Could Rogue AI Threaten The Global Banking System? Regulators Are Growing Increasingly Worried

Banking regulators in the United States and Europe are stepping up scrutiny of artificial intelligence systems amid growing concerns that rogue AI agents and sophisticated cyberattacks could disrupt financial institutions and threaten global financial stability.

The Federal Reserve, Federal Deposit Insurance Corporation (FDIC) and Office of the Comptroller of the Currency (OCC) have been questioning banks about their use of advanced AI, including whether autonomous systems can be monitored, controlled and shut down if they behave unexpectedly.

The inquiries extend to large, midsize and smaller lenders, according to an exclusive Reuters investigation published Tuesday, citing people familiar with regulatory discussions in the U.S. and Europe.

Supervisors are examining the use of Chinese-developed AI technology, the deployment of autonomous agents in cybersecurity operations and safeguards to prevent systems from acting beyond their assigned authority.

The increased scrutiny comes as banks adopt agentic AI, technology capable of performing tasks and making decisions with limited human intervention, while regulators assess whether existing security controls can keep pace with its development.

The U.S. inquiries focus on whether banks use AI agents to identify cyber threats, prioritize vulnerabilities and respond to security incidents without continuous human supervision.

Regulators are asking what restrictions apply to these systems, how their decisions are recorded and whether employees must approve sensitive actions, according to the people cited by Reuters.

They also want to know whether banks can prevent autonomous agents from exceeding their authority and disable them when necessary.

The concerns extend beyond systems deployed directly by banks to their dependence on outside technology providers, whose products may be used by multiple financial institutions.

European regulators have already taken steps to strengthen defenses against AI-enabled cyber threats. In a July 7 letter to major eurozone lenders, the European Central Bank (ECB) instructed banks to develop comprehensive cybersecurity action plans addressing vulnerabilities, monitoring systems, external technology providers and recovery procedures. The plans must be submitted by October 31, 2026.

The ECB called for faster security updates, stronger threat detection and improvements to aging technology infrastructure. It also emphasized the need for tested backup and recovery arrangements to restore critical operations following a serious incident.

British supervisors are separately encouraging major banks to examine recovery systems that operate independently of their primary technology infrastructure, according to Reuters.

Such arrangements, sometimes known as bare-metal recovery systems, are designed to restore essential banking operations when primary networks have been compromised.

However, developing and maintaining these systems can be expensive, and British authorities are seeking to work with banks rather than immediately introduce additional requirements.

The Bank of England warned in its July Financial Stability Report that advances in frontier AI were increasing the speed and sophistication of cyber threats against financial institutions.

It identified the potential for disruptions to spread across banks and financial market infrastructure through vulnerabilities in widely used software and shared technology providers.

The regulatory push coincides with warnings about the broader financial consequences of major cyber incidents.

In its October Global Financial Stability Report, the International Monetary Fund (IMF) identified cyber threats among the vulnerabilities facing global markets and called for stronger cybersecurity capabilities. A serious attack affecting a critical financial institution or shared technology provider could disrupt essential services and undermine market confidence, the document noted.