By October 28, Canada’s five largest banks had moved to keep personal AI agents out of their customers’ accounts, or at least limit what they can do. TD said it would “block all third-party personal AI agents from direct access to banking information.” RBC, BMO, and CIBC took similar positions. Scotiabank said it would limit access. The decisions came less than a week after Axios reported that several of the largest U.S. banks had found unvetted AI agents operating inside customer accounts.

In the United States, Morgan Stanley had begun blocking third-party agents, while JPMorgan Chase, Bank of America, and Citi were restricting them. However, the report’s most alarming claim, that some agents acted beyond their users’ instructions, came from unnamed sources and has not been independently confirmed. Morgan Stanley itself said it had not observed “rogue AI agents accessing our platforms.”

AI agents are programs that carry out tasks for a person, such as booking travel or making payments. In May, Robinhood opened accounts where an AI agent can trade on a customer’s behalf. In September, Meta launched Muse, a personal agent that can connect to accounts at 12,000 financial institutions through the data network Plaid. Meta’s chief AI officer, Alexandr Wang, said at the launch that users choose which accounts to connect, can revoke access at any time, and must approve any action the agent proposes. Muse passed 10 million U.S. downloads in its first 40 days, according to Sensor Tower, nearly three times the 3.7 million ChatGPT reached over the same period.

Much of the problem comes down to passwords. Some customers connect an agent by giving it their username and password, so the agent logs in as if it were the account holder. Even with the customer’s consent, that usually breaks the bank’s terms, which require customers to log in themselves. Once an agent is inside, the bank cannot reliably tell whether it is dealing with a person, an agent the customer approved, or one acting on its own. In Canada, the office of Evan Solomon, the minister of AI and digital innovation, said that Canadians “should be extremely cautious about sharing their banking passwords with anyone.”

On JPMorgan’s third-quarter earnings call on October 13, Chairman and Chief Executive Jamie Dimon told analysts the bank would not let just any outside agent inside, warning of rogue agents. Three days later, Charles Schwab Chief Executive Rick Wurster described the problem on Bloomberg Television: “We can’t control it, the client can’t control it, something could go wrong and who’s liable?”

The industry has yet to settle how agents should get into customer accounts, or who is responsible when one makes a mistake. Banks, payment networks, and regulators are each working on part of it.

Account access

Several banks are steering agents toward approved ways in. “We support secure, customer-authorized data sharing through open banking providers,” a JPMorgan spokesperson told Fortune. Open banking lets customers share their bank data with other apps through secure connections instead of passwords. Citi already allows limited read-only access through approved providers of this kind, meaning an agent can see balances and transactions without being able to move money.

Schwab plans to let a client’s chosen AI tool connect through links that Schwab controls. These use the Model Context Protocol (MCP), an open standard that lets an AI tool plug into another company’s software under that company’s rules and sign-in controls. Through them, outside agents will be able to check balances and do research. Moving money will stay off limits.

Morgan Stanley is opening a different channel. Its ShareWorks and Equity Edge platforms run employee stock plans for nearly half of S&P 500 companies. The bank plans to let the corporate clients that use them connect their own AI agents, with all 3,400 clients due to have access next year. Mark Mitchell, chief product officer of Morgan Stanley at Work, told CNBC that those clients will eventually stop logging into the platforms at all. Instead of staff signing in to the websites, the companies’ own AI agents would pull the data and insights they need directly.

Agent identity

Credit card issuers are also building ways to identify agents. Visa and Mastercard each launched systems in 2025 that give agents their own payment credentials, so a merchant can confirm that a request comes from a registered agent rather than an unknown bot. On September 10, Visa, Mastercard, and Ant International agreed to work toward a shared “Know Your Agent” framework. It would link every agent to a validated operator, certify it against common security requirements, and keep monitoring its transactions. The work runs through an industry platform convened by the Monetary Authority of Singapore. In July, the regulator published its own framework for checking and recording an agent’s proposed actions before they are carried out.

Andrew Shikiar, executive director of the FIDO Alliance, one of several groups working on standards for verifying AI agents in finance, set out the questions every bank will have to answer. The most important, he suggested, are “who is it acting on behalf of, and did that person actually delegate this authority to it, and then what is it authorized to do?”

Deposits

Banks also have money at stake. They fund much of their lending with low-interest deposits, which agents could make easier to move. In late September, Apollo chief economist Torsten Slok asked whether agents like Muse could sweep household cash out of checking accounts, which pay 0.1% on average, into accounts paying 3.3% to 5%. On $10,000, that is the difference between earning $10 a year and earning $330 to $500.

Several bankers and analysts expect a slower shift. About two-thirds of U.S. deposits already sit in accounts paying almost nothing, even though moving money to a better-paying account takes minutes. Christoph Stegmeier, a senior partner at the consultancy Simon-Kucher, told American Banker that inertia is the reason. Jeff McMillan, who led firm-wide AI at Morgan Stanley until March, called it “repricing, not a run.” He compared it to 2022 and 2023, when more than $1 trillion moved from bank deposits into money market funds. Banks then paid higher rates only on the deposits most likely to leave. McMillan expects them to respond the same way again.

Agents could also look beyond bank accounts altogether. At FII PRIORITY Miami in March 2026, Galaxy Digital’s Michael Novogratz argued that with large banks paying “broadly zero” on savings, “for the consumer, stablecoins are a much better product.” According to FII Institute’s Digital Assets and Tokenized Finance Impact Report 2026, stablecoins reached $300 billion in circulation and $33 trillion in annual transactions in 2025.

A new rulebook

The banks’ responses look much alike. They block the shared-password route and offer limited access instead, such as read-only data or connections that the bank controls. Payment networks are adding ways to check for whom each agent works, and Singapore’s central bank has proposed safeguards of its own.

This approach has costs. Read-only access limits what an agent can actually do for a customer. Moreover, every bank building its own route risks a patchwork that agents and customers must navigate one institution at a time. Speaking on her own behalf, Rhea Rajwani, who leads AI and emerging banking solutions risk at M&T Bank, listed gaps in interoperability, authentication, and liability rules among the hurdles to wider use.

Customers may not be ready to hand over full control yet. “Giving an agent standing authority to move your money on its own is a much bigger step, and nobody has done it at scale,” McMillan told American Banker.

Although the U.S. federal open banking rule meant to set standards for this kind of access was first proposed in 2023, it is still on hold in court while the Consumer Financial Protection Bureau conducts a rewrite. Until that rule is settled, each bank will decide for itself which agents get in. Customers who then hand an agent their password will, as Dimon warned, be taking the risk on themselves.