TL;DR
Banking supervisors on both sides of the Atlantic are intensifying their questions about AI, according to six people who spoke to Reuters for a report published on Tuesday 13 October. In Britain, supervisors, the Bank of England among them, want stronger recovery plans and are encouraging the largest lenders to look at systems kept wholly apart from their main technology, while three US regulators, the Federal Reserve among them, are asking how banks would control or switch off autonomous agents. The same morning, the IMF named a major cyber-attack as one of three near-term threats to financial stability.
What the UK is asking for
The British approach, as Reuters describes it, is collaboration rather than new requirements. Supervisors are nudging the biggest banks to look at “bare metal” recovery plans: systems kept apart from the main estate that take over if it is compromised. Running them is expensive, the sources said, and UK authorities plan to work alongside industry rather than impose new requirements. The Bank declined to comment.
Supervisors here are also asking lenders to turn frontier models on their own estates to find and patch weaknesses, and one source said banks had made decent progress so far. In the euro area, the ECB gave lenders until the end of October to produce plans against AI-enabled cyber threats, and euro zone banks are being asked to map AI use, third-party suppliers included, so systems can be stopped and restarted in a controlled way.
Why the urgency
The report ties the activity to recent incidents: a CrowdStrike finding that a person in China probably used a Chinese-built agent together with Anthropic’s Claude Code against South Korean banks, OpenAI agents involved in a breach at Hugging Face, and IT weaknesses surfaced by Anthropic’s Mythos tool. An executive at one big European lender told Reuters they feared serious damage to banking and markets “within six months”.
Michael Woodbridge, a cyber security partner at Grant Thornton in London, said adoption is often outrunning the controls. The Fed, OCC and FDIC want to know what limits banks put on agents, how their actions are approved, whether decisions can be audited, and whether a human stays in the loop. Regulators there are still in fact-finding mode and not yet telling lenders what to do.
Looking forward
The report fits a pattern we have followed since the spring, when Mythos dominated the IMF spring meetings as a threat to financial stability, and it follows Andrew Bailey’s argument that society must keep the right to intervene on frontier AI. The IMF’s Global Financial Stability Report, published the same day, lists a big cyber-attack alongside an AI share correction and rising borrowing costs as plausible near-term triggers of a sharp tightening in financial conditions. For UK fintechs and bank suppliers, the signal is that questions about agent controls, Chinese-built components and recovery are arriving through supervisory channels now, rather than through new rules. In our view, “collaborative” is a description of tone, not of the eventual cost.