Over the past year, banks have started handing more work to AI agents, software that can carry out tasks with very little human supervision. Regulators are now asking an obvious follow-up question: if one of these agents goes wrong, can the bank actually stop it?
According to a Reuters report published today, regulators in the US, the UK and the euro zone are questioning banks more closely about advanced AI. Their concerns range from AI-powered cyberattacks to “rogue agents” acting beyond their limits.
Most of the detail in the report comes from people familiar with the discussions, not from regulators speaking on the record. That’s worth keeping in mind. Even so, the direction is clear enough to matter for anyone with a bank account.
What US regulators are reportedly asking
Three top US banking regulators, including the Federal Reserve, are questioning banks about how they use advanced AI models, two people familiar with the matter told Reuters. The other two named are the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC). All three declined to comment.
According to the sources, regulators want to know:
- Whether banks use Chinese-developed AI technology
- Whether they use AI agents in cyber defence
- What limits are placed on these systems, and how their actions are monitored and approved
- Whether banks can track and audit decisions made by AI agents
- Whether humans stay involved in key decisions
- How a bank would shut an autonomous system down if it had to
The questions have reportedly gone to large, mid-size and smaller banks, both in writing and in meetings. For now, regulators are said to be gathering information rather than writing new rules.
Europe is focused on recovery
European supervisors seem less worried about how banks use AI and more worried about what happens when someone uses AI against them.
The Bank of England and the European Central Bank are pressing banks to improve their recovery plans, three people told Reuters. The concern is that fast-improving AI could cause serious harm to markets sooner than expected. A senior executive at a large European bank told Reuters they were worried about major damage “within six months.”
Two parts of this are confirmed by the ECB itself. In July, it gave banks until the end of October to produce plans for countering AI-enabled cyber threats, including better backup and recovery. And when asked about the report, it pointed to a June speech by board member Frank Elderson, who said the goal was to create a sense of urgency rather than alarm.
According to people familiar with the matter, UK supervisors are encouraging the largest banks to look at “bare metal” recovery plans. Banks keep these backup systems separate from their main technology, so the backups can take over if attackers compromise the main systems. Building and running them costs banks a lot of money. The sources also told Reuters that UK authorities prefer to work with the industry rather than add new requirements. The Bank of England declined to comment.
Why now
Banks have used AI for years, mostly for fraud detection and credit scoring. What has changed is that newer systems can act on their own, and attackers have access to the same tools.
There was a real example this month. Cybersecurity firm CrowdStrike said a person in China likely used a Chinese-developed AI agent and Anthropic’s Claude Code in a hack on South Korean banks.
“The adoption of AI is often outpacing the ability to put the controls in place,” Michael Woodbridge, a cybersecurity partner at Grant Thornton in London, told Reuters.
Sukand Ramachandran of BCG explained what that could mean for customers. “To protect against attacks, rapid recovery matters as much as prevention,” he said. Without separately held, clean copies of critical data, he warned, “a serious attack could lock customers out of their accounts and disrupt payments across the wider economy.”
Where India stands
The Reuters report doesn’t mention the RBI, and there’s no public sign yet of a similar inquiry in India. But the RBI has been working on AI rules for a while.
In August 2025, it published the report of its committee on the Framework for Responsible and Ethical Enablement of Artificial Intelligence, or FREE-AI. The report sets out 7 guiding principles, which it calls “Sutras”, and 26 recommendations for how banks and other regulated entities should use AI.
In June 2026, the RBI released a draft “Guidance on Regulatory Principles for Model Risk Management, 2026” for public comment, with comments due by July 24. It deals with how regulated entities govern and oversee the models they use, including AI and machine learning models and ones bought from outside vendors. It’s still a draft, so it isn’t binding yet.
Neither document is mainly about AI agents. Both, though, deal with the question US and European regulators are now asking: who is in control when software makes the decisions?
What this means for you as a bank customer
There’s no reason to panic or move your money. The report doesn’t say any bank has been harmed by its own AI agents, and regulators are still at the stage of asking questions.
It is a good moment to check a few basic habits. Keep accounts in more than one bank, so that if one bank’s systems go down for a day you can still pay your bills. Holding part of your emergency fund in a second bank is an easy way to do this. Leave SMS and email alerts switched on for every transaction, so you notice anything odd quickly.
If your bank’s chatbot can’t solve a problem, ask to speak to a person. If the bank doesn’t resolve your complaint, you can take it to the RBI Ombudsman. And be careful with AI-powered scams, which can now fake voices and messages convincingly. Your bank will never ask for your OTP, PIN or password.
What to watch
- The end of October, the ECB’s deadline for banks’ AI cyber-threat plans
- Whether US regulators move from asking questions to issuing formal guidance
- The RBI’s final model risk guidance, now that consultation on the draft has closed
The RBI is also making news for other reasons this month. See our explainer on the RBI’s October repo rate hike and what it means for your EMIs. For how quickly AI is growing inside Indian IT, see our breakdown of TCS’s Q2 results, where AI revenue crossed $3 billion.
You can read the original report via Reuters on Global Banking & Finance Review. For India’s framework, see the RBI’s FREE-AI press release and the RBI’s draft model risk guidance.
