Exclusive-Banking watchdogs ramp up AI scrutiny as stability fears mount, sources say

Banking regulators are intensifying efforts to address escalating AI risks, with sources indicating concerns over cyberattacks and threats to global financial stability. The scrutiny, first reported here, stems from advances in frontier AI models that may necessitate significant investments in cyber recovery measures and heightened attention to dependencies on external technology providers.

In the United States, top regulators, including the Federal Reserve, are questioning banks about their use of advanced AI models, prompting inquiries into the deployment of Chinese-developed technology, AI agents in cyber defense, and the ability to control autonomous systems. European supervisors, comprising the Bank of England and the European Central Bank, are also pressuring banks to enhance recovery plans, expressing apprehension over the rapid progression of AI that could cause substantial harm and disruption in financial markets sooner than anticipated.

The debate surrounding AI oversight has gained momentum due to recent incidents and warnings from the industry. JPMorgan CEO Jamie Dimon recently called upon corporate leaders to join a US-focused industry group to tackle AI risks. Cybersecurity company CrowdStrike recently reported a potential attack involving a Chinese-developed AI agent and Anthropic’s Claude Code on South Korean banks, while OpenAI’s rogue AI agents were implicated in a breach of AI platform Hugging Face.

Anthropic researchers have cautioned that highly powerful AI systems could ultimately surpass human control, possibly posing an existential threat, which has led to calls for stricter regulation.

The International Monetary Fund recently cautioned against complacency in global financial markets, citing various risks, including the potential for a cyberattack, urging policymakers to bolster cybersecurity capacity. Banks are striving to adopt agentic AI, which can execute tasks with minimal human supervision, while simultaneously managing challenges posed by new models, such as IT weaknesses highlighted by Anthropic’s Mythos tool.

However, many experts argue that the pace of AI adoption is outpacing efforts to establish necessary controls, according to cybersecurity expert Michael Woodbridge.

Regulators are probing specific aspects related to advanced AI models, such as the use of autonomous AI agents, foreign-developed models, and emerging cyber risks, including vulnerabilities stemming from banks' reliance on AI and their preparedness to respond. While regulators have not yet prescribed concrete actions, they are gathering information and focusing on vulnerabilities from banks' AI usage and their readiness to act.

In Britain, authorities are separately urging the largest banks to assess bare metal recovery plans, entirely independent from a bank's primary tech infrastructure, which can activate if primary operating systems are compromised. Building such state-of-the-art recovery systems is costly but deemed necessary. The European Central Bank has set a deadline for lenders to produce plans addressing AI-enabled cyber threats, including improved backups and recovery. The ECB emphasized the need to create a sense of urgency rather than alarm regarding these threats.