OCC Issues New Supervisory Framework for Banks’ Use of Super Intelligence

The Office of the Comptroller of the Currency issued a new supervisory framework Wednesday to help its examiners assess how federally regulated banks use “super intelligence,” including autonomous, or agentic, systems. The guidance gives examiners a way to consider the risks and controls associated with the technology, but it does not impose new regulatory requirements on banks.

The November 4 release puts greater emphasis on what a system can do, how independently it can act and the consequences if it fails. That distinction matters as banks move beyond tools that generate information toward software capable of carrying out tasks with varying degrees of human direction. The OCC says examinations should reflect the actual importance and risk of a bank’s use case, rather than treating every application of the technology alike.

In Bulletin 2026-54, the agency makes the limits of the document explicit: it is a resource for OCC examiners, not a new set of standards that banks are expected to follow. The OCC supervises national banks, federal savings associations and federal branches and agencies of foreign banking organizations. Its approach applies to that supervisory work, not automatically to every financial institution in the United States.

Examiners will look at autonomy, oversight and potential harm

The framework directs attention to the consequences of a particular use of super intelligence and how much decision-making or action has been handed to the system. OCC examiners may assess risk according to potential consequences, the transfer of agency and the level of human oversight, rather than relying primarily on the sophistication of the underlying technology. A technically advanced tool is not necessarily the highest-risk application simply because it is advanced.

The contrast is easiest to see when comparing different tasks. A system that prepares material for an employee to review does not have the same operating role as an agent authorized to take steps within a business process. In the second example, questions about permissions, review and the effects of an error become more pressing. These are illustrations of the framework’s risk-based logic, not new activities the OCC has ordered banks to adopt or prohibit.

One of the bulletin’s central points is that the intensity of a bank’s controls could rise with the potential consequences of an agent’s failure or misuse. An examiner’s attention can therefore be shaped by the damage an activity could cause, including when its output affects an important operational or customer-facing process. The guidance does not prescribe a uniform control for each type of system; it directs examiners to consider the context of the activity.

OCC staff may also use the framework to supplement their assessment of existing model risk management, governance, technology, compliance and operational-risk practices. That places the newer tools within familiar areas of bank supervision rather than outside the established structure. The regulator’s stated aim is to give its examination workforce a consistent way to think about features that may differ from traditional software, especially where a system has more freedom to act.

No separate AI risk category or new bank standards

A significant boundary in the guidance is what it does not require. Examiners should not treat super intelligence as a separate and distinct risk category, the OCC says, and banks are not required to establish a separate risk appetite for it. The agency also states that banks are not expected to use the examiner document to assess their own systems or their risk management practices.

The OCC goes further by saying the framework creates neither enforceable standards nor prescriptive requirements. Its publication should not be read as a rulemaking that changes the legal duties of banks using the technology. Existing obligations still apply, however. In the accompanying announcement, the regulator stresses that banking activities must be conducted safely and soundly and in compliance with applicable laws and regulations, whether they rely on established processes or newer technology.

Community banks receive a specific qualification. OCC examiners may use the guide when supervising smaller institutions, but the agency has instructed them to adapt their work to each bank’s size, complexity and risk profile. The nature of a use case, its possible consequences, its autonomy and its complexity are all relevant. That avoids assuming a community bank deploying a limited tool needs the same examination approach as a much larger institution operating more consequential systems.

This is consistent with a wider emphasis on proportional supervision. In September, the OCC and other federal financial regulators proposed revisions to third-party risk management guidance that would tailor attention to the risks of particular relationships rather than treat every arrangement as equally hazardous. That September document was a proposal, not a final requirement. The new super intelligence framework is a separate examiner resource, but both reflect the OCC’s stated preference for assessing actual risk rather than applying a single process to every bank or technology.

What “super intelligence” means in federal policy

The unusual terminology comes from a federal policy change, not from an OCC determination that banks are using hypothetical superhuman systems. Executive Order 14434, signed September 29, directed executive agencies, to the extent permitted by law, to use “Super Intelligence” and “SI” in place of “Artificial Intelligence” and “AI” in official communications and other nonstatutory materials. The order was published in the Federal Register on October 2.

The executive order says that, unless another law provides otherwise, the new terms cover technologies and systems already encompassed by the statutory definition of artificial intelligence in 15 U.S.C. 9401(3). That explains why the OCC’s bulletin uses the new label while addressing banking applications often described elsewhere as AI and agentic AI. The name should not be taken as evidence that a bank has deployed a system with abilities beyond human intelligence.

For bank executives, the practical significance of the November 4 announcement lies less in that label than in the distinctions examiners have been asked to make. The degree of autonomy, the importance of the task and the scope of human intervention may influence how an examination approaches the bank’s controls. The bulletin does not announce a new filing deadline, approval process or standalone supervisory rating for these systems.

The OCC expects the framework to change as the technology, bank use cases and its own supervisory understanding develop. It also says stakeholder feedback will inform updates. No timetable for those revisions was specified in the announcement, leaving the present document as guidance to examiners rather than a fixed, comprehensive rulebook for future uses of autonomous systems.