OCC AI Governance for National Banks: Office of the Comptroller of the Currency AI Risk Supervision and Examination Expectations

SR 11-7 applied to AI models, fair lending disparate impact testing, UDAP/UDAAP review of chatbots, and third-party AI risk under OCC Bulletin 2023-17 — AI moved to a top-five OCC examination priority in 2024, which means it's now a routine exam topic, not a special review.

The OCC supervises more than 1,100 national banks and federal savings associations, covering roughly 65% of US bank assets, and it governs AI the same way it governs everything else: by applying existing law and existing supervisory frameworks rather than writing a new AI-specific rule. That means AI governance for an OCC-supervised bank isn't one checklist — it's the intersection of model risk management (SR 11-7), fair lending law (ECOA, Fair Housing Act), consumer protection (UDAP/UDAAP), and third-party risk guidance, all pointed at the same set of AI deployments simultaneously.

In March 2021, the Fed, CFPB, FDIC, NCUA, and OCC jointly issued a Request for Information on financial institutions' use of AI, raising questions about safety and soundness, lawful treatment of consumers, transparency, explainability, and fair access to credit. What that RFI actually did was signal where the agencies' attention was headed — and OCC's subsequent examination practice has since turned those themes into real, applied supervisory expectations, even though the 2021 document itself wasn't the mechanism that made them binding.

AI risk became a top-five examination priority in the OCC's 2024 and 2025 supervision operating plans, alongside credit risk, operational resilience, compliance risk, and liquidity risk. For a national bank, that's the detail that actually matters more than any individual rule: examination teams are now instructed to assess AI governance in routine safety-and-soundness exams, not just in targeted horizontal reviews reserved for unusual cases.

Model Risk: The OCC's Own Finding Is That AI Models Are the Least-Validated Category

OCC Bulletin 2011-12 brought SR 11-7 to national banks, and for AI models the examination question is specific: does the inventory capture every AI deployment, including the ones marketing or customer service stood up without routing through formal model risk management? Is risk tiering calibrated to AI's actual opacity and potential for unexpected output, not just mapped onto the same tiers used for a regression model? Has independent validation actually happened with scope proportionate to the model's risk tier? The OCC's own examination findings noted that AI/ML models were the most common category with incomplete validation — either skipped entirely or validated with a scope too narrow to mean much — and that finding has already produced Matters Requiring Attention at national banks. A bank that hasn't closed this gap should assume its next exam will find it, not hope the examiner misses it.

Fair Lending: Disparate Impact Testing Has to Cover Intersectional Effects, Not Just Single Variables

ECOA and the Fair Housing Act apply to AI credit models the same way they apply to any credit decision system, and OCC fair lending examiners test AI models specifically for whether disparate impact analysis has actually been run — and whether it covers intersectional effects (age and geography together, for instance), not just one protected characteristic at a time. Alternative data variables used in AI credit models need review as potential protected-characteristic proxies, because a variable that looks neutral (shopping pattern, device type, browsing behavior) can correlate with a protected class closely enough to function as one in practice. Adverse action notices for AI-driven decisions need specific, accurate reasons — "algorithm determined insufficient creditworthiness" is a generic reason that fails this test regardless of how the underlying model actually worked, and OCC examiners apply that same standard whether or not a specific CFPB circular on the topic is current.

UDAP/UDAAP: Does Your Chatbot Know It's Giving Financial Advice?

Consumer-facing AI — chatbots, recommendation engines, pricing systems, automated account management — gets tested against the OCC's UDAP standard and the CFPB's UDAAP standard for three distinct risks: unfairness (does the AI disadvantage consumers in ways they can't reasonably avoid), deception (could the AI's outputs mislead a reasonable consumer), and abusiveness (does it take unreasonable advantage of a consumer's lack of understanding). The specific question OCC examiners ask about AI product recommendations is whether the output functions as unlicensed financial advice in substance, regardless of how it's labeled — and whether disclosure actually makes clear to the consumer that they're talking to an AI system, not a human adviser, before the recommendation lands.

Third-Party AI Risk: Most Banks' AI Vendor Contracts Give Performance Data But Not Audit Access

OCC Bulletin 2023-17 applies standard third-party risk management to AI vendors, scaled to criticality — AI used in credit decisioning, compliance, or customer-facing roles sits in the higher-risk tier requiring enhanced due diligence. The OCC's 2024 examination findings flagged a specific, common gap: many national banks' AI vendor contracts give the bank access to performance data but not to model documentation or validation records — which looks adequate until an examiner actually asks for the documentation the contract never guaranteed access to. Pre-contract due diligence, audit rights sufficient for OCC examination purposes, ongoing performance monitoring, and a real exit plan all need to be in place before the vendor relationship goes live, not negotiated retroactively once the bank needs them.

India Context: The Parent Bank's Governance Program Doesn't Automatically Cover the US Branch

Indian banks with OCC-supervised US presence — SBI's New York agency, ICICI Bank's New York and Chicago branches, HDFC Bank's New York representative office, Bank of India, Bank of Baroda, and Canara Bank's New York operations, Bank of Maharashtra — face a scope problem more than a complexity problem. US operations are typically smaller than a domestic national bank's, but OCC examiners assess the US entity's governance program specifically, and an Indian parent's RBI-aligned model risk framework doesn't automatically satisfy SR 11-7 for the US branch. The two genuinely different requirements that need building from scratch, not inherited from the parent: ECOA/Fair Housing disparate impact testing (RBI has no direct equivalent), and UDAP/UDAAP review for consumer-facing AI (India's Consumer Protection Act and RBI's Fair Practices Code don't map onto this cleanly). Adverse action notice standards are the sharpest gap — CFPB's expectation for specific, accurate reasons is materially more demanding than RBI's Fair Practices Code reason-code conventions, and a US credit AI deployment using India-standard adverse action language will fail a US exam.

Action Checklist: Closing the Gaps OCC Examiners Already Know to Look For

1. Audit the AI model inventory for business-line deployments that never went through formal model risk management — the OCC's own findings say this is where the gaps concentrate.
2. Run intersectional disparate impact testing on credit AI, not single-characteristic analysis alone.
3. Rewrite adverse action notice generation to produce specific, model-grounded reasons — generic "algorithm determined" language fails regardless of model quality.
4. Audit AI vendor contracts for documentation and validation-record access, not just performance-data access.
5. Build US-specific ECOA and UDAP/UDAAP review for the branch independently — don't assume the India parent's RBI-aligned program covers it.