Federal Reserve Bowman: AI Brings Both Opportunities and Risks to the Banking Industry, Fed Urges Strengthening of System Security Protections

Michelle Bowman, Vice Chair for Supervision at the Federal Reserve, issued a warning on Tuesday regarding the dual impact of artificial intelligence on the banking industry, urging banks to strengthen system defenses while emphasizing the significant practical value of the technology.

On September 29, in a speech prepared for an event in Colorado, Federal Reserve Vice Chair Bowman stated that AI is "both a defensive tool and a continuously evolving risk" and holds great potential for both threat actors and those defending against threats.

Bowman has previously stated that the Federal Reserve should not "over-intervene" in banking operations regarding issues such as artificial intelligence, as U.S. officials assess the impact of this rapidly developing technology.

According to a previous report by Bloomberg, regulators have suspended some cybersecurity-related bank examinations to give banks time to address security threats revealed by the latest AI models.

In her speech, Bowman proposed specific directions for banks to address AI-related cyber threats.

She stated that the starting point for defensive efforts lies in solid basic network measures, including keeping asset inventories up to date, deploying multi-factor authentication to combat phishing, strengthening identity and access control, and establishing comprehensive vulnerability identification and patch management procedures.

These requirements point to the real challenges the banking industry faces in the AI era. As threat actors increasingly use AI methods to launch attacks, traditional passive defenses are no longer sufficient, and banks need to incorporate cybersecurity management into a proactive risk control framework.

At the same time, Bowman noted that while cybersecurity requires the active involvement of bank boards and senior management, regulators also recognize that related preparations could pose a significant burden and challenge for community banks. She stated:

This is precisely why we continue to adjust our IT examination approach, so that risk profiles and emerging threats are taken into account.

This statement is consistent with her previous position emphasizing that the Federal Reserve should not "micromanage" banks on issues such as AI, reflecting regulators' intention to implement differentiated supervision based on institutional size and risk characteristics, rather than enforce uniform mandatory requirements.