AI Oversight: Who Can Actually Intervene?
At a Glance
US: The OCC’s new examiner framework focuses on what AI systems can do and the consequences of their actions, without introducing new bank requirements. Source
Hong Kong: The HKMA examines how banks can maintain accountability and meaningful human oversight as AI agents gain autonomy. Source
UK: The FCA reports missed AI code errors, undisclosed AI use and weak emergency-stop arrangements. Source
The Week’s Key Development
OCC shifts supervisory attention from AI complexity to consequences
What happened. On 4 November, the Office of the Comptroller of the Currency (OCC) published its Super Intelligence (SI) supervisory framework, covering AI technologies and their advancing capabilities. Intended for examiners, it establishes no new bank requirements.
What it says.
Banks may sort SI uses into risk tiers by “potential consequences, transfer of agency, and the degree of human oversight”. A basic agent that can start transactions could be riskier than a powerful model that only helps staff write internal documents (p. 2).
Human oversight should be “more than a nominal click”. Reviewers may need sufficient information, authority and time to challenge or stop actions (p. 4).
The OCC says “accountability for managing the bank's risk generally remains with the bank”, even when AI is outsourced. There is no need for a stand-alone SI risk appetite (pp. 1, 5).
What it means. An AI system’s risk can change substantially while its model stays the same. Give it new permissions, such as starting transactions or opening sensitive records, and the earlier risk assessment may no longer fit. Validating the model alone does not show whether the powers it was given later are still appropriate.
Human oversight can become a formality when automated decisions arrive faster than reviewers can assess them. Responsibility remains with people who may have little effective control. Evidence of approval is therefore weaker than evidence of actions challenged, rejected or stopped.
Outsourcing introduces another dependency: banks generally remain accountable for outcomes, but their ability to demonstrate effective oversight may depend on information and intervention rights controlled by providers.
What’s next. The OCC plans to revise the guide as AI, its uses and supervisors’ knowledge develop.
Most relevant to: Board · Risk · Internal Audit · AI Governance
Sources: OCC Bulletin 2026-54 (4 November) · OCC, Super Intelligence Supervisory Framework (PDF)(4 November)
Also that week
Hong Kong: HKMA examines who owns decisions made by AI agents
What it says. The HKMA’s 2 November discussion paper states: “Accountability should not default to technology functions solely because agentic A.I. is involved.” It adds: “A formal approval step is not, by itself, meaningful human oversight.”
The paper explores possible governance arrangements without creating new obligations. Comments are due before 1 February 2027.
What it means. Agentic workflows complicate accountability when decisions span business functions, technical teams and providers. Even with a designated owner, responsibility is difficult to establish without evidence of how decisions were made and under which permissions. An approval alone does not show who answers for what the agent does next.
Most relevant to: Board · Risk · Internal Audit · AI Governance
Source: HKMA, Discussion Paper on Agentic A.I. Governance in the Banking Sector (2 November)
UK: FCA finds gaps between AI controls and their effectiveness
What it says. The FCA’s 2 November review describes a case where faulty AI-suggested code got past human checks and took a service down. Separately, staff used AI tools their firms had not signed off. Data leaked as a result, some of it sensitive.
Banks’ own internal auditors found flawed approvals, partial AI inventories and inadequate emergency-stop testing.
What it means. The FCA’s findings expose a gap between having controls and showing that they work. Approval records do not prove independent challenge, while incomplete inventories weaken assurance. Internal audit also found no written list of who may operate the kill switch, leaving an open question: can the bank show who can intervene?
Most relevant to: Internal Audit · Information Security · Risk · AI Governance
Source: FCA, Wholesale Banks Supervision: Insights 3 (Autumn 2026) (2 November)
Worth Watching
UK: Government considers measures for agentic loss of control
What it says. A 3 November factsheet discusses spotting when an agent slips out of control, warning those affected and keeping evidence. Rules would need consultation and secondary legislation under the Cyber Security and Resilience Bill. The measures would apply to organisations covered by the Bill, such as energy, transport and water operators and cloud providers. not banks specifically.
What it means. An agent can exceed its authority without visibly failing. Existing incident records may not establish when or how control was lost. For banks, the proposals remain a signal, not rules.
Most relevant to: Information Security · Risk · Legal
Source: GOV.UK, Agentic AI Resilience Measures (3 November) · GOV.UK, Summary of the Bill (updated 3 November)
Singapore: New MAS institute plans shared AI risk resources
What it says. MAS announced on 3 November that its Future of Finance Institute is up and running. Under its SafeFin.ai pillar, financial firms will jointly produce practical material and examples of what good looks like when applying MAS’s AI risk guidelines. Agentic AI is in scope. SafeFin.ai will also deepen the MindForge toolkit’s coverage of AI risk assessments, testing and checking, and AI from outside providers.
What it means. Common assurance methods could make vendor assessments more comparable, but cannot fully capture risks specific to each firm’s deployment. Vendor assurance alone cannot establish effective control. For now, MAS says the details are still to come.
Most relevant to: Risk · Internal Audit · AI Governance
Source: MAS, Future of Finance Institute Commences Operations (3 November)
Coming Up
16 November: Comments close on proposed US interagency third-party risk management guidance.
20 November: ICO call for evidence on agentic AI closes.
25–26 November: FCA Supercharged Sandbox second-cohort showcase.
AI GRC Network
AI GRC Network briefs and connects the executives accountable for AI in financial services. Subscribe to our free weekly newsletter at aigrcnetwork.com and follow us on LinkedIn.
Know someone who should be reading this?
Disclaimer: this newsletter is designed to provide general analysis, and it is not legal, regulatory or financial advice.