Fed's Bowman: AI Presents Both Opportunities and Risks for Banking, Urges Stronger System Safeguards

Federal Reserve Vice Chair for Supervision Michelle Bowman on Tuesday warned about the dual impact of artificial intelligence on the banking industry, calling on banks to strengthen their system defenses while also emphasizing that the technology holds significant practical value.

On September 29, Bowman said in prepared remarks for an event in Colorado that AI is "both a defensive tool and an evolving risk," offering enormous potential for both threat actors and those defending against threats.

Bowman had previously said the Fed should not "overreach" into banks' business on issues such as artificial intelligence, as U.S. officials weigh the impact of the rapidly developing technology. According to prior Bloomberg reporting, regulators have paused some cybersecurity-related bank examinations to give banks time to address security threats exposed by the latest AI models.

Specific Safeguards: From Basic Network Measures to Identity Controls

In her remarks, Bowman outlined specific directions for banks in addressing AI-related cyber threats.

She said the starting point for defense lies in solid basic network measures, including keeping asset inventories up to date, deploying phishing-resistant multi-factor authentication, strengthening identity and access controls, and establishing robust vulnerability identification and patch management procedures.

These requirements point to the real challenges the banking sector faces in the AI era. As threat actors increasingly leverage AI to launch attacks, traditional passive defense is no longer sufficient, and banks need to incorporate cybersecurity management into a proactive risk control framework.

Bowman also noted that while cybersecurity requires proactive engagement from bank boards and senior management, regulators recognize that such preparations may pose a significant burden and challenge for community banks. She said:

This is why we continue to adjust our approach to IT examinations so that risk profiles and emerging threats are taken into account.

This statement is consistent with her earlier position that the Fed should not "micromanage" banks on issues such as AI, reflecting the regulator's intent to implement differentiated supervision based on institution size and risk characteristics rather than taking a one-size-fits-all mandatory approach.