Sen. Elizabeth Warren, D-MA, asked three federal regulators Friday to rescind a pair of updated policies she argues curb bank examiners’ power to issue supervisory warnings and enforcement actions as artificial intelligence tools grow more sophisticated.
Warren, the top Democrat on the Senate Banking Committee, took issue with a September update to the Federal Reserve’s statement of supervisory operating principles. The guidance limits examiners from taking action against a threat unless there is “an abnormal probability of abnormal harm,” Warren asserted, adding that regulators’ hands would be tied if “harm is merely ‘possible,’ if the harm is only ‘material’ but not quite ‘significant,’ or if the severity of the harm is uncertain.”
The senator cited a June survey from the Texas Bankers Association, which found that 76% of surveyed banks saw an increase in cybersecurity attacks over the past year, and that 84% are increasing investments into cybersecurity to address risks associated with AI.
“As advancements in frontier AI increasingly enable bad actors to conduct cyberattacks, the Fed should be strengthening bank examiners’ supervisory tools and their ability to enforce strong cybersecurity standards, not gutting them,” Warren wrote to Michelle Bowman, the central bank’s vice chair for supervision.
Separately, Warren wrote the heads of the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp., urging the agencies to reconsider an August change to the definition of unsafe and unsound practices, as they relate to the enforcement category known as matters requiring attention.
“Whether a cybersecurity vulnerability would meet the definition of an unsafe or unsound practice … depends on the potential severity and likelihood of material harm to the financial condition of the institution,” Warren wrote to Comptroller of the Currency Jonathan Gould and FDIC Chair Travis Hill. “The narrowed definition of an unsafe or unsound practice means examiners can only take action if it is ‘likely,’ rather than merely ‘possible’ or ‘plausible,’ that a cybersecurity incident could materially harm the financial condition of an institution.”
Warren said the narrowed scope of unsafe and unsound practices “undermines incentives for banks to maintain rigorous policies, procedures, and internal controls related to cybersecurity.”
Banks face a “complex calculation” to determine the level of harm from an “evolving AI-enabled cyberthreat,” Warren said, adding that “a vulnerability may not be easily quantifiable as ‘likely,’ especially if vulnerabilities have been discovered but not yet exploited.”
However, she added, “allowing cybersecurity vulnerabilities to fester, instead of remediating them early, could lead to more frequent and severe cyberattacks, threaten the sensitive financial data of businesses and households, and undermine the stability of the financial system.”
By restricting the circumstances under which examiners can act against a threat, Fed, OCC and FDIC leaders “will share responsibility for the potential harm wrought by future cyberattacks on the banking system,” Warren warned.
