Banks shut the door on AI agents: banking chooses control over convenience and shifts the risk to customers

By USA Today · October 23, 2026.

Citi, Wells Fargo, Bank of America and JPMorgan Chase have moved to block third-party AI agents from accessing their platforms, as first reported by Axios and picked up by USA Today. Other institutions are following suit, according to the outlet.

An AI agent is software that acts on a user's behalf: it can log into their account, make purchases or move money without the person stepping in at each stage. That is exactly what worries the banks.

Citi says it does not allow third-party agents to log in or operate directly on its platforms. It does let customers authorize read-only access through open banking providers approved by the bank. According to a spokesperson, it has not detected any cases of agents accessing customer accounts.

Bank of America CEO Brian Moynihan told Bloomberg on October 15 that his bank restricts agent access to consumer deposits. He wants a human in the loop, with the customer authorizing a payment before it goes through. According to USA Today, JPMorgan's CEO confirmed that it also blocks outside agents. Charles Schwab, for its part, says it blocks "dozens to scores" of attempts by major agents to access client funds, and has launched its own assistant, Charley, which does not execute trades.

The security picture points the same way. According to a 2026 Palo Alto Networks study, two-thirds of chief information security officers (CISOs) in financial services and software rank agentic AI among their top three risks, and more than a third see it as the biggest. In September, a coalition of Bank of America, Capital One and four other global banks warned that the technology is outpacing standards.

Andre Durand, CEO of Ping Identity, a company that sells identity security to banks, poses the underlying question: how do you tell that a request comes from an agent rather than a human, and how do you know whether it is acting with that person's genuine authority? He advocates passkeys and biometrics, because one-time passwords sent by email are no longer enough if the agent has access to the inbox. His diagnosis should be taken with caution: his company sells exactly that solution.

**Our take.** The block makes sense today. With no reliable way to identify agents or verify their mandate, opening the door would be irresponsible. But the fine print matters more than the headline.

Wells Fargo's new online access agreement, which takes effect on November 24 according to USA Today, states that the user is "solely responsible" for overseeing their agents. It also treats all agent transactions as authorized, "including those you did not intend or want," unless the customer notifies the bank and the bank has had a "reasonable opportunity" to act. In other words, the bank blocks unauthorized agents, but if you authorize one, the risk is yours.

It is the same question we ask of any security breach: what happens when something goes wrong, and who is accountable? Here, for now, the contractual answer is "the customer." That could discourage the banks themselves from building the defenses and standards that agents need.

There is also a strategic play. By restricting third-party agents and offering their own (Schwab's Charley), banks are protecting their customers, but also the customer relationship. As a rule, whoever controls the front door controls distribution, and banks do not want to become pipes behind someone else's assistant.

In the long run, this is transitional friction, not a permanent roadblock. Agents that reliably handle finances, purchases or paperwork are part of the promise of freeing up human time. Getting there will take verifiable agent identity, accredited delegation, spending limits and a clear allocation of liability. Until then, the prudent advice is the one the banks keep repeating: a human in the loop for anything that moves money.