OCC Issues Supervisory Framework for Super Intelligence in Banking
FOR IMMEDIATE RELEASE
By Eric Postow, Esq., Chief Strategy Officer, Holon Law Partners
Fairfax, Virginia — November 4, 2026 – The Office of the Comptroller of the Currency today published a supervisory framework that guides how examiners will evaluate national banks’ use of what the agency now calls Super Intelligence (SI) in the ordinary course of business, including credit decisioning, payments, fraud detection, customer service, operations, risk management, and market activities. Holon Law Partners considers the framework essential reading for anyone who wants to understand how Super Intelligence is being introduced into agency-level oversight of banking institutions and for the boards, executives, and counsel who will be expected to answer for it. More broadly, the framework offers an early window into how federal agencies are approaching the oversight of SI across the sectors they regulate.
The full framework is available from the OCC at occ.gov.
Risk Management Frameworks Are the Center of Gravity
The framework places SI within the risk management frameworks banks already maintain, and it instructs examiners that SI should not be treated as a separate and distinct risk category. The working premise is that SI can introduce, amplify, or modify risk across a bank’s existing activities, and that those risks should be identified, measured, monitored, and controlled within the bank’s established risk management framework. The guidance is organized around six pillars of purpose, risk, control, oversight, resilience, and assurance, and it extends familiar disciplines such as model risk management, data governance, privacy, compliance, cybersecurity, third-party risk, and internal audit to account for generative and agentic systems.
Consequences Over Sophistication
The most consequential choice the OCC has made is in how it measures risk. The agency will evaluate SI by its potential consequences, the transfer of agency to the system, and the degree of human oversight, rather than by the technical sophistication of the SI being used. Control intensity is to be measured relative to the potential consequences of an SI agent’s failure or misuse, which leads the framework to observe that a simple rules-based agent authorized to initiate transactions could present greater risk than a far more sophisticated model that only drafts text. Human oversight is expected to be meaningful as well, carried out by reviewers with the competency, authority, and capacity to intervene, with overrides and escalations logged and human involvement increased after a misfire or control breach.
Proportionality and the Materiality Spectrum
The OCC expects controls to be proportionate to the nature, consequences, autonomy, and complexity of each SI use case, and examiners are directed to weigh a bank’s size, complexity, and risk profile in applying the guidance. Materiality runs along a spectrum, which the framework illustrates with a four-tier model that moves from critical uses involving direct and largely irreversible action, such as autonomous payment agents and real-time credit decisioning, through high and moderate tiers involving decision support under human-on-the-loop or human-in-the-loop review, down to low-risk internal productivity tools with no customer or financial data exposure. A fully autonomous, customer-facing payment agent sits at the top tier regardless of how well it performs in testing.
From Risk to Litigation
The path from risk to litigation is becoming more apparent, and those with a stake in it should pay close attention. The framework makes clear that accountability for managing the bank’s risk generally remains with the bank, including when SI is sourced from third parties, which puts vendor contracts, data-use limits, incident notification timelines, and liability and indemnification provisions under new scrutiny. Its expectations for decision traceability, version control, documentation, and independent audit will shape the evidentiary record available when an SI-driven decision is challenged, and its attention to hallucinated statements about fees, rates, or account status connects SI performance directly to consumer compliance exposure. As supervisory expectations of this kind mature, they are likely to inform how regulators, courts, and counterparties assess whether a bank exercised reasonable care in deploying SI. The OCC notes that the framework itself was prepared with the assistance of SI and then reviewed, edited, and approved by a human, which is a fitting illustration of the oversight model it describes.
A Window Into the Wider Federal Picture
The OCC framework is one part of a larger whole that is still taking shape. It follows Executive Order 14434 of October 2, 2026, which it cites, and it describes itself as a living document to be updated as the technology and supervisory understanding evolve. We expect other federal agencies to issue their own guidance in the months ahead, and each release will add to a fuller understanding of how consequence, agency, and human oversight are becoming the shared vocabulary of SI governance. The lasting value for clients will come from reading these pieces together, because the way one regulator frames accountability for an SI agent tends to shape how other regulators, courts, and counterparties come to view the same conduct. Holon will continue to follow this guidance as it develops and to assess each new piece in relation to the whole.
About Holon Law Partners
Holon Law Partners, LLP is a fully virtual boutique law firm with a national footprint and an emerging presence in the European Union. The firm’s Emerging Technologies practice advises clients on AI governance, risk, and regulatory strategy, and works alongside its Regulated and Emerging Industries, Litigation, Corporate Transactions, and Employment practices to give clients assessments that account for the full picture of how new technology reshapes their legal exposure.
