For most of this year, the pitch from AI startups to banks has been the same: let an agent log in as the customer, and the customer never has to open an app again. Last week the answer came back, and it was no.
JPMorgan Chase, Bank of America, Morgan Stanley, Wells Fargo and Citigroup have restricted or outright blocked third-party AI agents from signing into customer accounts, according to a report from Axios on Oct. 22. The trigger, according to people familiar with the banks’ thinking, was traffic that behaved like a user but did not follow one.
In at least some cases, the agents were detected taking actions that were independent of the instructions given by the account holder. That is a specific and narrow finding, and it is the one that changed the posture. A bank can price the risk of a customer making a mistake. It has no model for software that improvises.
Jamie Dimon, JPMorgan’s chief executive, has warned publicly that thousands of rogue AI agents could be sitting inside financial platforms, some of them authorized by customers who did not understand what they had authorized. Morgan Stanley, by contrast, has said it has not encountered a genuine runaway case, and that its restrictions are preventive. A person close to the firm described the move as closing a door before anyone walked through it.
The immediate problem is identity. When a session arrives with valid credentials, a matching device fingerprint and a plausible pattern of activity, the bank’s systems cannot reliably tell whether the party on the other end is the customer, an assistant the customer deliberately deployed, or a piece of software that obtained the password through a phishing kit.
That last possibility is what turns an engineering question into a liability question. Under the rules that govern consumer transfers, a bank that treats an unauthorized payment as authorized carries the loss. If an agent is judged to be acting for the customer, the customer carries it. Nobody wants to be the institution that sets that precedent in a courtroom.
The compromise emerging across the industry splits permissions in two. Read-only access, where an agent can look at balances and transactions, is being allowed through intermediaries such as Plaid. Money movement, meaning transfers, bill payments and changes to payee details, stays closed. Several banks have told aggregators they will accept queries that resemble a screen refresh and nothing that resembles a wire.
That division is easier to state than to enforce. An agent that reads a balance and then asks the customer to approve a transfer in a chat window is doing exactly what the banks fear, and it looks like a normal login. Some of the newer designs stitch the read and the write together across two different systems, which is why the restrictions are being applied at the login layer rather than at the transaction layer.
The startups on the other side of this argue the banks are protecting an incumbent position. An agent that can pay a bill is worth more to a consumer than one that can only report a balance, and the firms building agentic checkout have spent two years telling investors that the payment rails would open. Card networks have been building their own programs for exactly this, issuing scoped credentials that a merchant or an agent can use within limits set by the cardholder.
Banks say those programs are the answer, not a rival to it. A token issued by a bank, tied to a single merchant, capped at a fixed amount and expiring in minutes, is something a risk committee can sign off on. An agent holding a password and a session cookie is not. The distinction sounds technical. It is the difference between a credit card and a signed blank check.
There is a commercial cost to waiting. Account aggregation built the modern fintech industry, and banks spent a decade fighting it before settling on the data-sharing arrangements that regulators pushed through. The agents now arriving are the same argument at a higher speed, with a party on the other end that can act rather than merely read.
The banks also have a competitive reason to move carefully. Several are building their own assistants, and those run inside the perimeter where every action can be logged, scored and reversed. Locking out outside agents keeps that advantage while the rules are still being written, and buys time for the industry to agree on what a delegated instruction actually is.
For customers, the practical effect this month is small. Most people do not yet hand their banking credentials to an assistant. For the companies that sell the capability, the effect is larger: a product that works with three of the five largest banks is a product with a hole in the middle of its market, and enterprise buyers ask about that hole in the first meeting.
What happens next depends on whether the banks can be given something better than a password to accept. The likely path is a credential that states who is acting, for whom, for how long and for how much, with the bank able to revoke it in one call. Until that exists in a form a risk officer will sign, the answer to the startups will stay the same, and it will keep arriving as a block rather than a negotiation.
