• Warren urges Fed, OCC and FDIC to reverse supervisory policy changes
• Senator warns revised standards could weaken defenses against AI cyberattacks
• Fed guidance allegedly raises thresholds for examiner intervention
• OCC and FDIC changes narrow definitions of unsafe banking practices
• Survey finds 76% of banks reported increased cyberattacks
• 84% of surveyed banks are increasing cybersecurity investment
• Warren argues emerging AI threats cannot always be quantified reliably
• Delayed remediation could threaten customer data and financial stability

Sen. Elizabeth Warren has called on three federal banking regulators to reverse recent supervisory policy changes, warning that restrictions on examiners' authority could expose financial institutions to increasingly sophisticated artificial intelligence-enabled cyberattacks.

Warren, the ranking Democrat on the Senate Banking Committee, urged the Federal Reserve, Office of the Comptroller of the Currency (OCC) and Federal Deposit Insurance Corp. (FDIC) to rescind policies she argues weaken regulators' ability to intervene before emerging cybersecurity threats cause significant financial damage.

In letters sent Friday, Warren challenged the Federal Reserve's September revisions to its supervisory operating principles, claiming the changes impose an excessively high threshold for identifying risks that warrant regulatory action.

According to Warren, the updated framework prevents examiners from responding unless threats present "an abnormal probability of abnormal harm," potentially excluding vulnerabilities where damage is possible but its likelihood or severity remains uncertain.

She argued that the restrictions were particularly concerning as advances in AI enable cybercriminals to develop increasingly sophisticated attacks against financial institutions.

"As advancements in frontier AI increasingly enable bad actors to conduct cyberattacks, the Fed should be strengthening bank examiners' supervisory tools and their ability to enforce strong cybersecurity standards, not gutting them," Warren wrote to Federal Reserve Vice Chair for Supervision Michelle Bowman.

The senator cited a June Texas Bankers Association survey showing that 76% of responding banks had experienced an increase in cybersecurity attacks over the preceding year.

The survey also found that 84% were increasing cybersecurity investment to address risks associated with AI, highlighting growing industry concern about the evolving threat environment.

Warren separately challenged August policy changes introduced by the OCC and FDIC that narrowed the definition of unsafe and unsound banking practices for supervisory matters requiring attention.

In correspondence with Comptroller of the Currency Jonathan Gould and FDIC Chair Travis Hill, she argued that the revised definition could prevent examiners from requiring remedial action against cybersecurity weaknesses unless significant financial harm was considered likely.

"The narrowed definition of an unsafe or unsound practice means examiners can only take action if it is 'likely,' rather than merely 'possible' or 'plausible,' that a cybersecurity incident could materially harm the financial condition of an institution," Warren wrote.

She warned that such restrictions could discourage banks from maintaining robust cybersecurity controls and addressing vulnerabilities before they were exploited.

The difficulty, Warren argued, is that the potential consequences of emerging AI-enabled attacks cannot always be accurately quantified.

Financial institutions must assess complex and evolving threats, including vulnerabilities that have been identified but have not yet resulted in successful attacks.

Consequently, requiring examiners to establish that material financial harm is likely could delay intervention until risks become substantially more serious.

Warren maintained that preventative supervision was essential to protecting customer information, institutional resilience and broader financial stability.

"Allowing cybersecurity vulnerabilities to fester, instead of remediating them early, could lead to more frequent and severe cyberattacks, threaten the sensitive financial data of businesses and households, and undermine the stability of the financial system," she warned.

The intervention highlights growing political scrutiny of banking supervision as regulators reconsider the circumstances under which examiners can demand corrective action.

Warren's objections center on whether supervisory standards should prioritize demonstrable financial harm or allow earlier intervention when emerging technological threats remain difficult to measure.

She concluded that restricting examiners' ability to address cybersecurity vulnerabilities could leave regulatory leaders sharing responsibility for the consequences of future attacks on the banking system.