Bank Regulators Probe Agentic AI Shutdown Controls

Financial institutions deploying AI agents should be able to show who authorized each system, what it can do, where human approval remains mandatory and how it can be stopped without losing control of the underlying process. Reported questions from U.S. bank supervisors make that evidence—not general AI policy—the immediate operating test.

Reuters reported October 13 that the Federal Reserve, Office of the Comptroller of the Currency and Federal Deposit Insurance Corporation have asked banks about advanced and agentic AI. The inquiries reportedly cover large, midsize and small banks and ask about systems that may exceed their authority, the role of people in approvals, monitoring and audit trails, and the ability to shut down an AI system.

The agencies declined to comment to Reuters. The reporting describes information gathering, not a new rule, formal guidance or enforcement action. It also does not say the National Credit Union Administration has opened the same inquiry. Credit-union leaders should therefore treat the development as a supervisory signal from adjacent banking regulators—not as a new NCUA requirement.

Reuters also reported questions about the use of Chinese AI models and agents in cyber defense. Those issues should be separated in an institution's evidence. Model provenance and hosting affect data, legal and supply-chain risk; an agent's ability to take defensive action affects operating authority. A credit union may accept one risk while prohibiting the other, but only if the inventory and approval record distinguish them.

A signal, not a new credit-union rule

The signal still aligns with existing credit-union guidance. The NCUA's current artificial-intelligence resource identifies operational resilience, model risk, member privacy, fair lending, due diligence and ongoing third-party monitoring among the issues credit unions should consider when evaluating AI.

Interagency examination guidance also gives institutions a practical baseline. The Federal Financial Institutions Examination Council's development, acquisition and maintenance booklet emphasizes governance, change management, resilience and the risks created by interconnected technologies and third parties. Agentic AI raises the same disciplines with a harder question: can the institution reconstruct and reverse a chain of machine-initiated actions?

Build evidence around authority and recovery

Start with an inventory that names the accountable business owner, technical owner and risk approver for every agent. Record the data, tools and systems each agent can reach; the decisions it can recommend; the actions it can take; and the actions it is prohibited from taking. A label such as “human in the loop” is not enough. The record should identify the exact checkpoint, approver and fallback path.

Logs should preserve the inputs, retrieved evidence, actions, approvals, exceptions and configuration or model version needed to reconstruct a consequential event. That matters when an agent chains several tools together: a final transaction record may not explain why the system selected a member, changed a parameter or invoked another service.

Shutdown testing should cover more than disabling the user interface. Teams need to know whether queued actions stop, credentials are revoked, downstream systems remain consistent, incomplete work is reconciled and the process can restart from a known state. Test those controls under realistic failure conditions and retain the results, owners and unresolved exceptions.

Useful scenarios include a compromised credential, a bad model or prompt update, an unavailable third-party tool, an agent repeatedly retrying an action, and conflicting instructions between systems. Each exercise should show how monitoring detects the condition, who can halt activity, which member-facing processes continue, and how staff confirm that recovery did not duplicate or omit transactions.

Vendor contracts and reviews should support the same evidence. Credit unions need visibility into dependencies and subprocessors, access to usable logs, notification of material changes or incidents, and tested arrangements for data return, recovery and transition. If a provider controls the only stop mechanism or audit record, the institution may not be able to demonstrate control when it matters.

The banking-regulator inquiries may evolve, and credit-union examiners may frame the issue differently. The useful move now is not to predict a future checklist. It is to test whether an institution can prove an agent stayed within authority, a person could intervene, and operations can recover cleanly. Our coverage of AI-accelerated financial-system risk and AI inventory and change control offers additional evidence tests.