US banking regulators are increasing scrutiny of how financial institutions deploy artificial intelligence, signalling that AI governance is rapidly becoming a supervisory priority as banks expand the technology’s role across critical operations. According to reports, regulators including the Federal Reserve and the Office of the Comptroller of the Currency (OCC) have begun asking banks to provide detailed information on how AI is being used in areas such as lending, sanctions screening, anti-money laundering controls, and customer due diligence processes.
The heightened oversight comes as banks move beyond basic AI applications and begin deploying more sophisticated systems capable of influencing credit decisions, monitoring compliance, detecting fraud, and automating operational workflows.
Rather than introducing new AI-specific regulations, supervisors are currently relying on existing frameworks covering model risk management, third-party oversight, cybersecurity, and consumer protection. The objective is to understand how institutions are managing emerging risks before determining whether additional regulatory measures are required.
Focus on Governance and Controls
A key area of regulatory attention is governance. Banks are being asked to demonstrate how they control AI systems, monitor their behaviour, and ensure human oversight remains in place.
Supervisors are reportedly examining whether institutions have appropriate guardrails to limit what AI systems can access, how decisions are reviewed, and whether emergency shutdown mechanisms can be activated if systems behave unexpectedly.
The rapid rise of generative and agentic AI has raised concerns that financial institutions could become increasingly dependent on technologies that are difficult to fully explain, monitor, or audit using traditional risk frameworks.
Vendor Risk Moves Into the Spotlight
Regulators are also placing significant emphasis on third-party AI providers. As banks increasingly rely on external vendors for AI capabilities, questions are being raised about data security, subcontractor exposure, operational resilience, and contingency planning.
Institutions are being asked to demonstrate how they oversee vendor practices and whether they have exit strategies in place should an AI provider experience a security breach, operational failure, or compliance issue.
The growing dependence on external AI infrastructure mirrors broader concerns around concentration risk within cloud computing and critical technology services.
A Principles-Based Approach for Now
While regulators are clearly increasing scrutiny, there is currently little indication that new prescriptive AI regulations are imminent. Instead, authorities are expected to continue using principles-based supervision while they build a deeper understanding of how the technology is being deployed across the industry.
The challenge for regulators is that AI is evolving far faster than traditional regulatory cycles. As a result, supervisory expectations are likely to continue developing alongside the technology itself.
What This Means for the Industry
- AI governance is becoming a board-level issue rather than a purely technology function.
- Banks will face increasing pressure to demonstrate transparency, oversight, and accountability for AI-driven decisions.
- Third-party AI providers will come under greater scrutiny as regulators focus on vendor and subcontractor risks.
- Human oversight and “kill switch” controls are emerging as key expectations for AI deployments in banking.
- Existing risk management frameworks are likely to be adapted before entirely new AI regulations are introduced.
- Institutions that establish strong AI governance practices early may gain a regulatory and operational advantage as supervisory expectations evolve.
