Banks are blocking AI agents, while the rules for letting them in remain stuck

Major US banks are restricting AI agents that enter customer accounts using a person’s login details, while a federal rule intended to move banking away from that practice remains tied up in court. For customers and agent makers, the result is a patchwork: access can be blocked, limited to viewing, or governed by terms that put responsibility for unintended actions on the customer.

Watch Desk analysis

What happened

AI News reports that banks including JPMorgan Chase, Morgan Stanley and Charles Schwab are blocking at least some third-party agents that use customers’ credentials. The article says banks have raised concerns about agents acting beyond a customer’s instructions. It also reports that Morgan Stanley had not seen unauthorised or rogue instances, so the concern should not be mistaken for evidence that such activity has already occurred at that bank.

Some access is being treated differently. The report says JPMorgan allows some third-party tools to view account information but not move money or pay bills. Charles Schwab chief executive Rick Wurster has said the brokerage blocks large outside agents, while planning to let outside models check balances and conduct research through its own servers, without moving money.

A crucial date is approaching for Wells Fargo customers: the article says its updated Online Access Agreement takes effect on 24 November. Subject to applicable law, it says transactions made by an agent given a customer’s login or authority may be treated as the customer’s own, without further verification. Customers may be responsible for unintended actions or actions beyond the authority they gave, and Wells Fargo may restrict agent access.

Why it matters

The Consumer Financial Protection Bureau’s Section 1033 rule was intended to establish a developer-interface route for authorised third parties to access customer data, rather than relying on screen scraping with customers’ passwords. But the article says a federal court has enjoined the Bureau from enforcing the rule and that, as of August 2026, a revised proposal had not been published. That leaves agent builders facing bank-by-bank restrictions rather than one settled path.

There is also an attempt to establish common ground. The report says Bank of America, BBVA, Synchrony and Wells Fargo have joined the Personal Agent Protocol, an open standard intended to let agents identify themselves and limit access to what a customer authorises. A standard could make the choice between read-only and write access clearer. It is not, on its own, proof that banks will grant access or that every agent will follow the rules.

Our read

The useful distinction is not simply “banks versus AI”. It is whether an agent can identify itself, what it can do, and who carries the consequences when it gets that wrong. Blocking credential-sharing may reduce one route into accounts, but it also leaves customers and developers navigating a thicket of individual policies. Read-only access is a meaningful limit on payments, not a magic cloak for sensitive financial data.

If you use an agent with a bank account, do not assume that giving it your login is covered by the same protections as a bank-approved connection. Check the bank’s terms and the specific permissions the agent requests. Password sharing remains a remarkably clumsy way to delegate financial authority.

What to watch

• Whether the CFPB publishes a revised Section 1033 proposal and what access it would require.
• How Wells Fargo’s updated terms are applied from 24 November.
• Whether Personal Agent Protocol members offer customers a clear, revocable choice of permissions.

Discussion spark: Should banks keep AI agents out until a shared access standard is in place, or allow limited read-only access now and let customers decide the risk?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.