OCC expectations for AI agents in national banks

Expect the OCC to examine AI agents through the risk management it already requires, not through a separate AI rule. A national bank running agents must show sound governance, model risk management under SR 11-7, controls over operational and compliance risk, and oversight of the vendors involved. The examiner's test is safety and soundness, plus fair treatment of customers.

What does the OCC require, in plain words?

The Office of the Comptroller of the Currency supervises national banks, federal savings associations and federal branches of foreign banks. Its approach is risk-based and technology-neutral: a bank may use new technology, but it must identify, measure, monitor and control the risks it creates. For agents, five areas of existing expectation apply.

• Governance. The board and senior management oversee risk, set appetite and hold management accountable. Larger banks face heightened standards for a risk governance framework with independent risk management and internal audit.
• Model risk. The OCC applies the interagency model risk guidance known as SR 11-7: sound development and use, independent validation with effective challenge, and governance including an inventory.
• Operational risk. Processes, people and systems must be controlled, including change management, access and business continuity.
• Compliance risk. Consumer protection and fair lending law apply to what an agent does. When credit is denied, ECOA and Regulation B require specific reasons, including where a model is used.
• Third parties. Relying on a vendor does not move the risk; the bank must manage it across the relationship.

Who does it apply to?

Banks under OCC supervision, in all sizes. Expectations scale with size and complexity. A community bank running one agent in its contact centre will be examined differently from a large bank running dozens across lending and operations, but the questions are the same in kind. State-chartered banks face similar expectations from the Federal Reserve or FDIC.

What does this mean when the system is an agent that acts?

An examiner looks at an agent through the lens of what can go wrong for the bank and its customers. Agents raise four specific concerns.

An agent is a model, and more. Its outputs are estimates and classifications, so model risk management applies. But an agent also has tools that change records and move money, which is operational risk. Most banks need to cover both, not choose between them. Our piece on how banks validate AI agents sets out the validation side.

Authority must be controlled like an employee's. A teller has limits on what they may approve. An agent needs the same, set per capability and enforced before it acts. An examiner will ask what an agent can do without a person, and how you know it stays within that.

Consumer outcomes are the bank's. An agent that tells a customer the wrong fee, or handles a hardship call badly, creates compliance risk under consumer protection law. A credit decision an agent influences must still produce accurate, specific adverse action reasons.

Change is constant. Model providers update models; sources change; tools are added. Each is a change that the bank's change management should catch, and examiners will test whether it does.

Take an illustrative case. A regional national bank uses an agent to triage small business loan applications. The agent reads documents, flags missing items and drafts a recommendation. Underwriters decide. The bank records the agent in its model inventory, validates it on past applications, limits its tools to reading and drafting, and checks that decline reasons in drafted letters match the factors underwriters relied on. When the examiner asks who decided each loan, the bank can show a named underwriter for every one.

How do you meet OCC expectations for agents?

What will an examiner ask?

• Which agents operate in the bank, and what can each do without a person?
• Where are they in the model inventory, and when were they last validated?
• Who approved each agent's authority, and on what evidence?
• How do you know an agent stayed within its limits?
• How do you ensure decline reasons are accurate when an agent was involved?
• What happens if the agent vendor or model provider fails?

What does OCC supervision not settle?

It does not prescribe a framework for agents or approve specific uses in advance. It does not replace the CFPB's role in consumer financial protection for larger banks, or state law where it applies. Vendor relationships have their own expectations, covered in our piece on OCC third-party risk. Banks with UK operations face a different supervisory lens: see PRA expectations for AI agents in UK banks and FCA expectations for AI agents. For the full map, see our guide to AI agent regulation mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

Pryme gives each agent capability a depth earned on the bank's own cases through Attest, capped by its plan, and enforced on every action through the minimum chain. Each verdict names the bound that decided and is filed in an append-only record, which is the evidence an examiner asks for when testing whether an agent stayed within limits.