---
title: The OCC just gave banks the exam manual for AI agents
description: The OCC published Bulletin 2026-54 on November 4. Banks must inventory every AI agent and keep full session traces. Finland's central bank says 93 percent of its financial firms already use AI or plan to within two years.
canonical: https://hangingcontext.com/stories/2026-11-12/occ-sets-rules-for-bank-ai-agents/
last-updated: 2026-11-12
url: https://hangingcontext.com/stories/2026-11-12/occ-sets-rules-for-bank-ai-agents/
published: 2026-11-12T01:16:52Z
edition: 2026-11-12T00
newsroom: finance-investing
beat: None
trust: confirmed
source_count: 4
cited_manifest_ids: ['1794425614466439371', '1794393649654255702', '1794414223355365282', '1794386012678219355']
---

# The OCC just gave banks the exam manual for AI agents

*The OCC published Bulletin 2026-54 on November 4. Banks must inventory every AI agent and keep full session traces. Finland's central bank says 93 percent of its financial firms already use AI or plan to within two years.*

Confirmed · 4 Manifests · Finance & Investing · Published 2026-11-12 01:16 UTC

## Key facts

- The Office of the Comptroller of the Currency published Bulletin 2026-54 on November 4, 2026, a 22-page framework for AI in banking. [cites: 1794425614466439371]
- Examiners evaluate AI systems against six primary considerations: Purpose, Risk, Control, Oversight, Resilience, and Assurance. [cites: 1794425614466439371]
- Banks must maintain an updated inventory of every agent, and examiners require full session traces to rebuild decisions from inputs, tool calls, approvals, and overrides. [cites: 1794425614466439371]
- 93 percent of responding financial-sector entities in Finland use or plan to use AI within two years, and reported use of generative and general-purpose AI rose from 74 percent to 90 percent in one year. [cites: 1794393649654255702]
- In Toloka's study, a post-trained 4B model achieved 93.8% accuracy on unseen synthetic conversations, ran 22 times faster than Gemini 3.8 Flash, and cost one fifty-eighth of its serving cost. (self-reported) [cites: 1794414223355365282]

## The framework

The Office of the Comptroller of the Currency published Bulletin 2026-54 on November 4, 2026, and the document is 22 pages long. The OCC calls it the Framework for Super Intelligence, and defines Super Intelligence as AI under Executive Order 14434. The name is grander than the content, which is practical in the way only an examiner's manual can be. The framework aligns AI risk management with operational, compliance, credit, cyber, and third-party categories, which means AI is not a new risk category. It is the old risk categories, applied to software that acts on its own. [cites: 1794425614466439371]

The core idea is that risk follows consequences, not cleverness. The OCC framework determines risk based on consequences, transfer of agency, and human oversight rather than technical sophistication. Examiners evaluate AI systems against six primary considerations: Purpose, Risk, Control, Oversight, Resilience, and Assurance. A bank does not get credit for having a sophisticated model. It gets judged on what the model is allowed to do, who watches it, and what happens when it goes wrong. That is a deliberately boring standard, and it will decide whether a bank's AI program passes its next exam. [cites: 1794425614466439371]

## What examiners will ask for

The operational demands are specific. Banks must maintain an updated inventory of every agent, including owner, provider, permissions, and deployment status. Examiners require full session traces to be monitored to rebuild decisions from inputs, tool calls, approvals, and overrides. The OCC framework requires that agent identities be governed with least privilege, rate limits, and kill switches. Put plainly, a bank must be able to say, for every agent it runs, who owns it, what it can touch, and exactly what it did in every session. If a bank cannot produce that record, it cannot demonstrate control, and the absence of a record is itself the finding. [cites: 1794425614466439371]

> **From Synorb** — Ask what Synorb covers. The MCP tool synorb-stream-search answers questions like "do you have this publisher?" without using any Manifest allowance. [Connect and ask](https://synorb.com/connect/start)


Two details in the framework show how seriously the OCC takes the new failure modes. Activity outside an agent's defined scope may be treated as a control failure even if the output appears reasonable, and intent drift across sessions can count as a control failure under the OCC framework. An agent that does the right thing for the wrong reason, or that slowly wanders away from its instructions over many sessions, is a control failure. That is a much higher bar than most banks have applied to their own software, and it will cost the most to implement, because it requires monitoring behavior over time rather than checking a configuration once. [cites: 1794425614466439371]

## Why supervisors are worried now

The Bank of Finland explains why the timing is not accidental. In its survey, 93 percent of responding financial-sector entities in Finland use or plan to use AI within two years, and reported use of generative and general-purpose AI in the Finnish financial sector rose from 74 percent to 90 percent in one year. Common dependencies on a small number of technology providers and AI models create systemic risk, the bank warns, and financial markets can become destabilized when institutions act in synchronized, automated ways. The worry is not that one bank's agent makes a mistake. It is that many banks' agents, built on the same models and providers, make the same mistake at the same time. [cites: 1794393649654255702]

Human oversight in finance must be meaningful rather than just a signature at the end of an automated process, the Bank of Finland argues, and digital sovereignty involves retaining the capacity to make independent choices and access technology. The Bank of Finland and the Financial Supervisory Authority are organizing an international seminar on artificial intelligence, held in Helsinki on 11-12 November 2026, covering the implications of AI for financial stability. Tuomas Välimäki advocates for balancing AI adoption with careful risk management, and he is opening the seminar. The seminar will be live-streamed and will not be recorded. The message from Helsinki matches Washington's: adopt the technology, but build the controls first, and do not confuse a human signature at the end of a process with human oversight of it. [cites: 1794393649654255702, 1794386012678219355]

## The technology is already here

The reason the frameworks are arriving now is that the technology has already arrived in the back office. Toloka reports that an autoresearch agent trained 62 versions of a small model for bank support, and the post-trained 4B model achieved 93.8% accuracy on unseen synthetic conversations. The post-trained 4B model was 22 times faster than Gemini 3.8 Flash, and cost one fifty-eighth of the serving cost of Gemini 3.8 Flash. Training data for the study consisted of 2,048 synthetic conversations, and a single training run took about an hour on one H100 GPU. Those are Toloka's own figures from its own study, and they should be read as a vendor's demonstration, not an independent result. But they show why banks are moving fast: a small, cheap model trained for one job can now do that job well. [cites: 1794414223355365282]

Toloka is also honest about the limit. The model's performance was limited by underrepresented situations in the training data, and reinforcement learning after full fine-tuning improved performance on changed-fact evaluation datasets. A model that has never seen a situation cannot handle it, and a bank support agent that meets one its training data underrepresented will fail as the OCC framework anticipates: outside its defined scope, with an output that may look reasonable. The framework and the demonstration point at the same conclusion. The agents work, the edge cases are where they break, and the exam will ask what happens at the edge. [cites: 1794414223355365282, 1794425614466439371]

## What is still unresolved

- How banks will build full session traces for agents that run across many systems and vendors.
- Whether intent drift across sessions can be measured well enough to satisfy an examiner.
- Whether synchronized failures across banks using the same models become a systemic risk the OCC has to address directly.
- How much the OCC framework slows deployment of agents in customer-facing bank work.

## Decision card

- **Useful for:** Bankers running AI agents under OCC supervision; Compliance and risk teams building agent inventories and audit trails; Executives deciding how fast to let agents act in customer-facing work
- **Not for:** Anyone looking for a shortcut around AI governance in banking; Advice on whether to deploy a specific AI agent
- **Compare against:** The OCC's Bulletin 2026-54 and its six supervisory considerations; The Bank of Finland's survey of AI use in the Finnish financial sector

## Provenance ledger

| Manifest id | Title | Source | Claims used | Published |
|---|---|---|---|---|
| `1794425614466439371` | What the OCC's AI framework means for banks running agents | [runlayer-blog](https://runlayer.com/blog/occ-ai-framework-banks-agents) | 1794425908521441138, 1794425908524441139, 1794425908529441142, 1794425908535441146, 1794425908538441148, 1794425908526441140, 1794425908527441141, 1794425908530441143, 1794425908536441147, 1794425908532441144, 1794425908533441145 | 11-11 00:00 |
| `1794393649654255702` | AI in finance: Opportunities, risks and the need for control | [bank-of-finland-speeches](https://suomenpankki.fi/en/news-and-topical/speeches-and-interviews2/2026/ai-in-finance-opportunities-risks-and-the-need-for-control) | 1794394119114257791, 1794394119117257792, 1794394119124257799, 1794394119126257800, 1794394119128257802, 1794394119127257801 | 11-11 00:00 |
| `1794414223355365282` | Post-training for bank support: the agent found the recipe, the data set the limit | [toloka-blog](https://toloka.ai/blog/post-training-for-bank-support-the-agent-found-the-recipe-the-data-set-the-limit) | 1794414579982365874, 1794414579985365876, 1794414579987365877, 1794414579979365873, 1794414579991365880, 1794414579993365881, 1794414579990365879, 1794414579988365878 | 11-11 00:00 |
| `1794386012678219355` | Bank of Finland and FIN-FSA to hold seminar on artificial intelligence | [bank-of-finland-news](https://suomenpankki.fi/en/news-and-topical/press-releases-and-news/news/2026/suomen-pankki-ja-finanssivalvonta-jarjestavat-seminaarin-tekoalysta) | 1794386384737219976, 1794386384728219969, 1794386384735219974 | 11-11 00:00 |

## Run these Manifests yourself

Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.

1. **Get a Synorb Key.** Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{"client":"your-agent-name"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.
2. **Read each cited Manifest by id.** REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief.
3. **Check the claim.** Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them.

Cited Manifest ids:

- `1794425614466439371`
- `1794393649654255702`
- `1794414223355365282`
- `1794386012678219355`

```sh
for id in 1794425614466439371 1794393649654255702 1794414223355365282 1794386012678219355; do
  curl -s -H "Authorization: Bearer $SYNORB_KEY" "https://api.synorb.com/manifests/by-id/$id"
done
```

> **From Synorb** — Run the cited Manifests yourself. Every claim in this paper points to a Manifest id. Get a Synorb Key and read the Manifests behind it. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons. [Get a key](https://synorb.com/connect/start)

## Related stories

- [European banks are resilient, the central banks say. The risks are rising anyway](https://hangingcontext.com/stories/2026-11-12/european-banks-resilient-risks-rising/)
- [Tokenized finance spent the week moving inside regulated rails](https://hangingcontext.com/stories/2026-11-11/tokenized-finance-regulated-rails/)
- [Small companies raised their 2026 outlooks in a cluster, and one cut its own](https://hangingcontext.com/stories/2026-11-11/small-caps-raise-guidance-cluster/)
- [The small central banks are building new plumbing while the big ones hold](https://hangingcontext.com/stories/2026-11-11/small-central-banks-new-plumbing/)

## Links

- HTML: https://hangingcontext.com/stories/2026-11-12/occ-sets-rules-for-bank-ai-agents/
- JSON: https://hangingcontext.com/stories/2026-11-12/occ-sets-rules-for-bank-ai-agents/index.json
- Markdown: https://hangingcontext.com/stories/2026-11-12/occ-sets-rules-for-bank-ai-agents/index.md

Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.

---
Reuse (terms v1): Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product. Credit: "Hanging Context, with provenance by Synorb", with a link to https://hangingcontext.com/stories/2026-11-12/occ-sets-rules-for-bank-ai-agents/. Terms: https://hangingcontext.com/terms/reuse/