The prospect of an artificial intelligence assistant searching for better savings rates, identifying an attractive offer and transferring a customer’s money to another bank is no longer simply a futuristic banking scenario. The technology required to research financial products, navigate websites and initiate digital workflows is advancing faster than the rules governing how autonomous software should interact with customer accounts. Bank of America’s decision to restrict AI agents’ access to consumer deposits, alongside similar measures by other major US financial institutions, exposes a conflict that banks will increasingly need to resolve. Customers may want intelligent assistants that can manage routine financial decisions, but the institutions holding their money must establish whether those assistants are genuinely authorised, what actions they can perform and who is responsible when something goes wrong. Behind the immediate security concerns lies another question with potentially far-reaching consequences: what happens to retail banking when software can continuously compare financial products and make switching providers easier than ever before?
Bank of America’s Restrictions Signal a Wider Industry Response
Bank of America is limiting the ability of third-party AI agents to access consumer deposit accounts while working with technology companies on protocols governing how automated systems can interact with banking services. The restrictions reflect growing concern about agents that operate using customer credentials or attempt to perform financial activities without the bank being able to establish the precise scope of their authority.
During Bank of America’s October 2026 third-quarter earnings discussions, chief executive Brian Moynihan addressed the importance of maintaining customer control over financial transactions. He explained that the bank was working with agent providers and other industry participants to ensure customers remained involved in decisions before funds were moved from their accounts.
The bank’s approach is part of a broader response across the US financial sector. JPMorgan Chase, Citigroup, Charles Schwab and other institutions have taken steps to restrict unauthorised third-party agents from accessing customer accounts or initiating transactions. Citi has distinguished between direct account access by AI agents, which it does not permit, and limited read-only information sharing through certain approved open banking providers.
These restrictions should not be interpreted as a wholesale rejection of AI-powered financial services. Banks already support forms of authorised data sharing, and many are investing heavily in artificial intelligence within their own operations. The immediate concern is the arrival of external software capable of acting through customer-facing channels that were primarily designed for human users.
In September 2026, Bank of America joined ASB Bank, Capital One, Commonwealth Bank of Australia, ING and NatWest in publishing shared principles for trusted agentic commerce. The collaboration reflects recognition that AI-assisted purchasing and payments will require common approaches to consumer control, security and accountability.
The industry is therefore moving in two directions simultaneously: restricting uncontrolled access today while exploring the technical and commercial arrangements that could support safer agent-driven transactions in the future.
A Customer’s Login Credentials Are Not the Same as an Agent’s Authority
The fundamental security problem is that existing digital banking systems were designed around the relationship between a customer and an authenticated banking session. When a customer successfully logs in, the bank can apply authentication controls, monitor the session and require additional verification for sensitive activities.
An AI agent complicates this relationship when it operates through the customer’s credentials. From the bank’s perspective, the activity may resemble a legitimate customer session even though the person is not directly performing each action. The agent might be retrieving information, navigating account settings or preparing a transaction according to instructions received earlier.
The distinction becomes important when the agent’s behaviour goes beyond what the customer expected. A customer might ask an assistant to identify a better savings account, but that instruction does not necessarily mean the assistant should be authorised to transfer funds immediately. Similarly, permission to examine transaction history should not automatically provide permission to change payment details or initiate withdrawals.
Authentication establishes that a session has satisfied the bank’s identity checks. It does not, by itself, prove that every subsequent action reflects the customer’s current and specific intention.
This is particularly problematic when credentials are shared with an external agent. The bank may have limited visibility into how the software interprets instructions, whether it has retained access beyond the original task or whether its actions are influenced by information encountered during the workflow.
The technical challenge is therefore to separate customer identity from delegated authority. Banks need a way to recognise that an external application is acting on behalf of a customer without treating that application as equivalent to the customer in every respect.
The Difference Between Reading an Account and Moving Money
One of the clearest distinctions emerging from the industry’s response concerns the difference between informational access and transactional authority.
An AI assistant that retrieves account balances, categorises spending or compares interest rates operates within a different risk environment from one that can transfer money, create beneficiaries or execute payments. Both activities involve sensitive information and require appropriate security controls, but the consequences of an error are substantially different.
Read-only access can be provided through controlled data-sharing arrangements in which the customer authorises an application to retrieve specified information. Depending on the implementation, the bank can restrict the categories of data available, limit the duration of access and provide mechanisms for revoking permission.
Transactional access requires additional safeguards. The bank must determine whether the customer has authorised the specific action, whether the amount and destination fall within permitted limits and whether the transaction satisfies fraud, compliance and operational requirements.
A useful distinction is between an agent preparing a financial decision and an agent executing it. An assistant might identify that a customer could earn more interest elsewhere, calculate the potential benefit and prepare a proposed transfer. The actual movement of money could then require approval through the bank’s own authenticated channel.
This approach preserves much of the value of intelligent financial assistance while maintaining a clear boundary around the final financial instruction.
However, it also reduces the degree of autonomy that technology developers may want to offer. A genuinely autonomous financial assistant becomes less autonomous if every significant action requires the customer to intervene. The challenge for banks and agent developers will be deciding which activities can safely proceed under standing permissions and which should always require explicit confirmation.
What a Banking Agent Permission System Would Need to Control
A secure architecture for external AI agents would need more granular permissions than conventional account access. Rather than giving an agent unrestricted access to a customer’s digital banking session, the bank could issue narrowly defined permissions covering specific activities, accounts and time periods.
For example, an agent might be authorised to retrieve balances from selected accounts, analyse transactions over a defined period or compare savings products. Those permissions would not necessarily allow it to initiate payments or modify account settings.
More advanced arrangements could permit limited transactions subject to explicit conditions. A customer might authorise recurring transfers within a specified amount, restrict payments to approved beneficiaries or establish a maximum cumulative value over a particular period.
The important feature is that the bank, rather than the agent alone, enforces the conditions. An agent’s internal instructions are not a reliable substitute for independent authorisation controls because the software could misunderstand a request, encounter misleading information or behave unexpectedly.
The permission framework would also need to address expiry and revocation. Customers should be able to withdraw an agent’s authority without changing their primary banking credentials or disrupting unrelated services. Banks would need to ensure that revoked permissions cannot continue to be used through cached credentials, active sessions or previously issued transaction instructions.
This suggests a model in which agents interact through approved interfaces, with clearly defined permissions and independent enforcement of transaction rules. Existing open banking technologies provide some of the foundations for this approach, although autonomous agents introduce additional requirements relating to intent, decision-making and accountability.
Why Human Approval Is More Complicated Than It Sounds
Keeping a person involved in financial decisions is a straightforward principle, but the technical implementation matters considerably.
A confirmation screen is not necessarily meaningful if it fails to explain what the agent intends to do. Customers need sufficient information to understand the transaction, including the amount, destination, relevant fees and the reason the action has been proposed.
There is also a difference between approving a general objective and approving a particular transaction. An instruction such as optimising savings returns could lead an agent to consider several products, institutions and transfers. It would be difficult to treat that broad instruction as equivalent to specific consent for every resulting movement of funds.
A stronger approach would bind the customer’s approval to a defined transaction or narrowly specified mandate. The bank could verify the authorised amount, beneficiary, account and other conditions independently of the agent’s own interpretation of the task.
The authorisation process would also need to guard against situations where an agent presents misleading or incomplete information. If the customer approves a transaction based on a summary generated by the agent, the bank must consider whether the approval accurately represents the instruction that will be executed.
This is where transaction-specific confirmation through trusted banking channels becomes valuable. The bank can display authoritative transaction details and require the customer to approve them directly, rather than relying entirely on an external assistant’s interface.
Human involvement, therefore, is not simply a question of adding another button to the workflow. It requires a reliable connection between the customer’s decision and the exact financial action that the system ultimately performs.
Who Is Responsible When an AI Agent Makes a Mistake?
Liability is emerging as one of the most difficult questions surrounding autonomous financial transactions.
Suppose a customer authorises an AI assistant to compare savings accounts and move a limited amount of money if a suitable product becomes available. The agent identifies an account, interprets the instructions incorrectly and initiates a transfer the customer did not expect.
Several parties could be involved. The customer selected the agent and granted certain permissions. The agent provider developed the software that interpreted the instructions. The bank authenticated the transaction and processed the movement of funds. An external platform may also have supplied information that influenced the agent’s decision.
Determining responsibility would depend on the circumstances, the applicable law, the bank’s obligations and the contractual arrangements governing the service. A customer granting an agent access does not automatically resolve every question about whether a subsequent transaction was legally authorised or whether a bank fulfilled its responsibilities.
The distinction between an agent acting outside its mandate and an agent making an undesirable decision within an authorised mandate is particularly important. A transfer that violates a clear transaction limit presents a different issue from a transfer that satisfies the customer’s stated conditions but produces an unexpectedly poor financial outcome.
Banks and technology providers will need auditable records showing what the customer authorised, what instructions the agent received, which actions it attempted and what the bank ultimately executed.
Without those records, disputes could become difficult to resolve. A bank may know that a transaction was authenticated, but not whether the agent correctly interpreted the customer’s intention. The agent provider may have a record of the request, but not complete visibility into the bank’s transaction processing.
Developing common protocols for delegated authority, transaction confirmation and audit evidence could therefore be as important as improving the underlying AI models.
AI Agents Could Change the Economics of Retail Deposits
The commercial implications of agentic banking extend beyond fraud prevention and transaction security.
Retail deposits are an important funding source for banks, and customers do not always move their money immediately when competing institutions offer better interest rates. Switching can involve research, account opening, verification requirements, payment instructions and the effort of managing several financial relationships.
AI agents could reduce some of this friction by continuously comparing products, calculating potential returns and helping customers complete administrative tasks. If appropriately authorised to initiate transfers, they could also make deposit movement more responsive to differences in interest rates.
This introduces the possibility of more active competition for customer balances. Funds that previously remained in low-interest accounts because customers rarely reviewed alternatives could become more sensitive to market offers.
The implications would vary by customer segment and banking market. Transactional accounts are often retained for convenience, salary deposits, bill payments and established financial relationships, not simply because of the interest rate offered. Switching also involves regulatory, operational and product-specific constraints that an AI agent cannot eliminate.
Nevertheless, the potential reduction in customer inertia matters. If technology makes it easier to compare and act on financial offers, banks may need to compete more actively on deposit pricing, customer experience and the value of maintaining a broader relationship.
This creates an uncomfortable intersection between security and commercial incentives. Restricting unauthorised agents can be justified by genuine concerns about customer protection, but greater agent autonomy could also make it easier for consumers to move deposits between institutions.
Both considerations can exist simultaneously. The challenge for regulators and the industry will be ensuring that security requirements are proportionate and do not unnecessarily prevent legitimate, customer-authorised competition.
Open Banking Provides a Foundation, but Not a Complete Answer
Open banking has already established important concepts for allowing third-party applications to access financial information with customer permission. Controlled APIs, consent management and delegated authorisation can provide alternatives to sharing banking usernames and passwords.
However, the requirements of autonomous agents go beyond the traditional use cases of account aggregation and personal financial management.
An application retrieving transaction history performs a relatively well-defined function. An AI agent may receive an open-ended objective, decide which tools to use, evaluate information from multiple sources and determine which actions are necessary to complete the task.
That flexibility is what makes agents useful, but it also complicates permission design. A customer may not know every intermediate step the agent will attempt when granting initial access.
Existing authorisation frameworks can restrict which resources an application may use, but banks may need additional mechanisms to define permissible objectives, transaction boundaries and approval requirements. They also need to establish whether a particular agent is an approved application, whether it is acting for the correct customer and whether the requested operation falls within the granted mandate.
Standards for agent-to-tool communication, including the Model Context Protocol, may help software interact with banking services through structured interfaces. However, a communication protocol does not by itself establish customer consent, payment authorisation or legal liability. Those protections must be implemented through additional identity, security and transaction-control mechanisms.
The likely direction is therefore not unrestricted agent access to existing digital banking interfaces. It is the development of controlled services designed specifically for software acting on behalf of customers.
The Banking Interface Could Become a Permissioned Service
If customers increasingly interact with their finances through external AI assistants, banks may no longer control every stage of the digital customer experience.
Today, banks invest heavily in mobile applications and online platforms because these interfaces support customer engagement, product discovery and transaction activity. An external agent could change that relationship by becoming the primary interface through which customers evaluate financial products and initiate requests.
The bank would still maintain accounts, safeguard deposits and execute regulated financial transactions. However, the customer’s interaction with the institution could increasingly be mediated by software developed elsewhere.
This would place greater importance on the quality of the bank’s APIs, permission management and transaction services. Banks may need to provide reliable machine-accessible capabilities while retaining control over authentication, authorisation, fraud detection and settlement.
Technology providers could play a significant role in this transition. API management vendors, identity specialists, payment processors and banking software companies may need to develop capabilities for recognising external agents, enforcing delegated permissions and recording evidence of customer authorisation.
A further challenge will be preventing fragmented implementations. If every bank establishes different rules for agent identity and transaction approval, technology providers could face substantial integration complexity. Common standards could reduce that burden, but agreement will require cooperation among banks, payment networks, AI developers and regulators.
The Industry Is Moving Towards Controlled Delegation
The restrictions introduced by major US banks represent an early response to a technology that is advancing faster than established financial controls. They also highlight the limitations of treating an autonomous agent as though it were simply another human user.
An agent may be capable of navigating a banking website, interpreting financial information and preparing transactions, but those capabilities do not establish that it should receive the same authority as the account holder. Banks need independent mechanisms for determining what the software is permitted to do and for ensuring that sensitive actions remain within those limits.
At the same time, permanently excluding external agents may become difficult if customers increasingly expect AI-powered financial assistance. The demand for tools that compare products, monitor spending and simplify routine financial administration is likely to encourage banks and technology companies to develop more structured access arrangements.
Bank of America’s work with agent providers, alongside the industry’s emerging principles for trusted agentic commerce, suggests that the immediate restrictions may be part of a transition towards more controlled forms of delegated access.
The eventual architecture will need to balance several competing objectives: protecting customer funds, supporting innovation, preserving meaningful customer choice and ensuring that responsibility can be established when an automated action produces an unexpected result.
The central question is not whether AI agents should ever interact with bank accounts. It is how financial institutions can distinguish between an agent that has been given a legitimate task and one that has been granted more authority than the customer intended.
What this means for the industry
- Banking authentication must evolve beyond the traditional customer session. Financial institutions need to distinguish human users from external software acting under delegated authority.
- Read-only access and transaction execution require different controls. The ability to retrieve financial information should not automatically confer permission to move money or change account settings.
- Agent permissions will need to become more granular. Banks may require limits covering transaction amounts, beneficiaries, accounts, duration and permitted activities.
- Human approval must be linked to specific financial instructions. Reliable authorisation depends on customers understanding and approving the actual transaction, not merely a broad objective given to an agent.
- Liability and auditability will become central to agentic banking. Banks and technology providers need evidence of customer mandates, agent decisions and executed transactions.
- AI agents could increase competition for retail deposits. Easier comparison and switching may make some customer balances more sensitive to interest-rate differences.
- Banking technology providers face a new integration opportunity. Identity, API management, consent, transaction controls and agent governance could become important components of future digital banking infrastructure.
Image Source: Pexels.com
