What FFIEC examiners are now asking about your AI agents

Key takeaways

• The bank examination question about AI has changed. It is no longer “do you have an AI policy” — it is “show me what this agent did, who approved it, and how you stopped it.”
• Examiners apply an established accountability pattern to a new actor: attribution, approval, evidence, and control. Banks that already operate this way for payments and trading answer AI questions with the same records.
• The gap is almost always between policy and evidence. Documents establish intent; per-action records establish execution. Examiners ask for the second.
• Preparation is a records exercise, not a document-writing exercise: inventory, identity, one-query reconstruction, and a tested stop control.

The one-sentence summary

FFIEC examinations now treat AI agents as actors that must be attributable, approved, stoppable, and recorded — and the banks that answer from records rather than reconstructions are the ones that prepared.

From “do you have a policy” to “show me the record”

For years, the AI question in a bank examination ended at the policy document: does the bank have an AI governance framework, who owns model risk, are third-party AI vendors in the register. That question is answered by documents, and most banks have the documents.

SR 26-2 changed the register of the conversation. The Federal Reserve’s guidance on agentic AI extends existing third-party and model risk expectations to agents, and the extension lands on evidence: defined accountability for agent actions, risk assessments proportionate to the agent’s autonomy, evidence that controls ran rather than merely exist, and stop mechanisms that have been tested. An examiner applying SR 26-2 does not ask whether the bank’s AI policy mentions agents. The examiner picks an agent and asks about its actions.

The questions that follow have a consistent shape across examinations:

• Attribution: which agent took this action, and on whose behalf? If the bank’s answer starts with “the service account,” the answer has already failed.
• Approval: who approved this agent’s deployment, and who approves its consequential actions — the payments, the data exports, the external communications? What did the approver see?
• Policy: which version of the policy judged this action, and how do you know?
• Stop: how is this agent stopped if it misbehaves, who may stop it, and when was that last tested? May the person who stopped it also restart it?
• Evidence: show me the record for one completed action, end to end.

None of these are answered by the policy document. All of them are answered by records — if the records exist.

The pattern examiners are applying is not new

Banks have been through this arc for automated trading, payment initiation, and straight-through processing. Distributed actors, delegation, high-consequence actions — and a supervisory demand for attributable actors, central rules, approvals on the consequential actions, and records that reconstruct the chain. Agents are a new class of actor, not a new class of accountability.

The practical consequence: banks that operate attributable, approved, recorded action chains for their existing automated systems can extend the same machinery to agents and answer AI examination questions from the same records. Banks that governed those systems by policy document alone will find agents amplify the gap, because agents act more often and in more directions than any earlier automation.

The five records that answer the exam

Preparation is a records exercise. Five artefacts answer every question in the standard set:

1. The agent inventory — every production agent, its named owner, its workflow, and its approval status. Not a spreadsheet of pilots: the register of actors.
2. Identity records — each agent’s own credential, scoped and short-lived, with the on-behalf-of chain recorded when it acts for a user. Shared service accounts are the first finding an examiner writes.
3. The per-action record — request, policy decision and version, approvals with what the approver saw, tool calls, outcome. Correlated and tamper-evident, retrievable as one query.
4. The stop-drill record — when the kill switch was last tested, what stopping blocked, how restart was authorised, and by whom. A stop control that has never been tested is a hypothesis; the drill record is what turns it into a control.
5. The exception log — every policy override and exception, who granted it, and what it covered.

Banks holding these five records answer the examination in the session. Banks without them spend staff months reconstructing answers, and reconstruction is what examiners read as an ungoverned program.

What the preparation actually looks like

The sequence that closes the gap before the exam request letter arrives:

1. Inventory the agents. One day with IAM exports and workflow owners. Every production agent gets an owner or gets stopped.
2. Give each agent its own identity. Shared credentials are the fastest finding to write and the fastest to fix.
3. Wire the approvals and the record. Approval gates on irreversible action classes, enforced where the action executes; one correlated record per action.
4. Drill the stop control. Staging first, then production in a quiet window, with the drill record kept. The drill takes about 45 minutes on one agent.
5. Rehearse the reconstruction. Pick a completed action and reconstruct the chain end to end in one query. If it takes a manual join across log stores, that is the finding — fix it while it is cheap.

The same five steps are what an examiner’s follow-up will ask about, which is why banks that run them once run them on a cadence afterwards.

Where this fits with the rest of the regulatory picture

SR 26-2 and FFIEC expectations are the US banking slice of a global convergence: DORA and the EU AI Act bind EU financial entities to overlapping controls, CPS 230 does the same for Australian financial services, and the seven frameworks map onto four recurring controls. Build the controls once; the framework mappings become documentation.

For the full SR 26-2 examination-evidence picture, the dedicated page covers what the guidance asks in depth; the readiness checklist scores all four control domains in 36 checks; and what Moring does shows the same records produced as a product.

If you need to brief the board before the exam request letter arrives, the AI governance board briefing covers the fiduciary framing and the five questions directors should ask management. The insurance equivalent — state audits under the NAIC model — is covered in how to prepare for a NAIC AI model audit.

Frequently asked questions

About the author

Balaji Nagaraj KumarChief AI Officer, Moring AI, Moring AISweden

Leads platform and delivery engineering at Moring AI, turning each engagement into a substrate the customer’s own team operates at handoff. His background spans developer-platform leadership at Volvo Cars and engineering at CERN. He writes about governance for agents that take actions in production systems.

LinkedIn profile →