Regulators Ramp up Scrutiny on Banks Fearing AI Could 'Lock Customers Out of Their Accounts'

Banking watchdogs on both sides of the Atlantic are quietly stepping up scrutiny of lenders' use of artificial intelligence amid fears that fast‑moving systems could be hijacked or misfire in ways that threaten customer access and wider financial stability, according to six people familiar with the matter.

Reuters reported earlier this year that US bank regulators were already probing AI use at financial firms. The latest details are being reported for the first time. They suggest regulators may need costly cyber‑recovery investment, closer attention to outside technology providers and, in some places, more formal guidance.

US Supervisors Quiz Banks on Autonomous AI

Three top US regulators, including the Federal Reserve, are questioning banks about advanced AI models, two of the people said. Those questions include whether lenders deploy Chinese‑developed technology, use AI agents in cyber defence and can control increasingly autonomous systems, three of the people said.

The Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC) and the Fed are also asking about limits placed on these systems, two of the people said.

They want to know how actions are monitored and approved, and whether banks can clearly track and audit AI agent decisions. Safeguards against agents exceeding their authority, human involvement in key decisions and ways to shut down autonomous systems are on the list too.

The OCC, the Fed and the FDIC declined to comment. The written and verbal inquiries have gone to large, mid‑size and smaller banks, according to three people with knowledge of regulators' thinking. Regulators are still gathering information and are not yet being prescriptive about what lenders should do, they added.

'The adoption of AI is often outpacing the ability to put the controls in place,' said Michael Woodbridge, London‑based cybersecurity partner at Grant Thornton.

Europe Pushes Recovery Plans as AI Risks Loom

Across the Atlantic, supervisors including the Bank of England and the European Central Bank are pressing banks to improve recovery plans, three people said. Their concern is that rapid AI advances could cause serious harm and disruption in financial markets sooner than previously expected.

One senior executive at a large European bank said they were also worried about major damage to banking and financial markets within six months.

British supervisors are separately encouraging the largest banks to examine so‑called bare metal recovery plans, two of the people said. These systems sit entirely apart from a bank's main tech set‑up and can kick in if primary operating systems are compromised. They are expensive to build and maintain, the people added.

UK authorities do not plan new requirements, the sources said, preferring to work collaboratively with industry. The Bank of England declined to comment.

The ECB, for its part, gave lenders an end‑October deadline in July to produce plans against AI‑enabled cyber threats, including improved back‑up and recovery. Asked about its AI strategy, it pointed to that letter and a June speech by board member Frank Elderson. He stressed the need to create a sense of urgency, not alarm.

Why the AI Warnings Keep Multiplying

Recent incidents have intensified the debate. US cybersecurity company CrowdStrike said this month that a person in China likely used a Chinese‑developed AI agent and Anthropic's Claude Code in a hack on South Korean banks. Reuters has also reported that rogue AI agents developed by OpenAI were involved in a breach of the AI platform Hugging Face.

The International Monetary Fund warned on Tuesday against 'complacency' in global financial markets, citing risks including cyberattacks. It said a major attack on a critical service or financial institution could undermine confidence, and urged policymakers to boost cybersecurity capacity.

Meanwhile, banks are racing to adopt agentic AI, which can complete tasks with minimal human supervision. They are also dealing with IT weaknesses flagged by Anthropic's Mythos tool, and European regulators have voiced frustration at limited access to it this year.

Some of the early signals are cautiously positive. UK supervisors are asking banks to use frontier AI to find vulnerabilities and speed up patching, and one source said lenders were doing a good job so far.

Eurozone banks are being asked to map AI use across their businesses and third‑party providers, so they can switch systems off and restart them in a controlled way. Significant gaps remained at some firms, the third person said.

Sukand Ramachandran, managing director and senior partner at BCG, said rapid recovery matters as much as prevention. Without separately held clean, secure copies of critical data, he told Reuters, 'a serious attack could lock customers out of their accounts and disrupt payments across the wider economy'.