OCC / Basel III Capital Rules — Regulatory Reference

Basel III, through its BCBS 239 risk data aggregation principles, requires banks to maintain complete, accurate, and timely data for risk reporting. When AI agents generate or process inputs to capital and liquidity calculations — credit risk weights, LCR ratios, stressed VaR — those calculations must be traceable to their source data. Regulators expect an auditable lineage from raw data through model output to the reported figure. Informal processes or undocumented model pipelines fail Pillar 2 supervisory review expectations. Banks deploying AI agents in risk workflows need to demonstrate that each agent's data access was authorized, logged, and attributable to a specific model or process.

OCC capital rules apply to nationally chartered banks and federal savings associations operating in the United States. Basel III standards apply to internationally active banks subject to BCBS framework adoption in their home jurisdiction. The rules become directly relevant to AI deployments when models influence capital adequacy calculations — credit risk weights, market risk VaR, operational risk exposure, IRRBB — or when AI agents access risk data repositories to generate inputs for those calculations. The SR 11-7 model risk management guidance, which the OCC enforces alongside capital rules, establishes validation and governance expectations for all 'models' including AI systems used in material risk estimation.

BCBS 239 is the Basel Committee's Principles for Effective Risk Data Aggregation and Risk Reporting, issued in 2013 and continuously referenced in supervisory reviews. It requires banks to have automated, integrated data architectures for risk reporting — not manual workarounds or disconnected pipelines. For AI-driven risk reporting, BCBS 239 creates a direct obligation: any AI agent that aggregates, transforms, or summarizes risk data must do so through a process that can demonstrate data lineage, accuracy, completeness, and timeliness. Examiners look for evidence that the bank knows which systems touched risk data before it entered a reported figure. Undocumented AI agents in this chain represent a direct BCBS 239 gap.

AutoPIL writes a tamper-evident, cryptographically chained audit record of every decision an AI agent makes about accessing risk data — which source it requested, which policy governed that request, whether access was allowed or denied, and at what sensitivity level. This audit chain provides the lineage evidence BCBS 239 and Pillar 2 supervisory review require when AI-generated figures feed into capital or liquidity calculations. The agent registry documents each model's policy binding, supporting SR 11-7 model risk management expectations. Sensitivity classification on data sources prevents unregistered or unauthorized agents from consuming critical risk data before it is flagged. Policy IDs FS-BASEL-PII-001 and FS-BASEL-PIII-001 cover risk model input lineage and disclosure-linked data provenance respectively.

The OCC uses its examination authority under 12 CFR Part 30 to assess whether banks have adequate risk management for model-driven processes. Failure to demonstrate governance over AI agents that touch capital calculations can result in Matters Requiring Attention (MRAs) or Matters Requiring Immediate Attention (MRIAs) in examination reports. Persistent MRAs can escalate to formal enforcement actions — consent orders, civil money penalties, or requirements to remediate before expanding AI use. For internationally active banks, BCBS 239 gaps identified in supervisory college reviews can trigger Pillar 2 capital add-ons. The regulatory risk is not hypothetical: examiners have cited model risk and data lineage deficiencies in large bank enforcement actions since 2023.