Blocking AI agents is the right near-term move for banks

• Key insight: The industry won’t be able to fend off customers’ use of outside AI agents forever. Right now, though, bankers have an opportunity to begin creating the policies and procedures that will govern them in the future.
• Forward look: With good reasons to move slowly, banks should seize this opportunity to address long-standing weaknesses while preparing for a new way of doing business.

Jamie Dimon has long been an enthusiastic advocate for technology. He’s made AI a strategic priority at JPMorganChase and backed a $19.8 billion technology budget for 2026. So, when the CEO of America’s largest bank says outside AI agents are too risky to allow into customer accounts, we should take note.

Processing Content

Morgan Stanley, Bank of America and Citi are also restricting third-party agents, and for good reason. Axios reports that banks are already detecting agents accessing customer accounts, sometimes taking actions beyond what customers authorized.

The liability concerns are justified. Right now, there is little consensus on who’s responsible when an agent transfers money without permission. Is it the bank, the customer or the company that built the agent? Most online banking agreements were written with human customers in mind, not autonomous software acting on their behalf.

Even though some banks have already rewritten their terms of service to address these questions (usually assigning liability to the customer that authorized the agent to act on their behalf), changing the fine print won’t necessarily settle them. And we’ve seen how quickly assumptions about liability can change.

With authorized push payment, or APP,  scams, victims are tricked into approving payments to fraudsters. Since the customer authorized the transaction, it was defensible that they were liable for the losses. But as losses mounted, regulators stepped in. In the U.K., banks are now required to reimburse victims in most qualifying cases, even if they authorized the payments. If AI agents start making costly mistakes, banks shouldn’t assume today’s liability rules will be the final word.

Not to mention, banks have spent decades building customer relationships and don’t want to cede that ground to third-party software. On the one hand, banks and fintechs want their product offers to be discoverable by agents, and on the other, those same agents could make it much easier for consumers to shop for better rates and move money between institutions, threatening the loyalty and deposit relationships banks depend on.

How, then, can banks let third-party agents in safely?

Charles Schwab is blocking unauthorized agents while developing controlled ways for customers to connect AI assistants to their accounts (and pushing the use of its consumer-facing agent, Charley).

Meanwhile, six banks, including Bank of America and Capital One, have published principles for establishing trust in agentic commerce. They emphasize transparency, consumer consent, fraud protection and freedom to choose agent services.

Read more:

Both approaches recognize that banks need safeguards beyond a blanket prohibition. But approved connections don’t eliminate fraud risk. They can actually introduce risks that existing safeguards weren’t designed to catch.

Take the case of a criminal operating dozens of mule accounts. An agent that can’t transfer money could still monitor balances across those accounts. Banks might ordinarily detect suspicious patterns when someone accesses multiple unrelated accounts. But when those requests come through an approved AI connection, some familiar warning signs may be absent.

Blocking agents at login presents another problem. FFIEC’s guidance calls for risk-based authentication, but AI agents complicate matters. A customer can log in legitimately and then hand control to an agent, which may act in ways the customer never intended. So, knowing who logged in is no longer enough; banks need to know what’s happening the whole time they’re inside. It’s an open question if the FFIEC’s original guidance will be updated to require agent-specific controls.

Furthermore, the technology is changing faster than the industry can keep up, and the infrastructure needed to secure and govern agentic systems is still evolving. While banks have spent years dealing with account takeovers, unauthorized transactions and fraud committed using legitimate credentials, the speed, scale and independence with which agents can operate is new. The banks’ position paper acknowledges their five principles must be backed by technical controls not yet in place.

So, this is no place for a “move fast and break things” approach.

This isn’t solely a technology problem, either. Modern security and fraud infrastructure needs to enable fraud, cybersecurity and compliance teams to better share information and understand how agent activity could affect their respective responsibilities. If they remain siloed, each may see part of a suspicious interaction without recognizing the broader risk.

But there is an opportunity here. The tightened controls needed for AI agents can improve detection of “traditional” scams and fraud, provided fraud and security systems treat human and agent interactions holistically. Customers would benefit from stronger safeguards and greater freedom to use new financial services, with fraud and security teams being able to react more dynamically to a changing threat landscape.

With good reasons to move slowly, banks should seize this opportunity to address long-standing weaknesses while preparing for a new way of doing business.

Let’s use this time wisely.