Global Banking Regulators Intensify AI Risk Scrutiny, Focusing on Cybersecurity and Autonomous System Failures
nashnova research
Major banking regulators in the US and Europe are simultaneously escalating AI risk reviews, driven by fears that AI-powered cyberattacks and runaway autonomous systems could destabilize the global financial system — marking the first time regulators are reclassifying AI from an efficiency tool to a systemic risk source.
What are US regulators asking banks?
The Fed, OCC and FDIC are sending inquiries to banks covering: whether they deploy AI technology developed in China, whether they use AI agents for cyber defense, and whether they can control increasingly autonomous AI systems.
Regulators are drilling into four specifics: what permission boundaries AI systems have, how their actions are monitored and approved, whether humans remain in critical decisions, and whether banks can shut autonomous systems down when needed.
This means → regulators' core concern is not whether banks use AI — it is whether banks can pull the plug when AI goes wrong.
How does Europe's focus differ?
The Bank of England and the ECB are pressing banks to strengthen disaster-recovery plans. Three people familiar with their stance say regulators fear AI disruption to markets could arrive sooner than expected.
A senior executive at a large European bank said the institution shares concerns that the industry could sustain major losses "within six months."
UK regulators are separately encouraging major banks to review "bare-metal recovery" — rebuilding systems from scratch after total destruction. In plain terms = regulators are asking: if AI crashes your entire infrastructure, can you stand back up from a blank server?
Which incidents accelerated this push?
Cybersecurity firm CrowdStrike disclosed this month that a China-based individual may have used a Chinese-developed AI agent and Anthropic's Claude Code tool to launch a cyberattack on South Korean banks.
An AI agent built by OpenAI was linked to a security breach at AI platform Hugging Face.
This means → attackers are already weaponizing AI agents — this is no longer theoretical, and regulators have been forced to shift from observation to action.
What are international bodies and industry leaders saying?
The IMF warned this week that global markets must not be "complacent," listing cyberattacks as a near-term credible risk. A major attack on a critical financial institution could rapidly erode market confidence.
JPMorgan CEO Jamie Dimon called on business leaders to join a US-centered industry body to address AI risk collectively.
Michael Woodbridge, cybersecurity partner at Grant Thornton in London, noted: "The pace of AI adoption often outstrips the ability to build necessary controls."
Can regulation outpace the technology?
US and European regulators are still in the information-gathering phase and have not yet imposed prescriptive requirements on banks.
Banks, meanwhile, are racing to deploy "agentic AI" — systems that complete tasks with minimal human oversight.
This reflects a core tension: the technology is accelerating while the rules have not landed. Whether regulators can build a framework before AI agents scale across banking will determine if the next wave of financial risk is contained — or uncontrolled.
市场有风险，内容仅供研究参考，不构成投资建议。