The largest US banks have shut AI agents out of customer accounts, and the real reason sits on the balance sheet, not in the technology.
Citigroup and Bank of America have begun restricting third-party AI agents from logging into customer accounts or moving money, according to the Financial Times. JPMorgan Chase and Charles Schwab are doing the same. Citi still allows limited, read-only access through approved open banking providers. Bank of America's Brian Moynihan has said the bank is working out who bears liability when an AI authorizes a payment. Jamie Dimon warned of rogue agents, noting that 'there could be thousands of them.' Regulators have reportedly backed the restrictions in private. Officials believe the law may need to clarify how customers authorize an agent and who pays when a transaction goes wrong. Meanwhile, Visa already has agent-initiated card payments live in the United States.
The Deposit Question Behind the Block
The stated concern is fraud and liability. The financial concern is deposits. An agent told to maximize yield checks rates every night and never forgets. Idle checking balances that have behaved like cheap, sticky funding for decades start to behave like rate-sensitive money. That shifts deposit betas, liquidity assumptions and net interest margin forecasts all at once. Most deposit models were calibrated on human inertia, and agents remove it.
Why Blocking Only Works at the Login Screen
Blocking holds this off, but only at the login screen. Read-only access still lets an agent see the balance and recommend the move, and the customer can approve it with one tap. The card networks are building authorized rails for agent payments. A bank that refuses agent traffic may find that commerce, and the interchange tied to it, routing through issuers that accept it.
The Terms That Matter to the CFO
So the question for the CFO is not whether to allow agents. It is on what terms. That means a standard for verifying an agent's identity, the authority the customer delegated to it, transfer and spending limits, and a liability allocation the bank can defend. These are identity and integration controls, extended from human customers to the software acting for them. Done well, they also give treasury what it lacks today: visibility into which balances agents touch and how fast that money moves.
The blocks are a sensible holding action for the next few quarters. They are not a strategy. Law, network rules or a competitor will settle the liability question first. Deposit and liquidity models should start reflecting agent behavior before that happens, not after.
