What's Happening?
On November 4, the Office of the Comptroller of the Currency (OCC) released a supervisory framework detailing how examiners should assess banks' use of 'super intelligence' (SI), a term encompassing technologies previously known as artificial intelligence.
This framework applies to SI applications in various banking functions, including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities, with a specific focus on generative and agentic systems. The OCC clarifies that SI is not a distinct risk category but rather its risks should be managed within existing bank risk management frameworks. The guiding principle is proportionality, meaning that the greater the potential consequences of a system's failure or misuse, the stronger the necessary controls. The framework outlines 16 supervisory components across six pillars: purpose, risk, control, oversight, resilience, and assurance. It also highlights risks unique to generative and agentic technology, such as hallucinations, prompt injection, model and data poisoning, and scope drift. For consumer-facing applications, the OCC stresses that SI does not alter banks' existing legal obligations, and inaccurate or misleading outputs could lead to compliance issues.
Why It's Important?
This OCC framework is crucial for the U.S. banking sector as it provides a standardized approach for managing the rapidly evolving landscape of artificial intelligence in financial services. By integrating SI risks into existing risk management frameworks, the OCC aims to prevent the creation of new, isolated regulatory burdens while ensuring that banks maintain sound practices. The emphasis on proportionality means that banks will need to carefully assess the potential impact of their SI systems and implement controls commensurate with those risks. This will likely lead to increased investment in risk assessment tools, governance structures, and employee training related to AI. The framework's focus on specific risks like hallucinations and data poisoning underscores the need for robust validation and monitoring of SI systems, particularly those that interact directly with customers or make critical financial decisions. Banks that fail to adapt their risk management strategies to this new guidance could face heightened scrutiny and potential regulatory penalties, impacting their operational efficiency and market competitiveness.
What's Next?
The OCC describes this framework as a 'living document,' indicating that it will be updated as technology and supervisory understanding evolve. This suggests an ongoing dialogue between regulators and the banking industry regarding best practices for SI implementation and risk management. Banks are expected to use this framework as a roadmap to calibrate their controls and human oversight based on the permitted functions of an SI system and the potential consequences of its failure. This will likely involve internal audits, adjustments to compliance protocols, and potentially new training programs for staff. The OCC's illustrative four-tier methodology, ranging from 'Critical' uses like autonomous payment agents to 'Low' uses such as internal productivity tools, will help banks categorize and prioritize their SI risk mitigation efforts. Future updates to the framework will likely address emerging SI technologies and new risk vectors, requiring continuous adaptation from financial institutions.
Beyond the Headlines
The OCC's framework delves into the deeper implications of SI by highlighting the ethical and legal dimensions of its use in consumer-facing applications. The explicit statement that SI does not alter banks' existing legal obligations means that banks remain fully accountable for the accuracy and fairness of SI-generated outputs, particularly concerning fees, rates, and account status. This raises significant questions about liability in cases of SI error or bias, potentially leading to new legal precedents and consumer protection challenges. The framework also implicitly encourages a shift in organizational culture within banks, moving towards a more proactive and integrated approach to technology risk. The need to manage risks like 'scope drift' suggests that banks must establish clear boundaries and oversight mechanisms for SI systems to prevent unintended consequences. This regulatory move could also spur innovation in AI ethics and governance within the financial technology sector, as companies develop solutions to help banks comply with these evolving standards.
