Banks Tell Your AI Agent It Can Look at the Money but Not Touch the Money
JPMorgan, Bank of America, Citi and Schwab are restricting outside agents from customer accounts, in a policy best summarized as a museum rope.
For about two years, the promise of the AI agent has been simple: it will handle your boring digital chores. Pay the bill. Move the money. Find the better savings rate and chase it like a golden retriever after a tennis ball.
This month, several of America’s largest banks looked at that promise and said, in the language of finance, no.
Start with JPMorgan Chase, which on its October 13 third-quarter earnings call said it would not let outside AI agents operate inside the bank, per Let’s Data Science. According to PYMNTS, outside agents can still see balances through authorized connectors like Plaid, but cannot send money or pay bills. CEO Jamie Dimon, per PYMNTS, warned of “rogue agents,” and the bank gave no timeline for changing the policy.
The policy is, in effect, a museum rope. Look all you like. Do not touch the exhibit. The exhibit is your checking account.
Bank of America, per PYMNTS, is limiting agent access to consumer deposits while it writes rules on which party is liable for an AI-authorized payment. CEO Brian Moynihan said a human should approve money leaving an account. Citigroup, per the same report, does not let third-party agents log in or transact, though certain authorized open-banking providers can retrieve account information in read-only form. Charles Schwab blocks unauthorized agents, including Meta’s Muse, “in the tens and 20s” each week, according to PYMNTS. Its CEO, Rick Wurster, is quoted saying, “We’re not going to allow them to move money…”
Note the number: tens and twenties per week. That is not a flood. It is a polite, steady drip of robots knocking on the door with a stolen set of credentials the customer handed over willingly.
The reasons are the interesting part, and they are less cinematic than “rogue AI.” Per Let’s Data Science, banks are trying to separate activity a customer authorized from automated activity they did not. Software that acts through a customer’s credentials or account connections makes that distinction hard. Many institutions also require customers to log in themselves, so an assistant holding a customer’s credentials may fall outside the terms of service. And risk varies by action: reading a balance is a different animal than initiating a transfer, changing a payee, or contacting support.
PYMNTS links the restrictions to fraud, unauthorized payments, and unclear accountability when something goes wrong. It also frames this as the latest chapter of the open-banking fight over who controls access to bank infrastructure. That is worth saying plainly: this is not only a safety story. Digital Today reports that the main concern is agents moving deposits out of banks in search of higher returns, and cites a striking figure: non-interest-bearing deposits at JPMorgan, Bank of America, and Wells Fargo total $1.6 trillion, and paying 3 percent on that would cost $47 billion a year, close to half the three banks’ combined annual profits. Apollo’s chief economist Torsten Slok warned that agents could shift funds from accounts paying about 0.1 percent to ones paying 3.3 to 5 percent. It is a who-owns-the-customer story wearing a safety vest, and the vest is genuinely load-bearing.
The reporting is careful on one point worth preserving. Let’s Data Science notes that its reporting does not establish the reported agent activity was malicious, and that no uniform industry standard for third-party agent access has been announced. Nobody has said an agent robbed anybody. The banks are simply deciding, in advance, who gets to hold the pen.
Meanwhile, the agents’ makers are building as though the doors will open. Anthropic’s new Claude Duet, for instance, lists moving money between accounts and trading securities as off-limits even with user approval. So at least one lab has looked at the same banking sector and arrived at the same rope. It is a rare moment of convergence: the bank says the agent can’t, and the agent says it won’t. A marriage of mutual distrust is still a marriage.
There is a competing philosophy, and PYMNTS does note it. Robinhood lets outside AI agents trade through its banking MCP server, with a customer-set spending limit, optional manual approvals, and no access to the primary card number. This is the “let them in, but give them a very small wallet” approach, the financial equivalent of sending a toddler to the corner store with exactly two dollars.
Schwab, for its part, plans to offer read-only access for balances and research and is steering clients to its own assistant, called Charley. One can’t help noticing the pattern. The bank’s concern is that an unauthorized agent might act on your behalf. The bank’s solution is an authorized agent that also acts on your behalf. The difference, it must be said, is that one of them has a contract.
What happens next? Likely the same thing that happened to every other fight over data access: a negotiation, a fee, a standard, and a conference. PYMNTS reminds us that JPMorgan reached a data access agreement with Plaid in September 2025 under which Plaid agreed to pay for customer data. That precedent suggests the agents’ road to your bank account will have a toll booth.
In the meantime, the guidance for the modern consumer is clear. Your agent may check your balance. Your agent may draft your budget. Your agent may, if you ask nicely, explain what a “pending authorization” is. But if it wants to move your money, it will have to do what the rest of us do: ask a human, wait on hold, and say its name twice.
Sources: