The OCC just gave banks the exam manual for AI agents

The framework

The Office of the Comptroller of the Currency published Bulletin 2026-54 on November 4, 2026, and the document is 22 pages long. The OCC calls it the Framework for Super Intelligence, and defines Super Intelligence as AI under Executive Order 14434. The name is grander than the content, which is practical in the way only an examiner's manual can be. The framework aligns AI risk management with operational, compliance, credit, cyber, and third-party categories, which means AI is not a new risk category. It is the old risk categories, applied to software that acts on its own. m:…9371

The core idea is that risk follows consequences, not cleverness. The OCC framework determines risk based on consequences, transfer of agency, and human oversight rather than technical sophistication. Examiners evaluate AI systems against six primary considerations: Purpose, Risk, Control, Oversight, Resilience, and Assurance. A bank does not get credit for having a sophisticated model. It gets judged on what the model is allowed to do, who watches it, and what happens when it goes wrong. That is a deliberately boring standard, and it will decide whether a bank's AI program passes its next exam. m:…9371

What examiners will ask for

The operational demands are specific. Banks must maintain an updated inventory of every agent, including owner, provider, permissions, and deployment status. Examiners require full session traces to be monitored to rebuild decisions from inputs, tool calls, approvals, and overrides. The OCC framework requires that agent identities be governed with least privilege, rate limits, and kill switches. Put plainly, a bank must be able to say, for every agent it runs, who owns it, what it can touch, and exactly what it did in every session. If a bank cannot produce that record, it cannot demonstrate control, and the absence of a record is itself the finding. m:…9371

Two details in the framework show how seriously the OCC takes the new failure modes. Activity outside an agent's defined scope may be treated as a control failure even if the output appears reasonable, and intent drift across sessions can count as a control failure under the OCC framework. An agent that does the right thing for the wrong reason, or that slowly wanders away from its instructions over many sessions, is a control failure. That is a much higher bar than most banks have applied to their own software, and it will cost the most to implement, because it requires monitoring behavior over time rather than checking a configuration once. m:…9371

Why supervisors are worried now

The Bank of Finland explains why the timing is not accidental. In its survey, 93 percent of responding financial-sector entities in Finland use or plan to use AI within two years, and reported use of generative and general-purpose AI in the Finnish financial sector rose from 74 percent to 90 percent in one year. Common dependencies on a small number of technology providers and AI models create systemic risk, the bank warns, and financial markets can become destabilized when institutions act in synchronized, automated ways. The worry is not that one bank's agent makes a mistake. It is that many banks' agents, built on the same models and providers, make the same mistake at the same time. m:…5702

Human oversight in finance must be meaningful rather than just a signature at the end of an automated process, the Bank of Finland argues, and digital sovereignty involves retaining the capacity to make independent choices and access technology. The Bank of Finland and the Financial Supervisory Authority are organizing an international seminar on artificial intelligence, held in Helsinki on 11-12 November 2026, covering the implications of AI for financial stability. Tuomas Välimäki advocates for balancing AI adoption with careful risk management, and he is opening the seminar. The seminar will be live-streamed and will not be recorded. The message from Helsinki matches Washington's: adopt the technology, but build the controls first, and do not confuse a human signature at the end of a process with human oversight of it. m:…5702 m:…9355

The technology is already here

The reason the frameworks are arriving now is that the technology has already arrived in the back office. Toloka reports that an autoresearch agent trained 62 versions of a small model for bank support, and the post-trained 4B model achieved 93.8% accuracy on unseen synthetic conversations. The post-trained 4B model was 22 times faster than Gemini 3.8 Flash, and cost one fifty-eighth of the serving cost of Gemini 3.8 Flash. Training data for the study consisted of 2,048 synthetic conversations, and a single training run took about an hour on one H100 GPU. Those are Toloka's own figures from its own study, and they should be read as a vendor's demonstration, not an independent result. But they show why banks are moving fast: a small, cheap model trained for one job can now do that job well. m:…5282

Toloka is also honest about the limit. The model's performance was limited by underrepresented situations in the training data, and reinforcement learning after full fine-tuning improved performance on changed-fact evaluation datasets. A model that has never seen a situation cannot handle it, and a bank support agent that meets one its training data underrepresented will fail as the OCC framework anticipates: outside its defined scope, with an output that may look reasonable. The framework and the demonstration point at the same conclusion. The agents work, the edge cases are where they break, and the exam will ask what happens at the edge. m:…5282 m:…9371