OCC Agentic AI Framework: What Bank Executives Need to Know About Governing Agentic Banking and Commerce

Bank examiners are now establishing how agentic artificial intelligence (AI) must be governed today. As customer-owned AI agents move from answering questions to moving money, the regulatory spotlight has shifted from model intelligence to transaction control. Here is what your bank needs to know about the OCC’s Supervisory Framework on Bank Use of Super Intelligence and how to turn new supervisory requirements into an architectural roadmap for secure agentic banking.

What did the OCC announce regarding AI and Super Intelligence in banking?

On November 4, 2026, the Office of the Comptroller of the Currency (OCC) released the OCC Supervisory Framework on Bank Use of Super Intelligence, a supervisory framework guiding examiners on how to evaluate banks' use of Super Intelligence (SI) and agentic AI. The framework confirms that the OCC supports the responsible adoption of agentic technologies to automate operations, improve cyber defense and strengthen risk management.

However, it sets a clear regulatory boundary: SI is not treated as a distinct risk category, and banks are neither required nor permitted to maintain a separate AI risk appetite.

Autonomous AI is defined as an operational amplifier of existing credit, compliance, operational and liquidity risks. If an autonomous agent causes an unauthorized wire transfer, violates consumer lending rules or creates a liquidity strain, examiners will evaluate the failure through traditional risk management and internal control frameworks.

How does the OCC evaluate risk in autonomous agentic workflows?

The OCC framework establishes that supervisory scrutiny and control intensity must scale with the potential consequences of failure and the transfer of agency, rather than the technical complexity of the underlying model. Every SI and agentic use case may be scored against a common set of seven risk factors:

Decision Consequence: Does the system advise a human, make an automated recommendation, or take direct action on accounts or rails?
Reversibility: Can an erroneous output be undone before harm occurs, or is the transaction irreversible once settled?
Customer and Financial Impact: What is the potential dollar magnitude, systemic exposure, or degree of customer harm?
Autonomy Level: Does the system require human sign-off (Human-in-the-Loop), allow human intervention (Human-on-the-Loop), or act autonomously without a real-time checkpoint?
Data Sensitivity: Does the agent touch non-public personal information (NPI), customer financial records, or material non-public data?
Explainability: Can the system reconstruct a verifiable rationale for legal, regulatory, or customer adverse-action disclosures?
Provenance: Is the system built in-house, fine-tuned from third-party foundation models, or consumed as an external vendor service?

What is the OCC risk classification for agentic banking?

The seven common risk factors combine to form a four-tier risk classification.

Tier 1: Critical Risk

This includes agents involved in direct action, with low or no reversibility, high financial or customer impact and autonomous or partially autonomous execution. Illustrative banking use cases include: autonomous payment agents, real-time credit decisioning, fraud-hold releases and automated market access.

Supervisory control expectation: Maximum. These agents will require deterministic guardrails, real-time circuit breakers, instant kill switches, tamper-evident audit trails, and mandatory out-of-band Human-in-the-Loop (HITL) approvals.

Tier 2: High Risk

This includes agents involved in direct action or high-weight decision support, with human-on-the-loop oversight and moderate-to-high operational impact. Illustrative banking use cases include: AI-assisted underwriting, agent-initiated customer communications, AML alert disposition and automated code changes for data access.

Supervisory control expectation: Elevated. These agents will require continuous performance monitoring, strict least-privilege tool access, behavioral anomaly tracking, and tested human override procedures.

Tier 3: Moderate Risk

This includes agents that require decision support with mandatory human-in-the-loop review, limited data sensitivity and fully reversible outcomes. Illustrative banking use cases include: internal document summarization for credit memos, agent-assisted policy research and customer inquiry triage.

Supervisory control expectation: Standard. These agents will require input/output validation, data governance checks and periodic sampling for drift and hallucination.

Tier 4: Low Risk

These agents require no customer or financial data exposure, no direct action capability and fully human-controlled usage. Illustrative banking use cases include general employee productivity tools, internal code drafting assistance and general employee assistance.

Supervisory control expectation: Light. These agents require basic acceptable-use policies, credential hygiene, and standard enterprise software reviews.

Under this framework, models and agents used to summarize internal research sit at Tier 4 (low risk) because a human retains agency and the consequence of failure is minimal. However, agents authorized to initiate payments autonomously sit at Tier 1 (critical risk) because money movement is immediate and irreversible.

Can banks mitigate agentic risk by simply choosing not to support AI agents?

No. Treating agentic AI as an opt-in technology experiment is a critical operational blind spot. Corporate customers already deploy autonomous agents in the business applications they use every day. According to OvationCXM's nationwide survey of 520 U.S. corporate finance leaders:

75% of finance teams actively use or are piloting AI agents in their operations today.
43% of corporate finance workflows utilizing AI agents touch the bank directly, including financial close, payment approval, and transfer initiation.
88% of finance leaders want to use agentic AI for banking workflows if secure, auditable, and compliant.
43% stated that if their primary bank refuses to support agentic connections, they will use workarounds (such as third-party aggregators or automated scripts) to connect their agents anyway.
10% will move their operational deposits and banking relationships to an institution that supports agentic banking.

When an institution fails to provide a governed machine front door, client-owned agents access corporate online banking portals using shared employee credentials and automated screen-scraping. To the bank's perimeter, this automated traffic appears identical to standard human sessions, leaving the institution with unmonitored sessions, uncontrolled API bursts and zero forensic attribution. Refusing to support agents does not block them - it merely blinds the bank's defenses.

Why are existing digital banking portals unable to handle agentic traffic?

Modern commercial banking interfaces were engineered for human User Experience (UX) - visual navigation, contextual dropdowns, and manual button clicks. Autonomous agents require an Agent Experience (AX) - machine-readable service catalogs, structured tool parameters, cryptographic mandate verification, and deterministic execution boundaries.

Furthermore, foundation models and generative AI agents are probabilistic. In simple terms: they generate instructions based on mathematical token likelihood. Banking core ledgers and payment rails are strictly deterministic - they require absolute logical precision, statutory compliance, and zero variance. Wiring a probabilistic model directly to core execution rails creates severe safety and soundness vulnerabilities, including hallucinated payment amounts, unauthorized beneficiaries, and bypassed approval thresholds. Banks require an intermediate transaction control layer to translate and enforce deterministic business rules outside the model.

What must compliance and risk teams see before money moves?

Before any machine-initiated interaction is permitted to touch bank ledgers, Risk and Compliance require definitive answers to five operational questions:

Who is the agent? Verified via know your agent (KYA) registration, cryptographic credentials and persistent digital fingerprinting.
Who authorized it? Linked directly to an accountable corporate entity and a named human executive who executed the liability agreement.
What is it allowed to do? Restricted by a published, least-privilege action catalog and explicit transaction thresholds.
What did it actually do? Documented via immutable execution traces capturing raw inputs, parameters, approvals and downstream results.
How do we stop it instantly if it goes out of scope? Enforced via automated circuit breakers and immediate kill switches operating at the individual agent, customer or institutional level.

If an institution cannot answer all five questions for a given workflow, the channel is not yet examiner-ready.

What is the OvationCXM Agentic Transaction Control Layer (ATCL)?

OvationCXM’s Agentic Transaction Control Layer (ATCL) provides banks and financial institutions with a secure, governed front door for customer-owned AI agents. Built on OvationCXM’s orchestration platform, ATCL enables institutions to register and verify agents, enforce permissions and transaction limits, route authorized requests through approved workflows, and maintain a complete audit trail. This allows banks to support agent-driven banking and commerce while retaining control over access, approvals and execution across their existing systems.

ATCL delivers five foundational capabilities to align banks with the OCC framework:

Know Your Agent (KYA): Registers client-owned agents as accountable non-human actors, binding each agent to a verified corporate entity, an authorized human owner, and cryptographic credentials.
Task-Level Least Privilege: Constrains agent tool discovery using Anthropic’s Model Context Protocol (MCP). Rather than issuing broad API tokens, agents are limited strictly to the tools and data fields required for an immediate task.
Mandatory HITL Checkpoints: Any Tier 1, irreversible money-movement action (such as a wire release or payroll batch) automatically triggers an out-of-band One-Time Passcode (OTP) to the authorized human executive. The transaction cannot settle without human authorization, guaranteeing the human remains the legal business of record.
Operational Resilience & Kill Switches: Real-time circuit breakers monitor transaction velocity and structural payload compliance. If an agent behaves anomalously, loops, or attempts to exceed spend caps, ATCL severs agent connectivity instantly without taking core banking services offline.
Forensic Auditability: Captures complete, tamper-evident execution traces detailing raw prompt context, tool parameters, latency, policy decisions, and human approval timestamps, enabling auditors to reconstruct every automated event.

What is "Know Your Agent" (KYA), and why is identity verification alone insufficient?

Traditional identity and access management tools answer a single question: "Who is the caller?" For autonomous agents executing financial transactions, identity alone does not establish authority. An agent may be authenticated, but the bank must still verify who it represents, what tasks it is permitted to perform and whether its authority covers the specific transaction being requested.

ATCL’s KYA governance establishes a living, registered record for every non-human actor before it is permitted to interact with bank systems:

Agent Identifier: Distinguishes the specific calling agent, even when multiple agents operate on behalf of the same client or share credentials.
Accountable Human Owner: Ties the agent to an authorized corporate executive who signs the liability agreement and retains legal responsibility.
Customer Entity Linkage: Maps the agent to the specific corporate entity, account hierarchy, and existing treasury entitlements.
Scoped Purpose and Allowed Tools: Restricts the agent to an approved action catalog with explicit transaction thresholds.
Granular Revocation: Enables the bank or client to suspend a single agent, revoke specific tool permissions, or pause all agent activity in seconds.

Why isn't wrapping banking APIs in Model Context Protocol (MCP) enough?

Anthropic's Model Context Protocol (MCP) is an essential connectivity standard that enables agents to discover available tools and resources across systems. However, deploying an MCP wrapper without a dedicated transaction control layer introduces significant security and compliance vulnerabilities:

Discovery vs. Governance: MCP defines which tools exist and how an agent can invoke them; it does not decide whether a specific call should proceed under bank policy.
Model-External Enforcement: LLMs cannot be trusted to enforce their own boundaries; policy enforcement, spend caps, dual-control rules, and maker-checker approvals must execute deterministically outside the model.
Transaction Entitlements: Raw MCP endpoints expose tools directly. Without ATCL, an agent with read access could inherit unintended write privileges or access broader account data than authorized.
Examiner-Grade Audit Trails: MCP standardizes message transport, but it does not capture the forensic chain of custody—including cryptographic client mandates, human OTP delivery logs, and denial events—required by bank examiners.

ATCL wraps MCP endpoints within governed business journeys, ensuring that tool discovery is paired with deterministic policy enforcement, runtime authorization, and complete auditability.

How does ATCL connect with core banking ledgers and enterprise infrastructure?

ATCL is designed as an overlay control plane that coordinates execution across existing banking technology without requiring a costly core modernization or rip-and-replace project:

Core Banking and Rails: ATCL sits in front of existing systems of record, translating governed agent requests into standard, validated transactions that respect existing treasury entitlements and payment limits.
Enterprise Intent Orchestration: When corporate clients build complex business workflows using enterprise platforms, ATCL acts as the receiving transaction firewall, validating incoming requests against bank compliance rules before allowing them to touch settlement rails.
High-Throughput Mainframe Execution: For institutions handling massive transaction volumes, ATCL can deploy in a hybrid configuration alongside mainframe environments, enforcing deterministic policy at the transaction layer in sub-second timeframes without degrading payment throughput.

How can banks deploy ATCL through a phased, risk-managed rollout?

ATCL does not replace existing core banking ledgers, wire engines, or CRM platforms. It operates as an overlay control plane, leveraging existing treasury entitlements, dual-control rules, and payment limits. Banks implement ATCL through a phased, risk-managed rollout:

Phase 1 (Read-Only): Publish bounded read tools (account balances, transaction records, statement retrieval) via MCP wrappers. Validates agent authentication and denial logging under real-world conditions.
Phase 2 (Workflow Assistance): Expand to structured servicing workflows (treasury onboarding, exception intake, status reconciliation).
Phase 3 (Controlled Initiation): Open high-value transactional rails (wires, ACH, commercial card management) protected by mandatory OTP step-ups and cryptographic mandates.

By establishing a governed front door today, financial institutions can eliminate shadow AI vulnerabilities, satisfy OCC supervisory expectations, and capture the 70% of commercial clients willing to pay premium fees for secure, agent-ready bank connectivity.

Taking Control: Next Steps for Banking Leaders

The transition to agentic banking is already underway. Finance leaders are actively deploying agents to manage liquidity and reconcile cash, and they expect their financial institutions to support them. Banks that delay will see client relationships disintermediated by fintech connectors and software platforms; banks that act now can turn unmonitored shadow AI into a secure, auditable, revenue-generating commercial channel.

To prepare your institution for the OCC AI examination and establish a governed front door for customer agents, execute the following four steps:

Appoint an Agent Experience (AX) Owner: Designate a business leader within commercial banking or treasury product management to oversee agent interactions and establish dedicated ownership alongside your digital Customer Experience (CX) team.
Inventory Your Phase 1 Capabilities: Map existing treasury entitlements, APIs, and approval queues into a four-column matrix: the task, its current interface, existing human controls and whether it qualifies for Phase 1 read-only access.
Establish KYA Requirements with Compliance: Bring the Second Line of Defense into the design phase by agreeing on the five core governance answers (Identity, Representation, Authority, Context, and Control) before software is deployed.
Deploy the ATCL Transaction Firewall: Implement OvationCXM's ATCL to authenticate incoming agents, enforce task-level least privilege, activate real-time circuit breakers and log examiner-ready audit trails.

Related Resources

Deepen your team's understanding of agentic governance with our practical field guides:

Schedule an ATCL Briefing

OvationCXM’s AI Transaction Control Layer is already deployed in enterprise production with a top-25 U.S. bank. To schedule an executive briefing and view a live demo of ATCL, please contact OvationCXM today.