A policeman for paying robots. The Office of the Comptroller of the Currency (OCC), the supervisor of American national banks, published on November 4 its first supervisory framework devoted to artificial intelligence. The text comes three weeks after JPMorgan's decision to close its accounts to external AI agents and it places autonomous payment agents at the very top of the risk ladder.
An AI agent is software that no longer just answers a question but carries out tasks for you: compare offers, fill out a form and now pay. The regulator does not prohibit anything, it gives its inspectors a reading guide.
A framework for OCC examiners, not a new rule for banks
The 22-page document, distributed under bulletin 2026-54 and signed by James Gallagher, head of the agency's examiners, is primarily aimed at those officials who audit banks on site. Reuters sees this as the first instruction of this type ever addressed to American banking inspectors. And the OCC warns that its text “does not establish any new prudential expectations” for establishments.
The central message is contained in one line. AI is not a separate risk category and banks do not have to define a separate risk appetite for it. It can be read through the grids that already exist (model management, technology, compliance, operational risk) and it is during these routine examinations that inspectors will have to ask the question of the software. A detail that will make you smile: the regulator never writes “artificial intelligence” but “Super Intelligence”, abbreviated SI, the vocabulary imposed by a presidential decree of October 2.
Three criteria structure the analysis, and none relates to the technical sophistication of the model. The text considers the potential consequences of a failure, the transfer of decision to the machine and the degree of human control that remains. Cross-reference them and you get four indicative risk tiers, based on Decrypt’s reading of the document. At the top are autonomous payment agents and real-time credit decisions, because a transfer that goes away doesn't come back.
AI agents at the account doors, JPMorgan had drawn the first
On October 13, JPMorgan Chase cut off direct access to its customer accounts to external agents, led by Muse de Meta and Instinct. Jamie Dimon summed up the house doctrine two days later: “You don’t want rogue agents”. Morgan Stanley in turn blocked it, Bank of America and Citi restricted access.
The OCC framework endorses this distrust without ever mentioning these banks. It places agents operated by clients, fintechs or other companies in the chapter of operational resilience and expects banks to provide identity verification, delegated permissions, transaction limits and the ability to cut off access. In terms of safeguards, the document cites circuit breakers, flow limits and an emergency stop button. The problem is not theoretical. Researchers from Cornell and Yale showed last week that crypto payment agents had granted themselves spending limits higher than those intended by their designers.
While banks lock down, crypto opens the floodgates. Coinbase's x402 protocol, which allows an agent to settle an API in USDC, recorded 138 million payments on Base in one year according to Chainalysis. Cloudflare distributes wallets to its agents and Stripe has been sending stablecoins to any wallet in more than 160 countries since Wednesday. These rails do not have an examiner or bulletin 2026-54.
What the OCC AI Framework Changes for the Average Customer
Nothing this morning, a lot in the next audit. A bank that deploys an agent capable of moving money will now have to prove to its inspector that it knows who is acting and up to what amount. Large brands already have their model governance teams. Regional banks, less so.
For you, the change will be seen in the refusals. A third-party assistant who attempts a transfer from your account will more and more often come up against a wall, as at JPMorgan since October. The bank will prefer its own agent, which it controls and for which it answers to the OCC.
