Banks are drawing a line against personal AI agents. On its third-quarter earnings call, JPMorgan Chase CEO Jamie Dimon said the bank will not let outside agents log in to or act on customer accounts, and the Financial Times now reports that Citi and Bank of America are restricting them as well. For anyone building agents that touch money, this is the clearest signal yet that credential-based access to bank accounts is on its way out.
This post sets out what each bank has said, what comes only from secondary reports, and the part that is analyst theory rather than fact. It builds on our earlier coverage of agent privacy promises around Meta Muse and of AWS payments for agents.
TL;DR: who said what
| Bank | What is reported | Source quality |
|---|---|---|
| JPMorgan Chase | Blocks outside AI agents from logging in to or acting on customer accounts; does not allow third-party agents that obtain customers' banking credentials; still supports customer-authorized data sharing through open banking providers | Dimon on the Q3 call and a spokesperson, via Fortune |
| Citi | Per the FT, does not allow third-party AI agents or assistants to log into customer accounts or trade directly on its digital banking platforms | FT report, relayed by DigitalToday and a FT post on X |
| Bank of America | Per the FT, restricting access to deposits; CEO Brian Moynihan said a person must approve any money leaving an account | Relayed by DigitalToday |
| Stated reason | Security, customer protection, and who is responsible when an agent acts | Banks |
| Deposit-flight theory | Agents could shift money to higher-yield products | Analyst commentary, not a bank statement |
What JPMorgan actually said
According to Fortune, Dimon told analysts on Tuesday that JPMorgan will not allow "just any outside agent" in because it is too risky for clients and the bank, adding: "You don't want rogue agents." He said the bank is "building tools to do that, too," meaning tools to protect customers.
A spokesperson told Fortune that JPMorgan does not allow third-party agents that obtain customers' banking credentials, and that it supports "secure, customer-authorized data sharing through open banking providers." The distinction matters. Reading data through an authorized connector is allowed; an agent holding your username and password and clicking around as you is not.
Fortune also ties the move to Meta's personal agent Muse, launched in September for tasks such as email, travel booking and calendars. Muse's finance features connect accounts through Plaid for balances, transactions and investment holdings, and Plaid says users can share mortgage information as well. Meta declined to say whether Muse can still offer financial help if more banks block agents. DigitalToday, citing CNBC, says JPMorgan's blocks cover agents including Meta's Muse and Instinct; we could not confirm that naming in a bank statement.
What is reported about Citi and Bank of America
The FT reported on Friday, October 16 that Citi is the latest US bank to restrict agents. As summarized by DigitalToday, Citigroup does not allow third-party AI agents or assistants to "log into customer accounts or trade directly" on its digital banking platforms, a measure aimed at protecting customer accounts and information.
A separate write-up by Crypto Briefing points out that Citi has not announced a loud public ban of the kind Dimon described and has stressed internal governance. It cites CEO Jane Fraser at Sibos on September 30, saying autonomous agents need strong identity verification and authentication before executing transactions, for a customer or for the bank. It also cites Citi's internal ARC platform, which Fraser says every internal agent must pass through: "You cannot create an agent without going through ARC." Treat the Citi restriction as FT-reported rather than as a published Citi policy.
For Bank of America, DigitalToday relays that Moynihan said deposit access is limited until there is a process to decide who bears ultimate responsibility for AI-approved payments, and that a person must approve any money leaving an account. Fortune's article does not describe other banks beyond JPMorgan, so BofA and Citi both rest on the FT.
The deposit-flight theory: claimed, not confirmed
Some coverage frames the blocks as protecting cheap deposits. DigitalToday relays Apollo chief economist Torsten Slok warning that assistants could move household money from demand deposits averaging about 0.1% interest to accounts paying 3.3% to 5%. The same report cites a figure of $1.6 trillion in non-interest-bearing deposits across JPMorgan, Bank of America and Wells Fargo, and says paying 3% on that would cost about $47 billion a year. Those are the outlet's and the analyst's numbers, not bank disclosures, and DigitalToday itself notes it relays FT and CNBC reporting.
Nothing in the bank statements above mentions deposit economics. The banks say security and responsibility. Both can be true, but only one is on the record.
Two ways an agent can reach your bank, and why only one survives
It helps to separate the two technical routes, because the banks' wording targets one of them.
Credential access. The user gives the agent a username and password, and the agent signs in like a person: it opens the banking site, clicks through screens, and reads or submits forms. This is what browser-using and computer-use agents do by default. For the bank, it is indistinguishable from an account takeover, because it cannot tell the customer from software acting with the customer's secrets. It also puts the user's full credentials into a third party's memory, logs and prompts.
Authorized data sharing. The customer approves a connection through an open banking provider, and the agent or app receives a scoped token that can only do what was granted, such as reading balances. The bank can see the connection, limit it and revoke it. JPMorgan's spokesperson, as quoted by Fortune, describes this route as supported. It is also how Meta's Muse reaches finance data, through Plaid.
The new policies are aimed at the first route. A bank that blocks credential logins but supports tokens is not banning AI; it is insisting that anything acting on an account be identifiable and revocable. The open question is the middle ground: tokens that can move money. Bank of America's stated rule that a person approves outgoing payments suggests that, for now, action rights will stay with humans even where read rights are granted.
Claimed versus verified
| Claim | Status |
|---|---|
| JPMorgan blocks outside agents that log in or act on accounts | On the record: Dimon on the earnings call and a spokesperson, per Fortune |
| Citi bars third-party agents from logging in or trading | FT-reported; the FT wording is relayed by secondary outlets, and we did not find a standalone Citi policy page |
| Bank of America limits agent access to deposits | FT-reported, with a Moynihan statement relayed second-hand |
| Muse and Instinct are specifically named as blocked | Reported by CNBC via DigitalToday; not seen in a bank statement |
| Banks are doing this to protect cheap deposits | Analyst theory (Slok, via DigitalToday), not stated by any bank |
| Roughly $47 billion a year at stake if 3% were paid on $1.6 trillion | Outlet arithmetic, not a bank disclosure |
To check these yourself, read Fortune's report on the earnings call, look for the FT's original article (it is paywalled, so we relied on how other outlets summarized it), and watch each bank's online-banking terms for language on third-party agents and assistants.
Why security is a real concern
The security worry is not abstract. Credential-sharing agents are a juicy target, and recent incidents show agents being hijacked or misused. Fortune cites a Cloud Security Alliance note describing a campaign in which three open-source AI agents allegedly breached at least 27 organizations and took more than 600,000 credit card records from two of them. We covered a related case in the Papercut breach involving agents, and the question of intent drift in Goodfire's rogue-agent monitors.
There is also the liability angle. Per DigitalToday, JPMorgan says customers are responsible if they hand agents their login details and the agents act in unwanted ways. That is the opposite of how cards work, where fraud protections are built in. Payment players are building rules for this gap, as in American Express's intent framework for agent purchases.
What this means for agent builders
- Stop designing around passwords. An agent that logs in as the user will be blocked, and may violate terms of service. Use sanctioned open-banking or token-based access with scoped permissions.
- Keep money movement behind a human. Moynihan's line, a person approves any money leaving the account, is a sensible default regardless of regulation.
- Log everything. If a bank or regulator asks who authorized a transfer, you need an auditable trail of prompts, tool calls and approvals.
- Expect a patchwork. Read-only data may stay open while action rights are closed. Your product should degrade gracefully to read-only guidance.
- Add a separate guard layer. Whatever the model says it will do, enforce limits outside the model. AgentBeam, the agent security platform from the explainx.ai team, is built to stop AI agents before they take dangerous actions.
What consumers should do
If you use a personal agent, do not paste bank passwords into it. Prefer read-only connectors you can revoke, check what an app is allowed to do before linking an account, and review account activity regularly. If an agent offers to move money for you, treat that as a request for a transfer you must still approve.
What to watch next
- Whether Citi or Bank of America publish formal terms rather than relying on press reports.
- Whether Meta changes Muse's finance features, or how Plaid-style connectors adapt to action rights.
- Whether regulators say who is liable when an authorized agent errs.
- Whether banks build their own sanctioned agent channels, as Dimon's "building tools" comment hints.
Related reading
- Agent privacy promises: Meta Muse, OpenAI and the Verge analysis
- AWS AgentCore payments: agents that pay without private keys
- American Express intent framework for unauthorized agent purchases
- AI agents and the Papercut breach
- Goodfire monitors for rogue agents
Details reflect press reports as of October 17, 2026 and may change as the banks publish formal policies.