# Agents at the bank's door
In October, the largest US banks shut out the AI agents their customers had started using to manage money. What they blocked, why it is hard, and a practical roadmap for financial institutions to let agents in safely.
- Published: 2026-10-23
- Type: Perspectives
- Topics: agents, governance, transformation
- Canonical: https://hellofig.io/blog/agents-at-the-bank
**In short.** Customers have started letting AI agents manage their money, and in October the largest US banks blocked agents that log in with passwords and move money. Restricting first is reasonable. The institutions that come out ahead will build a sanctioned front door: verified agents, scoped mandates instead of passwords, clear liability, agent-aware monitoring and customer controls.
---
This fall, people started handing a new kind of software the keys to their financial lives. Personal AI agents from Meta, xAI and a wave of startups can now check balances, pay bills, look for a better savings rate and move money on a customer's behalf. Many of them do it the simplest way available: the customer gives the agent their bank username and password, and the agent logs in as them.
In October the largest US banks pushed back. This piece covers what they did and why the problem is genuinely hard, and then sets out what we think financial institutions should do next. Blocking was a reasonable first move. It cannot be the last one, because customers are not going to stop using agents.
## What happened
On its third-quarter earnings call on Oct 13, JPMorgan said it would not let just any outside agent into its systems, and that where it can detect services using customers' passwords, it is blocking them. Its [transcript](https://www.jpmorganchase.com/content/dam/jpmc/jpmorgan-chase-and-co/investor-relations/documents/quarterly-earnings/2026/3rd-quarter/3q26-earnings-transcript.pdf) is careful on one point: the bank described agents as tools, neither good nor bad, and said it is working on letting them in properly. A spokeswoman [confirmed](https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html) that agents can still see balances through data connectors such as Plaid, but cannot send money or pay bills.
Within days, others followed. Bank of America [limited](https://www.pymnts.com/news/artificial-intelligence/2026/big-banks-will-not-let-outside-ai-agents-move-money/) agents' access to deposits while it writes rules for who is liable when an agent authorizes a payment. Citi [said](https://finance.yahoo.com/news/us-banks-limit-ai-agents-113229223.html) it does not let third-party agents log in or transact, while still allowing read-only access through approved open banking providers. Schwab [blocks](https://thenextweb.com/news/schwab-blocks-ai-agents-meta-muse) agents that use clients' credentials, including Meta's Muse, while letting clients connect their chosen AI models to Schwab through a controlled interface that cannot move money. Morgan Stanley began blocking third-party agents too, though it said it had not seen rogue agents on its platforms, and in Canada, RBC's chief executive [said](https://www.tokenpost.com/news/technology/35885) the bank was weighing similar steps.
Early reports of unauthorized agents roaming customer accounts were later [walked back](https://www.americanbanker.com/news/gould-banks-preparing-for-rogue-ai-agents-for-months). What banks were mostly seeing was customers sharing their passwords with agents they had chosen.
## What the banks actually blocked
The headlines said banks were blocking AI agents. That is not quite what happened. Every bank that went on the record kept read-only access open through approved data connections, the same kind budgeting apps have used for years. What they shut was password-based access: an agent logging in as the customer and acting with the customer's full powers, including moving money.
The new terms of service show where this is heading. Chase's [terms](https://www.chase.com/digital/resources/terms-of-use) now allow agents only if they identify themselves as agents, clearly label their traffic and answer truthfully if asked whether they are human, and make whoever deploys the agent responsible for its errors, including when it exceeds the authority it was given. Wells Fargo's online banking [agreement](https://www.wellsfargo.com/online-banking/online-access-agreement/upcoming/) taking effect on Nov 24 covers agents "if and when we permit" them and treats their transactions as authorized by the customer. These are not bans. They are the first draft of a set of rules.
## Why this is hard
Some of the banks' concern is entirely reasonable, and any roadmap has to start from it.
**The law was written for people.** Under the federal rules on electronic transfers, a transfer is not "unauthorized" if it was made by someone the customer [gave their access device to](https://www.consumerfinance.gov/rules-policy/regulations/1005/2/), until the customer tells the bank otherwise. A customer who hands an agent their password has plausibly authorized everything the agent does, mistakes included. Credential sharing quietly moves the risk onto the customer.
**Security systems assume a human.** Fraud models and login checks are built to tell a customer from a criminal. An agent using a customer's password looks exactly like the customer, which blinds the bank to the difference between a helpful agent and a hijacked one.
**Agents can be manipulated.** Attackers are already planting hidden instructions on web pages for agents to find. Security researchers have [documented](https://www.infosecurity-magazine.com/news/researchers-10-wild-indirect/) such payloads in the wild, including one that directed an agent to send a fixed $5,000 payment. An agent that reads the web and can move money is a new kind of target.
**The commercial stakes are real.** Agents that compare rates will move idle balances from checking accounts paying almost nothing to products paying 3% or more. JPMorgan's own cash optimization tool went live as a pilot in the same weeks it began blocking outside agents, and Schwab is rolling out its own assistant. Banks are right to protect customers; they also have a business to protect, and customers will notice the difference.
## We have been here before
In 2015, JPMorgan throttled the data feeds that let Intuit's Mint read customers' accounts by logging in with their passwords. Within about two years, the two had replaced passwords with a token-based connection the bank controlled, and JPMorgan eventually [said](https://americanbanker.com/news/jpmorgan-chase-says-it-has-fully-eliminated-screen-scraping) it had eliminated password-based scraping entirely. In 2025 it went a step further and [renewed](https://www.jpmorganchase.com/newsroom/press-releases/2025/jpmc-plaid-renewed-data-access-agreement) its data access agreement with Plaid on paid terms.
The sequence is familiar: a new intermediary arrives using customers' credentials, the institution blocks it, a sanctioned connection replaces the password with the institution setting the terms, and a standard follows. Agents are on the same path, moving faster. The question for each institution is whether it designs that sanctioned connection or has one designed for it.
## A roadmap for financial institutions
What follows is what we would do, in roughly the order we would do it.
### 1. Know who is knocking
Before an institution can let agents in safely, it has to be able to tell them apart. We find it useful to sort traffic into five kinds, each with its own treatment.
The goal is to move agent traffic from the middle rows to the second row, not to block it all.
The tools exist. An emerging standard lets agents [sign their requests](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/) cryptographically so a site can verify which platform sent them. Cloudflare has [offered](https://blog.cloudflare.com/signed-agents/) a "signed agents" category since 2025, and the major bot management vendors now classify agent traffic separately from crawlers and attacks. Terms of service like Chase's make self-identification a condition of access. Start by measuring: how much agent traffic there is, which kind, and on which accounts. Note the limit: a signature proves which platform an agent came from, not what the customer actually asked it to do.
### 2. Give agents a front door
The single most useful thing an institution can do is offer a sanctioned way in, so that customers and agent providers have no reason to share passwords.
That means two things. First, **agent registration**: before an agent provider connects, it identifies its operator, registers its signing keys and passes a security review, the same third-party due diligence regulators [already expect](https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html) for any important vendor. Second, **an official interface**: an API protected by modern financial-grade standards such as [FAPI 2.0](https://openid.net/wg/fapi/), or an MCP server, the connection format AI models increasingly use, that issues each agent a token tied to one customer and a defined set of permissions.
Several institutions have started. Schwab lets clients connect their chosen AI models to Schwab's own servers, with Schwab controlling authentication and no money movement. Danske Bank [opened](https://danskebank.com/news-and-insights/news-archive/press-releases/2026/pr21102026) an MCP server over its business banking APIs on Oct 21 for customers using Claude or ChatGPT. Robinhood [opened](https://robinhood.com/newsroom/robinhood-is-now-open-to-agents/) to agents in May through dedicated MCP servers. On the card side, the networks are doing the same for checkout: Visa's [Trusted Agent Protocol](https://corporate.visa.com/en/sites/visa-perspectives/newsroom/visa-unveils-trusted-agent-protocol-for-ai-commerce.html), Mastercard's [Agent Pay](https://investor.mastercard.com/investor-news/investor-news-details/2025/Mastercard-Unveils-New-Tools-and-Collaborations-to-Power-Smarter-Safer-Agentic-Commerce/default.aspx) and the agent registration American Express is [developing](https://www.americanexpress.com/en-us/company/agentic-commerce/) all have agents identify themselves. Card-network identity covers card payments, though, not transfers inside online banking, so banks still need their own registration for account access.
Start read-only, as Schwab and Danske have, and widen from there.
### 3. Mandates, not passwords
A password grants everything. A sanctioned agent should get only what a specific job needs, with limits attached. We would define a small catalogue of permissions, each with its own guardrails.
| Permission | What the agent can do | Limits | When a person approves |
| --- | --- | --- | --- |
| View | See balances and transactions | Chosen accounts only | When connecting |
| Move own money | Transfer between the customer's own accounts | Amount and frequency caps | Within the mandate, no approval needed |
| Pay known payees | Pay existing billers and payees | Per-payment and monthly caps | Above the cap |
| Pay new payees | Add and pay someone new | Low first-payment limit | Always, on the customer's own device |
| Trade or spend in a fenced account | Trade or spend from funds set aside for the agent | The balance of that account | Optional per transaction |
Good models already exist. In the UK, [variable recurring payments](https://www.openbankingtracker.com/guides/commercial-vrp-ukpi) let a customer set a maximum amount, frequency and duration for payments a third party may initiate, which is exactly the shape an agent mandate needs. Robinhood's agents trade only from a separate account funded for the purpose, and its agent card has a monthly limit and optional approval on every purchase. Stripe's tools for [agent cards](https://docs.stripe.com/issuing/agents) add per-transaction limits, merchant-category restrictions and single-use cards.
For anything outside the mandate, require **step-up approval** on the customer's own device, through a push notification the agent cannot see or answer. That one control does more than any other to blunt prompt injection: even a manipulated agent cannot approve its own unusual payment.
### 4. Make liability legible
Today, a customer who shares a password probably carries the risk of whatever the agent does. A sanctioned connection changes that. When an agent acts through a scoped, revocable token, it is clear what the customer authorized: anything outside the scope was not authorized, and revoking the token is the customer's notice to the bank. The consumer protections customers expect come back into force.
Institutions should publish, in plain language, who pays in three situations: the agent acted within its mandate and made a mistake; the agent acted outside its mandate; the agent's token was stolen. American Express has [announced](https://www.americanexpress.com/en-us/company/agentic-commerce/) that it will protect eligible card members from charges caused by errors of registered agents, a sign of where competition is heading.
The UK's experience with mandatory fraud reimbursement is instructive. A year after it took effect, 88% of money claimed was [returned](https://www.psr.org.uk/news-and-updates/latest-news/news/one-year-on-impact-of-app-reimbursement-on-victims/) and 84% of claims closed within five business days, yet 71% of victims did not know their rights. Clear rules and fast resolution build trust; telling customers about them is half the work.
### 5. Watch the agent, not just the account
Fraud monitoring built around a person's habits needs a second lens for agents. Give every action an agent identifier in the audit log. Build a behavioral baseline per agent, not just per customer: how often it acts, what it usually does, which payees it uses. Flag velocity spikes, new payees and dormant agents that suddenly become active. Confirm new payees by name where the payment system supports it, as is now required for euro transfers across the EU. And keep a kill switch: the ability to suspend one agent, one provider or all agent access within minutes.
### 6. Put the customer in control
Customers should be able to see and manage their agents in one place in online banking: which agents are connected, who operates them, what each may do, what each has done recently, and buttons to pause or revoke. Chase's existing page for [linked apps](https://www.chase.com/digital/data-sharing), Plaid's portal and Robinhood's activity feed with one-tap disconnect are good starting points. Add notifications when an agent's permissions change, and a gentle message to customers whose password is being used by an agent, pointing them to the sanctioned path.
### 7. Decide your commercial posture
There are three postures: build your own assistant, open up to outside agents, or both. We think the answer for most institutions is both. Customers will choose their own agents regardless, and an institution that is easy for good agents to work with will win business from agents choosing products on a customer's behalf.
That has consequences. Publish product, rate and fee information in machine-readable form, because agents will compare it. Model what happens to deposits when agents shop rates for every customer, and price accordingly. And decide early whether sanctioned agent access is a cost of doing business or, like data access already is in some cases, something agent providers pay for.
### 8. Govern it as a new channel
Agent access touches fraud, digital identity, legal, compliance, third-party risk, model risk and treasury, so it needs one accountable executive and a cross-functional group that meets often. Report a handful of metrics to the board quarterly, and log near misses as well as incidents.
Regulators are moving in the same direction. US banking agencies have not yet issued agent-specific rules, and their revised model risk guidance from April explicitly leaves generative and agentic AI out of scope. The UK's Financial Conduct Authority [has said](https://www.fca.org.uk/news/speeches/building-future-finance-age-ai) it wants a framework for agent identity, delegated authority, accountability and execution, and that incident reporting should cover significant AI failures and near misses. Singapore's central bank has [issued](https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions) AI risk guidelines that cover agents and has [proposed](https://www.mas.gov.sg/publications/monographs-or-information-paper/2026/safeguards-for-agentic-finance-at-runtime) checkpoints before an agent acts. Industry standards bodies, including the [Financial Data Exchange](https://financialdataexchange.org/agentic-ai-open-finance-technical-standards/) in the US, have started work on agent identity, consent and delegation. Institutions that take part will shape the rules they later have to follow.
## The first year
Restrict first, then open a sanctioned door, then make agents a channel.
**In the first three months**, measure and classify agent traffic, update terms so agents must identify themselves, keep read-only access through approved providers, require confirmation on the customer's own device for new payees and large transfers, tell customers plainly not to share their passwords, and name an owner.
**From three to twelve months**, launch agent registration and an official read-only interface, add the permission catalogue with limits and step-up approval, ship the agent management page, make monitoring agent-aware, and publish a liability policy.
**After the first year**, allow money movement within mandates for registered agents, publish products in machine-readable form, settle the build-and-partner strategy, and take part in the standards work.
## Measuring progress
A few numbers will tell an institution whether the strategy is working:
- **Agent traffic by kind:** sanctioned, declared but using passwords, and undeclared.
- **Password-based agent sessions per week,** and the share of customers moved to the sanctioned path.
- **Sanctioned agent connections:** how many, for how many customers, with which permissions.
- **Step-up approvals per thousand agent actions,** and how often customers decline them, an early sign of manipulated or misfiring agents.
- **Disputes from agent actions** per thousand transactions, and how quickly they are resolved.
- **Losses on agent activity** compared with customer activity.
- **Time to revoke,** from a customer's click to a dead token.
- **Deposit flows driven by agents,** in and out.
The banks were right to close the password door. The ones that come out of this ahead will be those that open a better one: verified agents, scoped mandates, clear liability and customers firmly in control. The same is true for any business with a customer login, from insurers to airlines to retailers. Agents are becoming a channel, and channels are worth designing.
