The Bank Examiner Cares What the Agent Can Do

Key takeaways

Operational exposure depends on permissions, autonomy and consequences, not model sophistication alone.
The OCC framework guides examiners and creates no new bank training obligations.
Role/action matrices connect workflow controls to specific employee decisions.
Scenario assessments reveal whether employees can verify, approve, stop and escalate.
Learning records become more useful when linked to policy and permission changes.

The Bank Examiner Cares What the Agent Can Do

Examiner guidance is not a training mandate

On 4 November 2026, the U.S. Office of the Comptroller of the Currency published Bulletin 2026-54 and an examiner-facing framework. Its official title uses “Super Intelligence,” encompassing technologies previously described as AI. The bulletin explicitly creates no new supervisory expectations, enforceable standards or prescriptive requirements; banks are not expected to assess themselves against it. (occ.gov) It is not a new training mandate.

The OCC AI supervisory framework allows risk classification to reflect consequences, transferred decision authority and human oversight rather than technical sophistication. (occ.gov) That suggests a curriculum principle, not a regulatory instruction: bank AI agent training should follow what the system and employee are permitted to do.

Three workflows require different decision practice

Consider three illustrative configurations. Their exposure changes when permissions, data or downstream reliance change.

Document summarization stays internal, uses approved non-sensitive material and informs no consequential decision. Practice finding omissions and checking source passages.
Customer-facing recommendation drafting stops before delivery. Practice checking product terms, customer context and the required review before release.
Transaction initiation reaches a payment workflow. Practice verifying beneficiary details, approval status and stop conditions before any permitted action.

Matrix linking three banking AI tasks to impact, autonomy, human review and employee practice drills. — Train employees for what AI may do—and when to verify, approve, stop or escalate.

The role/action matrix comes before modules

The framework describes meaningful oversight in terms of expertise, information and authority to reject, modify, pause or halt an action. (occ.gov) A proposed training matrix makes those distinctions concrete across the three workflows.

Observer flags unsupported summaries, questionable recommendations and payment anomalies without granting approval.
Reviewer checks summary sources, recommendation evidence and transaction details against approved records.
Approver authorizes defined downstream use, customer delivery or payment progression only within delegated authority.
Incident owner coordinates containment, evidence preservation and recovery when any workflow crosses its permitted boundary.

Bank owners define these rights and technical controls. Learning teams translate them into practice; course completion never grants production permissions.

Decision drills expose unsafe confidence

In one AI scenario training drill, a recommendation draft promises a fee waiver absent from the approved product terms. The reviewer must identify the unsupported claim, withhold release and route the exception to the designated owner.

In another, a payment agent presents changed beneficiary details and claims that approval exists, but the authoritative record shows none. The employee must stop progression, verify through the approved channel and escalate without inventing authority.

A proposed rubric awards one point each for detecting the failure, selecting the correct control, identifying the responsible owner and recording a defensible reason. An unsafe release fails the drill regardless of total points.

Readiness evidence needs a policy version

Completion records show participation. Decision records show how someone handled a defined case—not whether production controls work.

For risk-based AI governance, a useful evidence design links role, workflow permissions, policy version, scenario decisions and remediation. Changes to approval thresholds or tool access should trigger review of the affected exercises. App-Learning can support this layer through policy-linked microlearning and scenario evidence, while the bank retains control ownership and readiness decisions.

Build role-specific AI decision drills with App-Learning.

Discuss

Local obligations remain local

The OCC’s revised model-risk guidance of 17 April 2026 excludes generative and agentic AI from its scope. (occ.gov) Publication and implementation reviews therefore need more than a familiar model-risk reference.

The FSB’s October 2026 sound practices provide international context on governance and human oversight. (fsb.org) Cross-border programs still need jurisdiction-specific review against applicable banking rules and internal policies.

The practical starting point is one controlled workflow, named decision owners and tested boundaries. The goal is not fluency about models. It is reliable judgment at the moment an agent’s output becomes a bank action.