are still gathering information and are not yet prescriptive. The three agencies declined to comment.
Because it was written to leave them out. On 17 April 2026 the Fed, OCC and FDIC issued revised model risk management guidance, published by the Fed as SR 26-2, replacing the 2011 SR 11-7. Its text states that generative AI and agentic AI models are novel and rapidly evolving and are not within its scope; it covers traditional models and non-generative, non-agentic AI.
The guidance still tells banks to apply their general risk management and governance to tools it does not cover. In practice that means each bank decides what "appropriate controls" for an agent look like, and examiners are now asking to see the answer.
It is a toolkit state examiners can use to find and assess AI at banks and nonbank lenders. The Conference of State Bank Supervisors published the framework on 16 September 2026. It is discretionary: each state regulator decides how much of it to adopt. It is built on the NIST AI Risk Management Framework, the Cyber Risk Institute's Financial Services AI Risk Management Framework and the US Treasury's AI Lexicon, and has five parts:
| Component | What it gives examiners |
|---|---|
| Core Examiner Guide | Scoping questions, a document request list, and procedures for governance, AI inventory and use cases, and generative AI |
| Examiner Work Program | More detail on applying the core guide |
| Nonbank AI Supplements | Third-party and vendor risk, model risk and consumer protection at nonbanks |
| AI Use Case Risk Tiering Worksheet | An optional way to tier individual AI use cases by risk |
| Source Support Document | The supervisory materials the framework draws on |
CSBS says institutions can use the same framework to assess their own AI programmes and prepare for exams. For a fintech or a bank vendor, that makes it the most practical public checklist available today.
Reuters reports that the European Central Bank gave euro-area lenders until the end of October 2026 to produce plans against AI-enabled cyber threats, including better backup and recovery, and asked them to map AI use across their businesses and suppliers so systems can be switched off and restarted in a controlled way. UK supervisors are working with the largest banks on "bare metal" recovery systems kept separate from their main technology, without new rules.
Design the agent so each regulator question has a short, provable answer. If you sell to banks, their vendor-risk team will ask you the same things examiners ask them:
| Examiner question | Design answer |
|---|---|
| What limits are placed on the agent? | Scoped tools only, per-action and per-day limits (amounts, counts, accounts), no free-form network or shell access |
| How are actions monitored and approved? | Policy checks in code before each tool call; a human approval queue for anything above a threshold |
| Can decisions be tracked and audited? | Append-only log of prompt, retrieved data, tool call, result, approver and model version for every step |
| What stops the agent exceeding its authority? | Its own least-privilege identity, separate from human users; authorisation enforced server-side, never by the prompt |
| Are humans in key decisions? | Credit, payments, account closure and adverse actions require a named human sign-off |
| Can you shut it down? | A tested kill switch: feature flag plus credential revocation, with a manual fallback process |
| Where does the technology come from? | An inventory of every model, provider and region, kept current, with a documented fallback model |
Most of this also satisfies PCI DSS 4.0.1 access and logging expectations if the agent is anywhere near cardholder data. We cover those in PCI DSS 4.0.1 for fintech and the controls in our AI agent security checklist. Liability is moving the same way: the proposed AI Agent Accountability Act would make agent operators answer for hacking their agents do.
Not as of 16 October 2026. SR 26-2 excludes generative and agentic AI, the CSBS framework is discretionary, and Reuters reports the federal agencies are still gathering information rather than issuing directives.
The Fed says it is expected to be most relevant to banking organisations with over $30 billion in total assets, though its principles scale to smaller institutions.
It is designed for state-chartered banks and state-licensed financial institutions, and includes nonbank supplements covering vendor risk, model risk and consumer protection. Each state decides how to use it.
An AI use inventory, a risk tier for each use case, documented limits and approval flows, an audit log you can export, a tested shutdown procedure, and a list of every model provider you depend on.
BeevR is a senior, founder-led studio in Hanoi, Vietnam, building fintech products and AI agents for regulated industries at a fixed price per phase, and you own the code from day one. If you are building an agent a bank will have to approve, see our fintech MVP work or tell us what it needs to do.