The money in question earns almost nothing. It sits in a checking account or a low-yield savings account because moving it requires a decision, and most people do not make that decision on a Tuesday afternoon. Software does, and the software now exists.
Citigroup and Bank of America became the latest large American lenders to restrict what third-party artificial intelligence agents can do inside customer accounts, the Financial Times reported on October 17. A Citi spokesman put the position plainly: the bank does not permit “third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms,” a step the company described as protecting account and personal information.
Brian Moynihan, Bank of America’s chief executive, was less specific and more revealing. He suggested the bank is limiting agent access to consumer deposits while it works out an agreement on who pays when an authorized payment goes wrong. That is the sentence worth reading twice. The restriction is not chiefly about fraud. It is about where the liability lands when a machine moves money on a customer’s instruction and the customer later says it should not have.
The two banks joined a queue that formed quickly. JPMorgan Chase, Charles Schwab and Wells Fargo moved against third-party agents in the days before, according to accounts from CNBC and Bloomberg. Jamie Dimon, JPMorgan’s chief executive, said the bank would not let outside agents into its systems. A JPMorgan spokeswoman explained the mechanism rather than the principle: the bank does not allow third parties to obtain a customer’s credentials and log in on the customer’s behalf, because it considers that unsafe. Charles Schwab’s Rick Wurster said the broker was blocking unauthorized agents, naming Meta’s Muse among them.
Set those statements side by side and a single commercial fear comes into view. An agent given the keys to a deposit account will do what a diligent treasurer does: compare the yield on idle cash against the yield next door, and move it. Banks fund a large share of their lending with balances that pay close to nothing. Every dollar an agent sweeps into a money market fund or a rival’s higher-rate account is a dollar of cheap funding that walks out the door at machine speed, at three in the morning, without a branch visit or a phone call to retention.
That is the uncomfortable part of the argument for the banks. The customer is not being robbed. The customer is being optimized. Banks have spent a decade telling depositors to compare rates; a tool that finally does it automatically is the logical result, and the industry’s response has been to close the door and describe the closure as security.
There is a real security argument underneath. Most consumer agents reach a bank by holding a customer’s username and password and driving the web interface, which means the bank cannot tell an agent from a thief using a stolen password, cannot rate-limit it per consent, and cannot revoke one permission without breaking the whole login. The bank’s fraud models see a session that behaves unlike a human, and their own terms of service prohibit sharing credentials. From the risk side, the wall is defensible.
The liability question is harder. Consumer protection rules written for unauthorized electronic transfers assume a binary: the customer authorized the payment, or someone else did. An agent acting on a standing instruction, optimizing within limits the customer set, and choosing a counterparty the customer never named fits neither category. If the transfer turns out to be a scam, the customer will say the agent was tricked and the bank should restore the funds. The bank will say the customer authorized the agent. Nobody has litigated enough of these cases to know how they end, and until someone does, institutions have every reason to keep the question from arising.
The commercial question is where this gets interesting. Blocking agents protects the deposit base now, and it also cedes the interface to whoever else is willing to serve the customer’s instruction. Payment networks, brokerages and fintech intermediaries would be glad to hold the relationship, and a bank that insists on being the last screen a customer touches may find that customers stop touching it.
What the banks are likely building toward is not a permanent ban but a licensing regime: named agents, registered identity, scoped permissions, contractual allocation of liability, and a data pipe the bank controls. Several lenders have been discussing exactly that with regulators, according to the reporting, and the industry’s trade bodies have argued that agent access should run through bank-approved channels rather than credential sharing.
The tell will be the first bank that announces an approved agent program with a partner, terms and a liability schedule. Until then, the wall stands, and the deposits behind it stay where they are, earning what they earn.
Moynihan’s phrasing is the one to remember. He did not say agents were dangerous. He said the industry needs an agreement on who is responsible for an AI-authorized payment. That is a negotiation, and negotiations end.
