Fed, OCC and FDIC Ask Banks How They Would *Shut Down* AI Agents

The questions nobody asked last year

US federal banking supervisors have started asking banks a set of questions about AI agents that didn't exist in any formal guidance six months ago. The Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation want to know how banks would stop an AI agent mid-task, how they audit what agents actually do and how they make sure agents don't quietly use prohibited models or pull data from forbidden sources ^[1].

The questions are arriving in informal supervisory conversations, ahead of formal regulatory information requests. Banks are being asked to document their answers now, because the day a request lands is too late to start building the evidence pack.

Think of it like an emergency stop button on factory machinery. Everyone expects one to exist, and when the inspector visits they want to see that it works and that someone has tested it. AI agents are less visible than a machine, so the documentation has to do the work the button does: show that the thing can be halted, and that someone knows how.

What SR 26-2 doesn't cover

The Fed's supervisory guidance SR 26-2, issued in April 2011 and still in force, sets out expectations for model risk management ^[2]. It covers model development, implementation and validation. It was written for models that produce a score or a forecast and wait for a human to act on it.

AI agents don't wait. They take an instruction, decide which tools to call, execute the calls and return a result, all in seconds. A credit risk model might flag an application; an agent might adjust a customer's credit limit and send them a message about it.

SR 26-2 asks for documentation of a model's limitations and for ongoing monitoring of its performance. It doesn't say how you document what an autonomous system did yesterday, or how you show a supervisor that you could have stopped it if you needed to.

That's the gap the new questions are filling, and it's a practical one. If an agent starts doing something unexpected, can you stop it before it finishes? If it did something last Tuesday, can you show what it was asked to do, which tools it called and what the result was? If your policy says agents can't use a Chinese-developed model, can you prove none of them did?

The shutdown question

The first question is the simplest: how do you halt an agent mid-task? Not after it finishes, and not by hoping it doesn't try again, but right now.

For some banks, the answer is a manual override in the orchestration layer. For others, it's an API call that every agent checks before acting. The form matters less than having an answer and being able to show it works.

The second part is harder: how do you document that you halted it, and when? An email saying "we stopped it" isn't evidence in the way a timestamped log entry is, and a log entry someone can edit after the fact is better than nothing but not by much.

The audit trail question

The second question is about reconstruction. If a supervisor or an internal auditor asks what an agent did on a given day, can you show them?

That means logging each instruction the agent received, each tool it called, the arguments it passed and the result it got back. It also means keeping those logs in a form that holds up when questioned, which brings up the same problem that comes up with any log: the people who keep it could also change it.

A log is like a diary. It tells you what happened, if you trust the person who wrote it. The supervisory expectation is moving towards logs you can check, not just logs you can read.

The model and data source question

The third question is about boundaries. If your policy says agents can't use models developed in certain countries, or can't pull customer data from certain systems, how do you enforce that?

It's one thing to write the rule. It's another to show, six months later, that no agent broke it. That requires logging which model an agent called, which version and where it came from, and doing it in a way that can be verified after the fact.

The same goes for data sources. If an agent is allowed to read from System A but not System B, the log should show which one it actually used, and the log should be hard to rewrite quietly.

What this means for you

If your bank is building or buying AI agents, here are three questions to ask this week:

• Can we halt an agent mid-task, and can we document when and why we did it?
• Can we reconstruct what an agent did on a specific day, including which tools it called and which models it used?
• Can we show that our agents respect the boundaries we set, and that the evidence of compliance hasn't been edited after the fact?

The answers don't have to be perfect, but they do have to exist before the formal request arrives.

A digital witness for agent actions

Here, the thing to seal is each step an agent takes: the instruction it received, the tool calls it made, the arguments it passed and the results it got back. Sealing takes a fingerprint of each record, not the record itself, so the data never leaves your systems.

If a supervisor asks what an agent did six months ago, you share the record and the sealed fingerprint. They calculate the fingerprint again. If it matches, the record is exactly what was logged at the time. Change a single character and it won't match.

A digital witness shows that the record existed at a given time and hasn't changed since. It doesn't authorise the action, and it doesn't make the action correct. What it does is answer the question every auditor will ask: can you show me that this log is the one you wrote on the day, not the one you wish you'd written?

You can seal agent actions through WitniumChain's MCP server, REST API or SDK. The content stays with you. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. Your orchestration layer logs each agent instruction, tool call and result.
2. As each record is written, your system sends a fingerprint to WitniumChain and gets a witness ID back.
3. When a supervisor asks what happened, you share the record. They check the fingerprint. If it matches, nothing has changed.

What to watch

The AI Act's logging requirement in Article 12 applies to high-risk AI systems from 2 December 2027 for Annex III systems ^[3]. US supervisory expectations are moving faster than EU law in some areas, and this is one of them. If your bank operates in both jurisdictions, the stricter standard is the one to meet.

DORA's technical standard on ICT risk management, which has applied since 17 January 2025, already requires logs to be protected against tampering, deletion and unauthorised access ^[4]. That standard applies to financial firms in the EU, but the principle is the same on both sides of the Atlantic: a log you can quietly edit is a diary, not evidence.