Issue #40
Weekly Banking Intelligence: October 30 to November 05, 2026
THIS WEEK’S SIGNAL
The OCC released its first formal supervisory framework for AI in banking this week, and the headline is less about what it requires and more about what it reveals: regulators have been watching banks deploy AI agents for two years without a shared standard, and the industry has been writing its own rules in the meantime. Nine AI incidents at banks have been confirmed by institutions themselves in 2026 alone, with one regulator finding and two court filings already in the mix. The gap between deployment pace and governance maturity is no longer theoretical. If your institution does not have documented AI controls that can survive an examiner’s questions, this week’s OCC release is your starting gun.
DEEP DIVE
The OCC framework arrives, and the real work begins
The Office of the Comptroller of the Currency issued its first supervisory framework for AI in banking this week, as reported by Yahoo Finance and PYMNTS. The framework directs examiners to focus less on how powerful a bank’s AI is and more on whether the bank is in control of it. That framing is deliberate, and it matters. Regulators are signaling that they are not trying to slow AI adoption; they are trying to determine whether the institutions deploying it have the governance infrastructure to manage what can go wrong.
What makes this week’s release notable is the context surrounding it. As reported by American Banker, banks have largely been navigating AI risks on their own while regulators worked to catch up. The FDIC’s revised guidance, also active this week, is explicitly non-binding and most relevant to institutions above $30 billion in assets, leaving generative and agentic AI to banks’ broader risk management programs. That means community banks and mid-tier regionals are operating in a space where the rules are still being written around them.
Why it matters: The OCC framework gives examiners a lens they did not have before. Even if the framework is not prescriptive on every point, it shapes what questions examiners will ask and what documentation they will expect to see. Banks that have been deploying AI without formal shutdown procedures, audit trails, or model governance policies are now facing a structured review environment. The institutions that treated the FSB’s 12 sound practices from Issue #38 as a planning document are better positioned for this moment than the ones that filed it under “watch and wait.”
Why it matters for governance and operating model: The harder challenge is not the documentation. It is the organizational question of who owns AI governance. In most banks I have spoken with, AI accountability is distributed across technology, risk, compliance, and business lines, with no single owner who can answer an examiner’s question end to end. The OCC framework does not mandate a governance structure, but it creates the conditions where the absence of one becomes visible quickly. That is an operating model problem, not a compliance checklist problem.
The AI incident data reinforces the urgency. As tracked by BankingNewsAI, there are nine confirmed AI incidents at banks in 2026, including a lawsuit filed by U.S. Bank customers against Pegasystems alleging its Voice AI secretly analyzed customer-service calls. Court filings and regulator findings are now part of the landscape. The question worth putting to your leadership team is not whether you have an AI policy, but whether that policy would hold up if it became exhibit A in a court filing or an examiner’s report.
MARKET MOVES
CIBC goes live on Thought Machine Vault Core
CIBC has adopted Thought Machine’s Vault Core platform for retail banking modernization, as reported by The Paypers. The milestone is significant: CIBC built and piloted its first product on the platform, the Simplii Account, in less than a year, making it the first large Canadian bank to go live on Vault Core. That is not a pilot. That is a production deployment at scale, and the speed of it is worth noting.
Why it matters: A major Canadian bank moving a live retail product onto a cloud-native core in under twelve months challenges the assumption that large-bank core modernization has to take years before anything reaches customers. CIBC’s approach, building a new product on the new platform rather than migrating existing accounts first, is a pattern worth watching. It reduces migration risk while generating real operational data on the new architecture. Banks still in the planning phase of core modernization should be asking whether they are sequencing their own programs in a way that produces early proof points, or whether they are designing a five-year journey before a single customer sees the result.
MyState Bank selects a core banking platform to consolidate post-merger systems
MyState Bank, an Australian institution working through the integration of its Auswide merger, has selected TCS BaNCS to consolidate onto a single core banking system, as reported by AD HOC NEWS. The driver here is straightforward: two banks, two cores, and the operational complexity that comes with running them in parallel.
Why it matters: Post-merger core consolidation is one of the cleaner strategic rationales for a core replacement, because the cost of the status quo is visible and measurable. Running parallel cores is expensive, creates data reconciliation problems, and limits the combined institution’s ability to offer consistent products across its customer base. MyState’s decision is a reminder that merger integration is often what finally forces the core conversation that management had been deferring. If your institution has gone through an acquisition in the last three years and is still running separate systems, the question of when, not whether, deserves a direct answer.
VENDOR SIGNALS
First New Mexico Bank selects PhoenixWorx for core banking
First New Mexico Bank of Silver City has selected PhoenixWorx, a core banking technology provider serving hundreds of banks and credit unions across the U.S., for a full platform replacement covering the Phoenix Core Banking System, MalauzAI Digital Banking, Analyzer IQ, and Enterprise Content Management. As reported by The Paypers, the deal covers the full operating stack, not just the core ledger.
Community banks selecting integrated platforms that bundle core, digital banking, analytics, and content management in a single deal are making a deliberate bet on simplicity over best-of-breed. First New Mexico Bank is essentially deciding what their operating model needs to look like in two years, not just what software to run today. The risk of that approach is vendor concentration; the benefit is that integration complexity, which quietly kills more transformation programs than technology failure does, is largely the vendor’s problem to solve.
Payment modernization: from separate rails to shared hubs
As reported by PYMNTS, banks are moving payment modernization away from building separate rails for each payment type and toward shared orchestration hubs that sit above the core. The architectural logic, separating payments from the banking core first, then building common orchestration across rails, is gaining traction as institutions try to support real-time, ACH, wire, and cross-border payments without rebuilding the core to accommodate each one.
This matters because the payments layer is where most banks feel the competitive pressure most acutely, and it is also where the technical debt from legacy architecture shows up first. An orchestration hub approach can accelerate time to market for new payment capabilities without requiring a full core replacement, but it introduces its own governance and integration dependencies. The institutions doing this well are the ones that have thought through data consistency between the hub and the core, and the operating model changes required to support it, not just the payments functionality itself.
The Swiss core banking loyalty paradox
A 2026 study covered by Finews, examining Swiss banks and their core banking relationships, found that significantly more institutions than three years ago expect to remain loyal to their current providers long term, even as the same institutions question whether their systems can support future needs. The much-discussed replacement of core banking systems is, for now, not materializing in Switzerland at the rate many vendors anticipated.
That finding is not unique to Switzerland. Across markets, the gap between dissatisfaction with current systems and willingness to replace them remains wide. The cost and complexity of replacement, not satisfaction with the incumbent, is what keeps most banks in place. That dynamic is unlikely to change until either the cost of staying becomes more visible or the competitive pressure from institutions on modern platforms becomes impossible to ignore. Both are happening, just slowly.
REGULATORY PULSE
SBA doubles relationship-wide lending limit to $10 million
The Small Business Administration has doubled its relationship-wide lending limit to $10 million, as noted in American Banker’s coverage of the agency’s active 2026 agenda. The change expands the ceiling on total SBA exposure a lender can carry with a single borrower relationship.
For community and regional banks with active SBA lending programs, this is a meaningful change. It allows relationship managers to deepen exposure with existing small business clients without triggering the prior limit, which is operationally simpler and potentially more profitable than originating new relationships. The catch is that it also concentrates credit risk within single relationships at higher dollar amounts, which means underwriting discipline and portfolio monitoring need to keep pace with the expanded authority. Banks that have invested in AI-assisted credit monitoring, as noted in Issue #39 with First Internet Bank’s SBA compliance work, are better positioned to manage that concentration risk at scale.
TALENT SIGNALS
Community bank AI hiring accelerates
As reported by Forbes, community banks and credit unions are moving from AI curiosity to AI deployment across loan processing, credit risk assessment, and customer service. BankSouth, based in Greensboro, Georgia, is implementing an FIS platform as its central operating system. The broader pattern is that smaller institutions are now hiring for AI-adjacent roles, not just purchasing AI-enabled software, because the gap between what a platform can do and what the institution can actually operate is a people problem.
This is consistent with the pattern flagged in Issue #36, where AI job postings across the industry jumped 49% and AI agent orchestration roles were up dramatically. What is new this week is that the signal is showing up clearly at community banks, not just Tier 1 institutions. The institutions hiring for AI governance, model oversight, and digital operations now are building the internal capability to actually run what they are buying. The ones that are not are creating a dependency on vendors that will be difficult and expensive to unwind later.
CB RADAR UPDATE
In our proprietary CB Radar database, the week’s entries reflect two distinct buyer profiles. CIBC and MyState represent larger institutions making decisive moves, one greenfield on a cloud-native platform, one consolidating post-merger complexity onto a proven system. First New Mexico Bank represents the community bank segment, where the integrated platform approach is gaining ground because it trades flexibility for simplicity. The payment hub pattern is worth watching separately: it is not a core replacement, but it is a structural decision that will shape what a future core replacement looks like. Banks making payment modernization decisions now are, intentionally or not, constraining or enabling their future core options.
RICK’S STRATEGIC TAKE
➜ The OCC framework is not the finish line; it is the beginning of a more structured conversation between banks and examiners about AI control. The institutions that will handle that conversation well are the ones that can walk an examiner through their AI governance model with confidence, not the ones scrambling to build documentation after the visit is scheduled. If you do not know today who owns AI accountability end to end in your organization, that is the first question to answer.
➜ What caught my attention in the CIBC story is not just that they went live on a new core. It is that they did it in under a year by building a new product on the new platform rather than migrating existing accounts. That sequencing decision is underappreciated. Most core modernization programs fail or stall because they try to move everything at once. CIBC’s approach produces a working proof point early, generates real operational data, and keeps the business running while the broader program develops. It is worth asking whether your own modernization roadmap is structured to produce something real in the near term, or whether year one is entirely setup.
➜ The AI incident data is the signal I would not ignore. Nine confirmed incidents in 2026, with court filings already in the mix. The U.S. Bank and Pegasystems lawsuit over Voice AI is a preview of the liability questions that will follow banks that deployed AI capabilities without adequate disclosure or oversight. The OCC framework gives examiners a lens; plaintiffs’ attorneys already have one. Governance and operating model clarity are not just regulatory requirements at this point. They are risk management fundamentals.
For a deeper framework on what AI-ready core architecture actually requires, see CSP’s CB Architecture Series at coresystempartners.com.
Want the Full Picture?
Subscribe to BIS, the Banking Intelligence Service from Core System Partners, for the full breakdown including Rick’s Strategic Take on the governance gap, the CB Radar vendor tracking signals, and the regulatory pulse analysis covering what SR 11-7 does and does not cover for agentic deployments, delivered weekly. Banking Intelligence Service
For CSP’s full analysis of what the Fed and Treasury are actually concerned about—and a framework for what AI-ready architecture requires—visit Core System Partners.
Continue With Core System Partners
- Contact Us: https://coresystempartners.com/#contact
- The Strategic Flywheel (book): https://coresystempartners.com/resources/strategicflywheel/
- Core Insider (weekly newsletter): https://coresystempartners.com/resources/newsletter/
