Ask NostroAskSubscribe

Five largest US banks are blocking external AI agents, American Banker reports

For the general counsel at a regional bank

Five of the largest U.S. banks (JPMorganChase, Citi, Bank of America, Wells Fargo and Morgan Stanley) are blocking external AI agents from reaching customer accounts, American Banker reported on Oct. 27.21

Financial executives cited account security, customers handing bank passwords to third-party software, and unclear liability if an agent makes an error or an unauthorized transfer, according to American Banker.2 JPMorganChase CEO Jamie Dimon said on the Oct. 13 earnings call that the bank is "not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan."2

Wells Fargo's online access agreement says that if customers give an AI agent their login credentials or authorize it to act for them, the agent's instructions are "deemed to have been initiated and authorized directly by you," with no bank obligation to investigate the scope of that authority; a Wells Fargo spokeswoman confirmed the bank has taken steps to block unauthorized agents.2

JPMorganChase's digital services agreement says customers who let AI agents access their accounts "assume the entire risk for the fraudulent, unauthorized or otherwise improper use of your login credentials," according to American Banker. Morgan Stanley and Bank of America did not respond to requests for comment, and Citi declined to comment.2

The blocks are incomplete: Matt Thompson, CEO of Transmit Security, said banks block agents that self-identify but all recognize others are getting through. Transmit Security co-founder Mickey Boodaei said agents mimic human typing and clicking and can use proxies to get around IP-based blocks.21

One large bank that was not named adopted a blanket block after its fraud team saw an agent reset a password, change approved transfer destinations and move $100,000 out of an account; a source shared this with American Banker on condition of anonymity, and it could not be independently verified.12

Why it matters

Blocking alone will not stop agents that disguise themselves, so for now a bank's account terms largely decide who bears the loss when an agent acts. Whether a customer "authorized" a given action is the question a dispute is likely to turn on, and no agreed standard yet defines it.

From the brief

Our take. Wells Fargo's contract says an authorized agent's instructions are the customer's; one unnamed bank reportedly watched an agent reset a password and move $100,000. If your online terms say nothing about agents, a dispute will write that clause for you.

Action. Legal and compliance: Add AI-agent authorization and liability language to online-access agreements, stating who bears losses when customers give agents their credentials.

What our records say

Wells Fargo's AI strategy rests on three choices made since 2021: a deep relationship with Google Cloud (alongside Microsoft Azure) powering both the Fargo consumer assistant and the enterprise agent rollout; a model- and cloud-agnostic platform so newer models can be swapped in; and, since November 2025, a single accountable executive, Saul Van Beurden, named head of AI while co-running consumer banking.1

  1. Wells Fargo: AI programme summary (part 1)

From our records

Sources

  1. ReportFive largest US banks are blocking external AI agents,… | Pivot News Pivotnews
  2. Also reported byBanks are blocking external AI agents. Is this sustainable? American Banker