Reading time ~15 mins

The US national bank regulator ranks bank AI by consequence, sets no duty on banks and parts from Singapore and Hong Kong on board risk appetite. The Dutch privacy regulator's full report treats a risk score as a possible decision, and the AFM holds advisers to AI they did not know they bought. MIT finds none of 39 large financial firms naming multi-agent risk. State Street weighs one gateway for outside agents, and three banks arrange $63 billion for Anthropic's chips. OpenAI finds a safety test understated real behaviour, and BT tests an assistant that pushes back.

Regulatory

The US national bank regulator told its examiners to rank bank AI by consequence, with payment agents at the top. Authority

The Office of the Comptroller of the Currency (OCC), which supervises US national banks, issued a framework on 4 November for how its examiners assess bank AI. The OCC calls the subject Super Intelligence, after Executive Order 14434 of 2 October. The term covers what US law already called artificial intelligence and names no new class of system, so this brief writes AI. OCC Bulletin 2026-54 says the framework sets no supervisory expectations for banks, and that banks are not expected to use it to assess themselves. It is a guide for examiners, and the OCC intends to update it regularly. "Banks" here includes federal branches and agencies of foreign banking organisations, so a foreign group's US branch can meet it in an examination.

Examiners are to scale their work to what could go wrong, not to how advanced the technology is. A simple rules-based agent allowed to start transactions could carry more risk than a sophisticated model that only drafts text. The illustrative top tier lists autonomous payment agents, real-time credit decisions, the release of fraud holds and market access. AI-assisted underwriting and the handling of money-laundering alerts sit one tier lower. On human review, the text says approval may be designed to be more than "a nominal click", and that a bank may ask how many agents or alerts one person can credibly monitor. Amazon shows how live that question is. Its Smart Approvals feature in the Quick assistant, on by default, lets a classifier approve eligible actions instead of asking the user, it wrote on 4 November.

The sharpest point is risk appetite. Examiners should not treat AI as a separate risk category, and banks are not required to define a separate AI risk appetite, though the board may set one. Singapore, reported here on 13 October, and Hong Kong, on 20 October, put AI into the board's risk appetite. A group active in all three places gets different signals on one board-level question. The framework binds no EU bank directly and its tier list is illustrative. It still gives a supervisor's own ordering of payment, credit and fraud uses, with reversibility and human oversight counted ahead of model sophistication.

OCC: Supervisory Framework on Bank Use of Super Intelligence | OCC Bulletin 2026-54 | Amazon Web Services: Smart Approvals in Amazon Quick

The Dutch privacy regulator's full report says a risk score can itself count as an automated decision. Authority

On 30 October this brief reported the debt-collection survey by the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, from its press page. The 21-page report behind that page, also dated 29 October, goes further on three points. Under Article 22 of the GDPR, the EU privacy law, the AP says a decision is not only the end of a process. Intermediate steps such as calculating a risk score can count, and it cites the EU Court of Justice's SCHUFA ruling (C-634/21). The agencies said they use no automated decision-making. The AP wants that watched where staff trust the system too much or the system steers the outcome. Under the AI Act, it places systems that assess a person's willingness to meet payment obligations in the high-risk class, beside credit scoring. Debt collectors that build such systems themselves must comply from 2 December 2027, and those using them carry duties such as AI literacy and human oversight. The AP also says human oversight under the AI Act differs from human intervention under the GDPR.

The findings have limits. The AP picked 29 agencies, 17 of them because their websites mentioned AI. Of the 22 that gave usable answers, 10 reported an algorithmic system, three of those with AI. The AP says the results are not representative, and calls them the most favourable scenario because it asked only registered agencies. The report addresses debt collectors, not banks, and announces no enforcement step. Its reading turns on what a system assesses, not on who runs it, so it may also reach arrears and propensity-to-pay scores a bank runs or buys, including ones an employee signs off. McKinsey's map for AI agents in arrears handling, carried here on 4 November, proposes automation in the same process.

Autoriteit Persoonsgegevens: Automatische incasso, algoritmes en AI bij incassobureaus

The Dutch markets regulator says advisers stay responsible for AI output, including AI they did not know they bought. Authority

The Autoriteit Financiële Markten (AFM), the Dutch conduct regulator, published its 2026 report on licensed financial advisers and intermediaries on 4 November. Banks are not its subject. Most of the report rests on a questionnaire that 5,808 firms completed, but the AI chapter on pages 35 and 36 rests on conversations with no stated sample. Firms use AI mainly for internal work such as summaries and call notes, often without an explicit policy. Staff may use tools such as ChatGPT on their own initiative, and software is bought with AI functions the buyer does not know about. The AFM warns of makeshift AI without the necessary checks. It calls the step from internal to customer-facing use relatively small, and firms report competitive pressure. The firm always stays responsible for advice and brokerage built on AI output, whether it built the tool or a supplier did. The report also says cybercriminals' use of AI models is raising ICT risk, and cites Article 4:15(1) of the Dutch Financial Supervision Act on sound business operations. It announces no AI inspection round. Mortgages also reach customers through independent intermediaries, so AI that an adviser has not mapped can sit between a bank's product and its customer. The AFM does not say so, but the same accountability logic can apply to a bank that gives advice itself.

Autoriteit Financiële Markten: Sector in beeld financieel dienstverleners

Perspectives

An MIT team finds none of 39 large financial firms naming multi-agent AI risk in public, and proposes climate-style reporting Perspective

Peter Slattery, an MIT researcher who works on AI risk, posted on 3 November about a paper he co-wrote, Unmitigated? How are the world's largest companies responding to AI risks? It is dated October 2026 and comes from MIT FutureTech, by Alexander Saeri, Jess Graham, Michael Noetel, Peter Slattery, Kun Zhao, Eunice Zhang, Erin Howard and Neil Thompson. The team coded 539 public documents from 200 companies against 24 AI risks, then set the result against a panel of 272 experts. Peter Slattery writes: "We find that 32% of the world's 100 largest companies, and an estimated 62% of the 1,000 largest, had not publicly acknowledged any AI risks as of early 2026." The 62% is a weighted estimate with a range of 54% to 70%, which his post leaves out. On 15 October this brief carried the experts' ratings for finance. The new material is what companies actually said, set against those ratings.

His post gives no finance figures, but the paper's sector table does. Of the 21 financial firms in the top 100, 52% named AI fraud, 48% discrimination, 43% AI-enabled cyberattacks and 29% loss of privacy. Only 10% named weaknesses in AI systems themselves. Experts rate finance Extreme on 17 risks, and no top-100 financial firm named seven of them. Those seven are overreliance, unequal performance, loss of human agency, dangerous capabilities, AI misalignment, multi-agent risks and power centralization. Six of the seven stay at zero across all 39 financial firms sampled, with overreliance the exception. Multi-agent risks are what can go wrong when AI agents interact, through conflict, collusion or cascading failure. Among the top 100, only companies in the Information sector named them at all.

That row needs care. Only 12 of the 21 carry a commercial banking code, and the rest include card networks, insurers and asset managers. No Dutch bank appears in the paper. The only EU banks named are PKO Bank Polski and Svenska Handelsbanken, and no result is given for either. The ranking covers listed companies, so unlisted banks cannot appear. A zero means the risk was absent from the documents collected, and general risk text not tied explicitly to AI did not count. The searches ended on 15 February 2026 and 85% of the documents date from 2024 or 2025, so the zeros on agent risks may partly reflect timing.

Across all sectors, severity and acknowledgement were uncorrelated. No top-100 company named power centralization or competitive dynamics, and four named dangerous capabilities. Peter Slattery writes: "Companies mostly disclose risks that affect their operations." He adds: "Risks to markets, institutions, and the public were largely unmentioned, even by the companies judged most responsible for addressing them." The paper is more careful, saying only that its results are consistent with earlier disclosure research. For a bank the zero on competitive dynamics means little, since that risk describes a race among AI developers and states. The zeros on agents and overreliance say more.

The proposal reaches finance directly. Peter Slattery writes: "Regulators and investors should set expectations similar to climate reporting." The paper sets out three tiers, with a small common core for all large companies, added risks where a sector is judged vulnerable, and added risks where a company's AI role carries responsibility. All large financial institutions would report on AI-enabled cyber threats and AI fraud. His post stops there for banks. The paper adds that those deploying AI would report on multi-agent risks too, the item furthest from current practice. Reports would also link each mitigation to the risk it addresses. Of the top 100, 71 reported a mitigation, but so few gave enough detail that the authors dropped their planned analysis of those links. The paper answers the obvious security objection by saying that naming a risk does not require a firm to disclose its preparedness.

None of this is a rule. The paper names no regulator, mechanism or date, and places corporate AI risk disclosure at the start of the path climate reporting took from voluntary to mandate. It says the EU AI Act's disclosure duties are notices at the point of use and technical documentation. DORA, the EU's digital resilience law, will capture IT or cyber-related AI incidents, it says, but was not designed for AI risks. The authors call disclosure an imperfect proxy for recognition, because a firm may manage a risk it does not name. Commonwealth Bank of Australia funded the work and reviewed its design, and the tiers lean on ratings from the same team. Its value for a bank is narrower and nearer. The risk section of a 2026 annual report is being written now, and this table is an outside record of what large financial firms named and left out. The seven zeros mark where naming a risk is still a free choice, and multi-agent risk grows with a bank's own use of agents.

MIT FutureTech via LinkedIn (By Peter Slattery)

Industry & competition

State Street's data chief says no agent-to-agent standard exists for banks, and it is considering one gateway for outside agents. Media

Manoj Bohra, State Street's chief data and AI officer, spoke at the Global Financial Leaders' Investment Summit in Hong Kong, the South China Morning Post reported on 4 November. He said the US custody bank has more than 350 AI use cases, up from around 150 last year. The article does not say how many are in production. A standard for agents to talk to each other would be ideal, he said, and the industry is far from one. An agent from one company entering another, he said, would be a foreign object sitting in your company. State Street is considering a gateway as the only way agents communicate, with each agent given a predefined identity and only the entitlements needed for that customer and process. He gave no date or deployment, and this is one executive's account to one newspaper. Royal Bank of Canada's block on 29 October and Wells Fargo's terms on 3 November concerned retail customers' agents. This is the institutional case, where the agent at the door belongs to a counterparty. The OCC framework published the same day says agents a bank does not control could present channel risk, so the question has reached examiners while the design is still open.

South China Morning Post: Banks must be 'responsible' as industry races to deploy AI agents: State Street

Three US banks are arranging first-lien debt in a $63 billion vehicle that leases AI chips to Anthropic. Corporate

Bank of America announced on 26 October a $63 billion transaction with Blackstone, Citi and Morgan Stanley to fund computing capacity for Anthropic, the maker of the Claude AI models. A new special purpose vehicle will buy accelerators, the chips that run AI models, and networking equipment using Broadcom technology, and lease them to Anthropic. Bank of America, Citi and Morgan Stanley arrange the first-lien financing, which ranks first for repayment. Blackstone provides committed second-lien financing, and Broadcom supports the residual value of the hardware. Deliveries are expected from 2027. The release gives no pricing, returns or further detail on who carries which risk. On 29 October this brief carried the Bank for International Settlements and an ECB supervisor tracing AI data-centre debt towards banks through leases and special purpose vehicles. This deal is a named example at a stated size. Senior bank debt sits against chips whose later value leans on a supplier's backing, and Anthropic's amended filing, reported here on 4 November, puts computing at 58% of revenue.

Bank of America

NVIDIA says Revolut and Lloyds have built AI models on their own transaction data, and shows scale but no results. Vendor

NVIDIA's blog from its Berlin event, published 22 October, says Revolut is rebuilding its technology on one foundation model called PRAGMA. A foundation model is a large AI model trained on broad data and then adapted to many tasks. NVIDIA describes it as in production for an initial 80 million customers and engineered to scale threefold. It says Lloyds Banking Group built ATUM, a model trained on transactions. Starling's model ran here on 15 October, and Plaid's on 13 October. NVIDIA sells the chips, gives no outcomes and says nothing about how the models are governed, so none of this is a measured benchmark. Taken together, though, the names show several banks treating their own transaction records as the raw material for a model, instead of buying one built on other firms' data.

NVIDIA Blog

Research

OpenAI found its agent safety test understated safe behaviour by 10 to 37 points against matched real work. Vendor

OpenAI's alignment team published Eval-production behavior gaps in agent safety and the role of eval-awareness on 3 November. It compares one safety test, Respecting Warnings, which checks whether an agent heeds warnings and restrictions during a task, with selected cases from real use of its Codex coding agent. Across six models, success in the test was 10.2 to 37.4 percentage points lower than on matched production cases. OpenAI calls that direction unexpected, because the common worry is that models spot a test and look safer. Simply knowing it was a test made little difference. In one trial on GPT-6.1 Sol, a general cue that this was an evaluation left success at about 63%. A cue naming the correct objective moved it to 91.6%, and one naming the opposing objective moved it to 17.6%. What a model believes the test is checking appears to matter more than knowing it is a test.

This is a vendor's unreviewed study of its own models and logs. Matching is approximate, the number of matched cases is undisclosed and the work is coding, not banking. Test and production results moved together across the six models, but their order differed. On 30 October this brief carried the UK AI Security Institute's doubt about what clean test results prove, which points the other way. Read together, the two leave a published safety percentage weak as a forecast of what a bank's own deployment would show, in either direction.

OpenAI: Eval-production behavior gaps in agent safety and the role of eval-awareness

BT's trial with 2,400 staff found a challenging AI assistant produced 3.5 times as many excellent goals as a default one. Corporate

Authors from BT Group, the UK telecoms firm, and the behavioural consultancy MoreThanNow reported a randomised trial in Harvard Business Review on 4 November, under the title What Sycophantic AI Can Cost Your Organization. In it, 2,400 participants set annual goals. One group had no AI tool, a second had an assistant built to mirror existing enterprise tools, and a third had a challenger that pushed for ambition and specifics. The authors report three and a half times as many goals rated excellent in the challenger group as in either other group, with no difference in enjoyment or psychological safety. BT is building the approach into goal setting. The figure needs care. An AI tool rated the goals on ambition and specificity, the qualities the challenger coaches, and the authors then checked the ratings. The result may therefore partly measure fit to the rubric, and there is no later performance data. The authors are BT staff and its advisers. On 3 November this brief carried an Anthropic trial in which experts followed an agent's assigned lean on 86% of open choices. Both studies treat an assistant's default manner as a design choice with measurable effects, and a bank that takes a vendor's default has made that choice without testing it.

Harvard Business Review: What Sycophantic AI Can Cost Your Organization

Security

MITRE will give AI systems their own platform in the catalogue security teams report their coverage against. Institute

On 20 October this brief reported that MITRE, the US non-profit behind ATT&CK, had added four AI techniques to that public catalogue of attacker methods. At its ATT&CKcon 7.0 conference on 27 October it announced the next step. ATT&CK Enterprise will add AI-enabled systems as a platform of its own, beside Windows, Cloud and Network Devices, early next year. The platform will cover techniques such as prompt injection, meaning instructions planted in what an AI system reads, and poisoning of AI results. Part of the content will come from MITRE ATLAS, its knowledge base on threats to AI systems, and dedicated staff will build the rest. The catalogue binds no one and the content is not yet out. It matters because security operations teams and managed detection providers already report against it. A full platform would turn October's four techniques into a standing line. A bank's AI systems could then sit in the same coverage report as its Windows estate, with missing logs showing as a gap.

MITRE

On the radar

• Cloudflare disclosed on 26 October that 155 responses from one hosted AI model carried data from other customers' requests between 27 August and 9 September, a fault its launch checks on status codes and speed did not catch and which it has since fixed. Cloudflare Blog