Bank prudential regulators House testimony: Live coverage

Rep. Maria Elvira Salazar, R-Fl., questioned Gould on the immigration-related executive order, directing financial regulators and banks to scrutinize activity involving undocumented immigrant workers as part of banks' anti-money-laundering regulatory regime. 

The order, entitled "Restoring Integrity to America's Financial System," instructs the Treasury Department, bank regulators and the Consumer Financial Protection Bureau to issue guidance to banks on "red flags" to identify the informal work arrangements upon which undocumented workers may rely.

Salazar opened by distancing herself from parts of administration policy in certain areas. 

"I do not always agree with the White House immigration policies established by this administration," She said, "Sometimes I do, sometimes I don't, but I believe that in this case this new directive could be, could be damaging to the average American citizen … [as Republicans] we stand for less regulation, less paperwork, less hurdles to do business."

Regulator Gould responded by saying the issue fits into longstanding compliance expectations for knowing banking customers.

"As a supervisor for the US banking system, I expect it not to be used to facilitate illegal activities, whether it be financial fraud or money laundering, or anything of that nature," Gould said. "That is a long-standing obligation that we impose on banks, and I think it is an expectation that every American citizen has of its US banking system."

When asked how he would make sure that the average American will not be affected by now establishing "another layer of regulation," Gould argued that the OCC would provide banks clear guidance so they can comply with the yet-unreleased proposal pursuant to the order. 

"Banks have flexibility in the documentation that they use to establish the identities of their customers," Gould said. "I think it's probably appropriate to withhold judgment until we've actually done the work working with Secretary Bessent and the other federal bank agencies."

While the order expands banks' obligations in supporting the administration's immigration policies, the order stops short of requiring firms to verify each customer's citizenship status, a move that was reportedly being considered and that would have imposed significant compliance costs.

The Federal Reserve's supervisors are collecting data on private credit activity to determine how bank funds are being deployed in the growing financial market.

Fed Vice Chair for Supervision Michelle Bowman told lawmakers the central bank is carefully monitoring private credit activity, but noted it is inherently difficult to get transparency into the sector.

"We have seen a rise in the investment from banks into [nonbank financial institutions] in particular, it's been difficult for us to have a clear understanding of where those funds are flowing," Bowman said. 

Bowman noted that the Fed has initiated a supervisory data collection series to improve transparency into this space to better understand "how bank funding is being used within the nonbank space, particularly private credit."

Bowman said bank lending to private credit is a "very small proportion" of overall bank lending, "but it is something that we need to [know] more about because it is opaque, which is exactly why we are asking for more information from our regulated institutions."

Rep. Joyce Beatty, D-Ohio, pressed Federal Deposit Insurance Corp. Chair Travis Hill on the status of Community Reinvestment Act rulemaking, questioning whether regulators' decision in July 2025 to nullifying their 2023 update to implementing regulations for the Community Reinvestment Act, a Civil Rights-era anti-redlining law that requires banks to invest in the communities they serve, are effectively reverting to a decades-old implementation framework.

Hill explained that the 2023 CRA rule "has never actually gone into effect" because it "was ruled by a federal court judge to have exceeded the statutory authorities." He said regulators are currently proposing to "codify rescinding that rule and reverting back to the 1995 rule," which has remained in place during litigation.

Hill added that the agency is still weighing next steps.

"We have been evaluating a range of possible options for next steps, which includes both finalizing the proposal from last summer, but also considering other options for proactive reforms," Hill said. "That's something that we continue to consider and I think we are likely to decide on a path in the near future."

Beatty pushed for a clearer stance, challenging the idea of staying on an outdated framework: 

"Does that mean that I could assume that you're not in favor of keeping the regulations the same?" she asked. "I mean, come on, it's 2026 that we're going to stay with 1995 [standards]?"

Hill responded more cautiously, acknowledging structural problems without committing to a specific direction.

"We recognize that there are a lot of flaws in the 1995 rule," Hill said. "So considering options for a new approach is, I think, worth considering."

Rep. Bill Foster, D-Ill. pressed officials on the cybersecurity risks posed by Anthropic's Mythos model, which he said has already identified more than 10,000 "high-and-critical level security flaws in otherwise trusted software."

Foster's questioned whether only large global systemically important banks, or G-SIBs and major institutions are getting early access to Mythos, while smaller banks and regional lenders are left to deal with weaker cyber defenses. 

"It's unquestionably true that small banks with their private systems have not been given the same level of cyber defense that the large ones have — which is not irrational, but it seems to me that you're going to need a very clear position on this," Foster said. 

He argued the government should define a standardized, defensible "software stack" for the financial system so regulators can prioritize consistent protection across institutions.

"You're going to have to define the defensive position perimeter and say this is a software stack that we're going to defend to the best of our abilities," Foster said. "Other institutions that are using different software stacks are going to have to just accept that there's lesser priority."

Regulators largely declined to disclose which institutions have access to Mythos or in what proportion. Gould echoed concern about the uneven security landscape and said they are focusing on third-party vendors that support smaller banks.

"I'm also concerned about the perception of a cyber moat, again, real or perceived, around the very largest banks, and I think, particularly around the smaller banks, as well as mid-size and regionals," Gould said. "It's very important for us to focus on the service providers that support them."

Foster also warned that autonomous AI systems operating at machine speed could trigger financial runs in seconds rather than hours, suggesting the 2023 bank failures could have been exponentially faster if agentic artificial intelligence had been deputized to run at the first sign of failure. 

"I don't think that we are prepared for agentic AI bank run. … If you look at what happened in Silicon Valley, and then ask yourself the question, what would have happened in the world where agentic finance makes things happen not at the speed of internet gossip [but] at the speed of agentic AI, that would have caused the run to take not 40 hours, but 40 minutes or 40 seconds," Foster said. "We are not ready for that, and you should come up with a plan to deal with that, because we can have that hearing now, or we can have it later."