US banks block AI agents attempting to move money for customers
As first reported by the Financial Times, Citigroup and Bank of America are limiting AI agents’ ability to access client accounts as lenders raise concerns that automated tools could move deposits in search of better returns.
Citi says it does not permit “third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms”, adding that the policy is designed to help safeguard customer accounts and information. The bank says customers can still authorise limited, read-only access to account data with certain open-banking providers.
Bank of America chief executive Brian Moynihan also indicates the bank is restricting AI agents’ access to consumer deposits while it works on protocols to determine which entity is ultimately liable for payments authorised by artificial intelligence. A person familiar with the matter confirms that BofA has restricted access.
Moynihan tells CNBC that the bank believes a person should authorise money leaving an account. JPMorgan Chase chief executive Jamie Dimon says this week that the bank will also be restrictive about agentic AI tools accessing client accounts because of the risk posed by “rogue agents”.
Sharat Chandra – the founder of EmpowerEdge Ventures commented: “Banks aren’t shutting out AI. They’re shutting out agents they can’t verify. In a few weeks, JPMorgan, Citi and Bank of America have all moved to restrict outside AI agents from customer accounts.“
He continued:
“The banks have three reasons:
1. Deposit flight. Fintechs pay 3.3–5.0% while the average checking account pays 0.1%. People leave that gap alone out of inertia, but an agent doesn’t. The big three banks hold about $1.6 trillion in non-interest-bearing deposits, and paying just 3% on them would cost around $47bn a year.
2. A liability gap. If an agent moves money wrongly, who pays: the customer, the agent, the app or the bank? Nobody has settled this. BofA is limiting access until someone does.
3. Agents as attack vectors. CERT-In’s latest advisory says none of the affected organisations detected the agent access themselves, and attacks went from days to hours. The weaknesses were old ones, like exposed credentials and over-permissive roles.”
Sharat Chandra concluded: “Banks run their own agents, so the objection isn’t to AI. It’s to agents that log in with a customer’s password and move money with no clear owner of the risk.“
