Regulatory authorities in the United States and Europe are moving to tighten oversight of artificial intelligence risks in the banking sector, amid warnings of sophisticated cyberattacks that could threaten the stability of financial markets and disrupt banking services.
According to Reuters, citing six informed sources, regulators have intensified their inquiries regarding banks' use of advanced AI technologies, their ability to control autonomous systems, monitor their decisions, and ensure they do not exceed their granted authority.
In the United States, these efforts include the Federal Reserve, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation, which are seeking to understand how banks use these technologies—including models developed in China—as well as the mechanisms for approving and reviewing their decisions, and the role of human oversight in sensitive operations.
So far, regulators are still gathering information without issuing new, specific instructions requiring banks to take particular actions.
Europe strengthens plans to counter attacks
In Europe, the European Central Bank and the Bank of England are increasing pressure on banking institutions to strengthen their cyberattack response and recovery plans, amid fears that rapid developments in AI could enable more complex and faster attacks.
Last July, the European Central Bank gave banks until the end of October to submit plans to counter AI-supported cyber threats, including improving data backups and enhancing system and service recovery capabilities.
In Britain, supervisors are encouraging the largest banks to consider creating recovery systems independent of their core technological infrastructure, so they can be operated if primary systems are compromised. However, the high costs of building and maintaining these systems pose a challenge to their widespread implementation.
Sukand Ramachandran of the Boston Consulting Group emphasized that the speed of recovery from attacks is just as important as prevention, warning that the absence of secure, separate data backups could lead to customers being denied access to their accounts and widespread disruption of payments.
Cyber incidents raise alert levels
Concerns have grown following reports of the use of AI agents in cyberattacks. The cybersecurity firm CrowdStrike stated that an individual, likely based in China, used an AI agent developed there, along with Anthropic's "Claude Code" tool, in an attack targeting South Korean banks.
Reuters also reported that autonomous AI agents developed by OpenAI were involved in breaching the "Hugging Face" platform, which has once again highlighted the risks of systems capable of executing tasks with minimal human supervision.
In the same context, the International Monetary Fund warned against complacency regarding risks facing global financial markets, noting that a large-scale cyberattack targeting a financial institution or vital service could undermine confidence in the financial system, and called on policymakers to strengthen cybersecurity defense capabilities.
Innovation race poses new challenges for banks
Banking institutions are racing to adopt agent-based AI due to its ability to perform tasks more independently and efficiently. However, this expansion raises questions about the banks' ability to control these systems, especially with persistent IT vulnerabilities and increasing reliance on third-party service providers.
Experts believe the primary challenge lies in striking a balance between leveraging AI's potential and strengthening security controls, ensuring the rapid detection of attacks, containment of their effects, and restoration of services before disruptions spread to the rest of the financial system.
