JPMorgan, Citi, Bank of America and Schwab restrict outside AI agents. None yet lets them move customer money, while the federal rule defining who may act for a customer remains stayed.
Banks' contracts currently decide how AI agents can access customers' money. Payments remain the dividing line. Outside agents may read balances through approved connectors, but they may not move money.
JPMorgan drew that line in public on 13 October. Chief executive Jamie Dimon told analysts the bank is "not going to allow just any outside agents to come in inside the company, because it's just too risky for clients and for JPMorgan." Nine days later, two people familiar said other large banks are blocking agents too.
Anyone building an AI assistant that accesses a bank balance currently needs the bank's permission rather than a regulator's. JPMorgan gives no timeline for letting agents move money.
What banks allow AI agents to do
JPMorgan permits data sharing while barring payments. A spokeswoman said the bank supports "secure, customer-authorized data sharing through open banking providers." The same coverage says agents can read some Chase data, such as balances, but cannot send money or pay a bill.
Banks block agents that log in with the customer's own password. Axios reports that this goes against most banks' guidelines. They require humans to log in to their own accounts.
JPMorgan is blunt about services that move money by credential sharing. Finance chief Jeremy Barnum said the bank has "a long record of being against that way of doing things, screen scraping, et cetera." If a customer hands over a password and the agent misbehaves, "that's going to be on them."
Other banks draw the same line. The FT reported on 16 October that Citi does not let third party agents log into a customer's account or transact directly. Customers may still allow read only access through certain open banking providers.
Bank of America is restricting agents' access to consumer deposits, its chief executive Brian Moynihan suggested. The bank is working out who is liable for payments an AI authorises. He wants "a human in the loop to authorise money moving out of your account." Regulators have privately welcomed the bank blocks, the FT added.
Schwab does not want clients giving Meta's Muse a password. Chief executive Rick Wurster said so in an interview. His reason: "we can't control it, the client can't control it, something could go wrong and who's liable?"
Schwab will let outside AI see balances but not move money. It counts blocked agents "in the tens and twenties" a week. It will build its own secure connections for outside AI models. "We're not going to allow them to move money," Wurster said, but they may see balances and do research.
Passwords, rogue agents and liability
Banks are rewriting their terms of service. Axios says the difficulty of telling a human from a bot is forcing them to block agents and rewrite the terms. It reported on 22 October that some banks tracked agent activity that appeared independent of user instructions, people familiar said. One bank executive said the bank cannot always tell an authorised agent from a rogue one.
Most banks have authorised, or are moving towards, read only access, Axios added. Morgan Stanley has begun blocking third party agents, sources said. A spokesperson said it has not observed instances of "rogue AI agents accessing our platforms." Axios also lists Wells Fargo among banks racing to contain agent risk.
A shared password also limits what a bank can call fraud. A person in the banking industry said banks typically flag and block such transactions. But they cannot be deemed unauthorized if the customer shared the credentials.
The open banking rule remains on hold
No federal rule fills the gap. The Consumer Financial Protection Bureau issued its Personal Financial Data Rights rule on 22 October 2024. It took effect on 17 January 2025. A Kentucky federal court stayed its compliance dates on 29 October 2025, 358 days ago.
The bureau has proposed no rule since its first step. Its advance notice of rulemaking of 22 August 2025 asked who may be a "representative" making a request for the consumer. It also asked whether banks may charge fees. The CFPB said it would propose extending the compliance dates. That was 426 days ago, and the Federal Register shows no proposed rule since.
The bureau is reconsidering the rule, the bank challengers' 28 July filing in the Sixth Circuit says, "with a view to substantially revising it."
Until the bureau acts, each bank answers "who may act for a customer" in its own terms of service.
JPMorgan was already preparing to charge data middlemen. A July 2025 memo counted 1.89 billion data requests from them in June. Only 13% were initiated by a customer for transactions.
Dimon also told analysts that regulators should think about bots and agents. "It's a new world," he said, and "if I was a regulator, I'd try to be prepared for that."
Read only data still flows. Plaid says Meta's Muse connects accounts through it to share balances, transactions and holdings. Schwab still bars payments.
Schwab wants clients to use its own assistant, Charley, which it launched last month. JPMorgan's finance chief said of agents that the bank is "working on being able to do this correctly."
Fraud prevention explains much of the restriction: customers share passwords, creating liability risks. The restrictions also prevent agents from moving deposits.
Why payment access matters for deposits
Deposits are the financial stake for banks. Apollo's Torsten Slok warned that assistants could sweep household cash into accounts paying 3.3 to 5 per cent against 0.1 per cent on checking. The FT calculated the cost at 3%. The $1.6tn of deposits that pay no interest at JPMorgan, Bank of America and Wells Fargo would cost about $47bn a year. That is almost half their combined annual earnings.
A sweep needs money movement, and read only access cannot do it. JPMorgan plays the threat down. Barnum called agent competition "not new" and said the bank is "focusing on primary bank share."
Fintechs building payment agents currently have one available route: read only data through an approved open banking provider. Banks block password-based agent logins and place responsibility for shared credentials on the customer. Payments wait for a bank built channel. The open question is who is liable when an agent initiated payment goes wrong.
The next tests are JPMorgan's BancAnalysts conference appearance on 5 November and its fourth quarter call on 14 January 2027. Four analysts raised agents on 13 October. Unless a bank run channel for moving money appears by then, outside agents will remain limited to that one route through the January call.