Two continents, two different questions
The American questions are about control. Regulators want to know what an agent inside a bank is allowed to do, who approved that, whether every decision it makes can be traced afterwards, and whether someone can stop it. The detail that gives the exercise away is the shutdown question. You do not ask how a system gets switched off unless you have started imagining the day it has to be.
The European questions are about the morning after. Supervisors in London are pushing the largest banks toward recovery systems that sit entirely outside the main technology stack, so operations can restart even if primary systems are compromised. Euro-zone banks are being asked to map where AI runs across their own operations and their suppliers, partly so a switch-off, if it comes, can be done in a controlled way rather than improvised. One person familiar with the discussions said significant gaps remain at some firms.
The deadline is the tell
Most of this is still soft power. The US agencies are gathering information and, by the sources' own account, are not yet prescribing what banks must do. Nobody has published a rule.
But there is one hard date in the story, and it is European. The ECB's July letter gives affected lenders until the end of October to submit action plans addressing AI-enabled cyber threats, including backup and recovery. That is a concrete supervisory deadline, although submitting a plan is not the same as completing the recovery systems it describes. Watch whether the ECB confirms receipt of the plans, publishes further guidance or describes supervisory follow-up. There is no indication that it intends to publicly name banks that miss the deadline. That will say more about the real posture than the questions do.
The backdrop is a run of incidents readers of this site have already seen in pieces: an AI-assisted hack on South Korean banks flagged by CrowdStrike this month, OpenAI-developed agents reported to have participated in the Hugging Face intrusion, and European frustration at limited access to Anthropic's Mythos vulnerability tool while US banks test frontier models first. JPMorgan's Jamie Dimon has separately urged corporate leaders to join a US industry group on AI risk. The regulators are not reacting to a hypothetical. They are reacting to a sequence.
Read the sourcing before the fear
One caution belongs in the piece itself. The newly reported details of US and UK supervisory questioning rest on Reuters' six unnamed sources. The Fed, OCC, FDIC and Bank of England declined to comment. The ECB, however, referred Reuters to its July letter and Frank Elderson's June speech, providing public anchors for its concerns. That does not make the reporting wrong — supervisory conversations are exactly the kind that happen off the record — but it means the direction of travel is better evidenced than any single detail.
The "within six months" line deserves the same discount. It is one senior executive's worry, quoted without a name, a bank or a scenario. It tells you the mood inside at least one large European bank. It is not a forecast, and it should not be repeated as one.
Sources
- [1] Reuters (Nupur Anand, Phoebe Seers, Tommy Reggiori Wilkes; additional reporting Pete Schroeder, October 13, 2026) — "Exclusive: Banking watchdogs ramp up AI scrutiny as stability fears mount, sources say", read in full via syndicationRead source
- [2] Same Reuters wire, corroborating syndicationRead source
- [3] ECB Banking Supervision — Frank Elderson speech, June 3, 2026 (public anchor for the ECB's AI cyber-threat concerns): ecb.europa.eu
- [4] Bloomberg Law, July 7, 2026 — independent reporting of the ECB letter (Supervisory Board Chair Claudia Buch) requesting action plans by end of October