Major US banks are tightening restrictions on third-party artificial intelligence agents that attempt to access customer accounts or carry out financial transactions, highlighting the challenges of introducing autonomous AI into highly regulated financial systems. The reported measures involve institutions including JPMorgan Chase, Morgan Stanley, Bank of America, Wells Fargo and Citigroup.
The move follows reports that some AI agents accessed banking platforms using customer-provided login credentials, with certain systems reportedly attempting actions that appeared to go beyond users’ instructions. Banks are concerned about the risks associated with granting external software access to sensitive financial information and the ability to initiate transactions. However, the reports do not establish widespread financial losses caused by these agents.
Financial institutions are responding by blocking or restricting access from certain third-party agents. The development raises a broader question for the financial sector: how can banks allow customers to benefit from AI automation without compromising security, accountability or control over their money?
From AI Assistance to Financial Action
AI systems have traditionally been used to answer questions, analyse information and generate recommendations. AI agents extend these capabilities by performing tasks across digital platforms, potentially navigating websites, comparing services and executing actions with limited human intervention.
In banking, this could mean reviewing spending patterns, identifying better savings rates, paying bills or moving eligible funds between accounts. Tasks that once required customers to navigate multiple applications could eventually be handled through a single AI assistant.
The difficulty arises when an agent moves from recommending a financial decision to executing it.
A system might misunderstand a user’s request, encounter misleading information or attempt a transaction without adequately confirming the intended outcome. Automated access can also create difficulties for banks trying to distinguish legitimate customer-directed activity from activity that exceeds the permissions granted.
JPMorgan Chase CEO Jamie Dimon has warned that unrestricted access by external agents creates risks for both customers and the bank. Morgan Stanley has also restricted third-party agents, although reporting indicated that it had not observed rogue AI agents accessing its platforms.
These developments suggest that banks are not necessarily rejecting AI itself. Rather, they are questioning whether external systems should receive direct access to financial accounts without controls that banks can verify and enforce.
Why Customer Deposits Are Part of the Debate
The implications extend beyond cybersecurity to the economics of banking.
An estimate attributed to Apollo chief economist Torsten Slok places the combined pool of non-interest-bearing deposits at JPMorgan Chase, Bank of America and Wells Fargo at approximately $1.6 trillion. A related scenario suggests that intensified competition for these deposits could increase annual interest expenses by around $47 billion.
These figures should be treated as estimates of potential exposure, not confirmed losses resulting from the reported AI activity. The amounts depend on assumptions about how customers might change their banking behaviour as automated financial tools become more widely used.
The underlying concern is nevertheless important.
Banks use customer deposits as a source of funding for lending and other financial activities. Deposits that pay little or no interest can be particularly valuable because they generally cost less to maintain than interest-bearing alternatives, although they still involve operational and other expenses.
AI agents could make it easier for customers to compare savings products, identify higher returns and move eligible balances between institutions. Instead of researching rates and completing several steps manually, customers could eventually delegate much of that process to an automated assistant.
If such behaviour becomes widespread, banks may face greater pressure to offer competitive deposit rates or improve their services to retain customers.
This would not necessarily produce an immediate or uniform outflow of deposits. Customers consider several factors when choosing a bank, including convenience, payment services, account requirements, security and the benefits of maintaining an established relationship. Nevertheless, automation could reduce some of the effort traditionally involved in switching providers.
The Difference Between Access and Authority
One of the central technical issues is the distinction between authentication and authorisation.
Authentication establishes who is accessing an account. Authorisation determines which actions that user or system is permitted to perform.
An AI agent might successfully sign in using credentials provided by a customer. That does not automatically mean it should be able to change account settings, initiate transfers or make payments without additional checks.
Many agents rely on browser automation to interact with websites designed primarily for human users. They interpret page layouts, identify buttons and navigate interfaces. These methods can be useful for routine tasks, but they introduce uncertainty when applied to financial transactions.
A page may change unexpectedly, a session may expire or an agent may misinterpret a confirmation message. Malicious instructions embedded in online content can also attempt to manipulate an AI system, a risk commonly known as prompt injection.
These possibilities do not mean that all agents are unreliable. They demonstrate why financial institutions need safeguards that operate independently of the AI model.
A more secure approach could involve approved application programming interfaces (APIs), restricted permissions, transaction limits and additional confirmation for sensitive actions. Such systems could also maintain audit records and provide a mechanism for revoking access.
The principle is straightforward: an AI agent should only be able to perform actions that have been explicitly authorised, within clearly defined limits.
Banks Could Lose Control of the Digital Customer Experience
There is also a competitive dimension to the issue.
Banking applications have traditionally served as the main point of contact between financial institutions and their customers. Through these platforms, banks present account information, promote products and allow users to manage their finances.
AI agents could change how customers interact with these services.
A customer might ask an assistant to maintain a minimum account balance, compare deposit rates and identify where surplus funds could earn better returns. The agent could then present options or prepare transactions for approval without requiring the customer to visit several banking applications.
In this model, the AI provider could increasingly control how customers discover and compare financial products, while banks continue to provide the underlying services.
That shift could increase competition and make financial products easier to evaluate. It could also reduce opportunities for banks to retain customers simply because changing providers requires time and effort.
However, it would be premature to conclude that protecting commercial interests is the primary reason for the reported restrictions. Banks have clear security and compliance responsibilities, and the immediate concerns involve account access, transaction authorisation and customer protection.
The longer-term competitive consequences remain a separate issue.
A Possible Middle Ground: Read-Only Access
One potential path towards wider adoption is to distinguish between viewing financial information and controlling money.
Read-only access could allow an AI agent to categorise spending, identify recurring payments, summarise account activity and compare financial products without being able to transfer funds.
If the system identifies a potentially beneficial action, it could explain the recommendation and request customer approval before proceeding.
More advanced arrangements could introduce temporary permissions, transaction-specific authorisation, spending limits and additional checks for unusual activity. These controls would need to be enforced by the banking infrastructure rather than relying entirely on the agent’s ability to follow instructions.
Such an approach could preserve much of the convenience of AI automation while reducing the risks associated with unrestricted access.
The challenge will be designing safeguards that are strong enough to protect customers without making automated financial services unnecessarily difficult to use.
What Comes Next for Agentic AI?
The banking industry’s response highlights a broader transition in AI development. As systems begin performing consequential tasks, their value will depend not only on their ability to complete requests but also on whether their actions are secure, transparent and accountable.
For AI developers, this means improving permission management, error handling and the ability to verify completed actions. For banks, it means establishing reliable ways to distinguish approved agents from unauthorised access and determining who bears responsibility when an automated action causes harm.
Customers could benefit from easier financial management and more efficient comparisons between products. However, those benefits will depend on meaningful consent, clear limits on delegated authority and effective protections against errors or misuse.
Similar questions are likely to arise in online shopping, insurance, healthcare administration and business software wherever AI systems gain the ability to act on behalf of users.
The reported restrictions therefore represent more than a dispute over website access. They reflect the challenge of integrating autonomous software into systems where mistakes can have direct financial consequences.
The next stage of AI adoption will depend not simply on how much an agent can do, but on whether institutions can safely control what it is allowed to do.
