Bank Supervisors Ramp Up AI Checks as Cyber Threat Concerns Grow

Bank supervisors in the United States and Europe are intensifying checks on the use of advanced artificial intelligence in the banking sector. In the U.S., the Federal Reserve, the federal banking regulator and the deposit insurance agency have begun questioning banks about AI tools that can act on their own, especially those built abroad or used for cyber defence. They want to know if banks can limit such tools, keep humans in the loop and shut them down if needed. European authorities, including the Bank of England and the European Central Bank, are urging banks to strengthen backup systems that can run without the main IT set‑up, known as bare‑metal recovery plans, after warning that AI could cause market turmoil within six months. The ECB has set an end‑October deadline for lenders to outline how they will guard against AI‑driven cyber attacks and improve data backups. Industry voices are echoing the regulators’ worries. JPMorgan chief Jamie Dimon has asked companies to join a U.S.‑focused group to tackle AI risks. A Chinese‑based hack on South Korean banks, reported by CrowdStrike, used a locally developed AI model and Anthropic’s Claude Code, while OpenAI‑linked agents were tied to a breach of the Hugging Face platform. Researchers at Anthropic have warned that ever‑more powerful AI could one day slip beyond human control, prompting calls for tighter rules. Grant Thornton’s cyber partner Michael Woodbridge said banks often adopt AI faster than they can put safety checks in place. Regulators say they are still gathering information and have not issued firm rules yet, but their inquiries cover AI agents, foreign‑made models and new cyber vulnerabilities. UK supervisors plan to work with banks rather than impose fresh mandates, while European banks are mapping AI use across their operations to ensure they can switch systems off safely.

Context

These moves reflect a global push to keep fast‑moving AI technology from creating new ways for hackers to strike banks, and to make sure banks can recover quickly if AI‑related failures occur.