The Office of the Comptroller of the Currency issued a supervisory framework on 4 November for examiners judging how national banks use AI, in OCC Bulletin 2026-54. The 22-page framework sorts bank uses into 4 illustrative risk tiers and puts “a fully autonomous, customer-facing payment agent” at Tier 1.
The OCC uses the term Super Intelligence, or SI, which its bulletin defines as “the technologies and systems previously encompassed by the term” Artificial Intelligence, citing Executive Order 14434.
Business Pill · The Model and the Harness
An evergreen Business Engineer explainer on the difference between a model and the harness around it. It teaches the general idea only and does not discuss the OCC or banks.
The key insight: The OCC’s examiner framework ranks bank AI uses by what happens if they fail, not by how advanced they are: a fully autonomous, customer-facing payment agent sits at Tier 1 and a simple internal productivity tool at Tier 4.
The framework’s overarching principle reads: “A bank’s control intensity could increase with the potential consequences of an SI agent’s failure or misuse”.
It adds that “Risk classification may be based on potential consequences, transfer of agency, and the degree of human oversight, rather than the technical sophistication of the SI used”. The OCC’s example: “a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated model limited to internal drafting assistance”.
The OCC’s four illustrative composite risk tiers for bank uses of AI, with its example use cases. Source: OCC supervisory framework, section 3.2, 4 Nov 2026. Bar lengths show tier order only.
The 4 Tiers
The illustrative tiers run from Tier 1, Critical, to Tier 4, Low. Tier 1 covers direct action with “low/no reversibility”; the OCC’s examples include an autonomous payment agent, real-time credit decisioning, fraud-hold release and market access.
Tier 2, High, lists SI-assisted underwriting, agent-initiated customer communications, AML alert disposition and “code assistance for internal code or data access changes”. Tier 3 covers decision support with mandatory human-in-the-loop review, and Tier 4 internal productivity tools, code assistance and general employee Q&A.
The OCC writes that a simple internal productivity tool with no customer or financial data exposure “sits at Tier 4, whereas a fully autonomous, customer-facing payment agent sits at Tier 1, regardless of how well it performs in testing”. The tier comes from 7 scoring factors, by our count: decision consequence, reversibility, customer and financial impact, autonomy level, data sensitivity, explainability and provenance.
What It Does Not Do
The bulletin says the framework “does not establish supervisory expectations for banks” and that “Banks are not expected to use this document to assess their use of SI or their SI risk management”.
The news release says “examiners should not treat SI as a separate and distinct risk category, and banks should not be required to define a separate SI risk appetite”. The document presents “sixteen framework components”, grouped into six pillars: purpose, risk, control, oversight, resilience and assurance.
Among the controls it lists for an agent “that is operating but acting incorrectly” are circuit breakers, rate limits, least-privilege permissions and kill switches. A footnote says the framework “was prepared with the assistance of SI” and that the content “has been reviewed, edited, and approved by a human”.
How Each Side Reads It
For readers focused on burden, the OCC says the framework sets no new expectations, banks need no separate SI risk appetite, and examiners should tailor work to the bank’s size, complexity and risk profile.
For readers focused on agent risk, the OCC places autonomous payment agents and real-time credit decisioning at Tier 1, and states that test performance does not lower that tier. We cite no analysts’ views here.
As we read the framework, the tier follows the permissions an agent is given, such as initiating transactions, rather than the model behind it; the OCC says a simple rules-based agent authorized to initiate transactions could present greater risk than a sophisticated drafting model.
As we read the bulletin, it is guidance for examiners, not a rule for banks: it says it does not establish supervisory expectations and that banks should not be required to define a separate SI risk appetite.
OCC supervisory framework, Bulletin 2026-54, 4 Nov 2026
“Risk classification may be based on potential consequences, transfer of agency, and the degree of human oversight, rather than the technical sophistication of the SI used”
Three Implications
FOR PAYMENT AND CREDIT AGENTS The OCC lists an autonomous payment agent, real-time credit decisioning, fraud-hold release and market access as Tier 1 examples.
FOR CODING TOOLS Code assistance appears twice: at Tier 4 as a productivity tool, and at Tier 2 when it touches internal code or data access changes.
FOR BANK PAPERWORK The OCC says examiners should not treat SI as a separate risk category and banks should not be required to define a separate SI risk appetite.
The framework puts it this way: “The surface, not the model, governs autonomy.”
As we read it, the OCC applies a similar test to banks: what an agent is allowed to do sets its tier, not how capable the model is. The framework, published in July 2026, does not discuss the OCC.
How examiners will apply the tiers in practice, and whether other bank regulators will issue matching guidance, is not established; the OCC says it intends to update the framework regularly. The tiers are labelled illustrative in the OCC text.
We read the OCC news release, the bulletin and the full framework PDF, and every detail here rests on those three documents. We did not contact the OCC.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
The OCC’s new examiner framework, Bulletin 2026-54, sorts bank AI uses into 4 illustrative risk tiers by consequences, transfer of agency and human oversight rather than sophistication, and puts a fully autonomous, customer-facing payment agent at Tier 1. It says it sets no new expectations for banks.
A note on sourcing. Every detail comes from three OCC documents published on 4 November 2026: News Release 2026-97, Bulletin 2026-54 and the supervisory framework PDF. The count of tiering factors is ours.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
