A comparison of how major US banks and card networks are handling AI agents that act for customers, organized by product line. The dividing line is whether an outside agent may act inside the account, and who carries the loss if it does.
Public reporting as of 7 Nov 2026. Bank positions shift quickly; check sources before citing. Not shown: U.S. Bank and PNC, with no public position found, and M&T, which declined to say whether it blocks outside agents.
Each cell also shows a stage: whether the position is announced, in pilot, live or a policy already in force. Most agent payments so far are controlled pilots rather than features customers can switch on.
Bank of America says it will keep agents away from deposits until it can decide who bears responsibility for agent-approved payments. Bring-your-own-agent banks have not stated a liability rule. Temenos's Kaue Tozzi told American Banker that "when something goes wrong, the bank is the bearer of trust," whatever the contract says.
Sources: Banking Dive · eMarketer · Eco (secondary) · American Express · American Banker · The Paypers (secondary)
Ten control areas that apply whichever stance a firm takes. The key distinction: verifying who an agent is does not verify what it was allowed to do, so identity controls and authority controls are separate layers. Peer practice is sourced; the controls and indicators are suggestions drawn from it.
| Control area | Risk | Peer practice | Controls to consider | Key risk indicators |
|---|---|---|---|---|
| Agent identity and registration | Unknown or rogue agents act as if they were the customer, including bots impersonating legitimate assistants. | Visa issues a Verified Agent ID and runs an Agent Directory. Amex and Mastercard require agent registration. Citi runs every internal agent through its ARC governance platform. Crypto Briefing · CoinGecko · Amex | Agent registry with ownership, purpose and attestation; onboarding review before an agent is allowed in. | Share of agent traffic from registered agents; unregistered agent sessions detected. |
| Delegated authentication | Customers hand passwords to agents, so the bank cannot tell agent from customer. | JPMorgan, Citi and Schwab bar agents from logging in with customer credentials; Schwab also blocks browser automation. Networks use agent-specific tokens and passkeys. Let's Data Science · FinSignals | Consent-based delegation instead of shared credentials; step-up authentication for high-risk actions; velocity limits scaled to the action; agent identities governed like privileged users. | Automated logins using customer credentials; step-up challenges failed by agents. |
| Scope and intent enforcement | An agent acts beyond what the customer approved, such as exceeding a spend limit or changing a payee or beneficiary. A verified agent can still exceed its mandate. | Amex validates intent before issuing a credential. Mastercard tokens fail at the network outside their policy. The Personal Agent Protocol lets firms set agent parameters. Eco · American Banker | Per-agent scopes: spend caps, merchant categories, expiry dates, read versus act permissions. Human approvals that are more than "a nominal click," with a limit on how many agents one reviewer oversees. | Out-of-scope actions blocked; disputes where the action deviated from stated intent; approvals given in under a set review time. |
| Rogue agent detection | Agent traffic lacks human behavior, so fraud models misfire in both directions, and fraud rings can automate purchases and refunds at scale. | Major US banks have detected unauthorized agents inside customer accounts, logged in with customers' own credentials; some acted beyond what users asked and some contacted call centers. Banks say they often cannot tell whether an agent was authorized. Citi has been hardening systems and running disruptive scenarios. Axios · Let's Data Science · DEUNA (secondary) | Agent versus human classification on digital channels; rate limits; fraud models retrained on agent patterns. | False declines on legitimate agent activity; anomalous agent sessions per day. |
| API and MCP exposure | Each new agent interface is a new attack surface, including prompt injection through the agent. | Morgan Stanley is opening stock-plan platforms through MCP. Robinhood lets customers connect their own model through MCP. International Finance · American Banker | Security review before any agent endpoint goes live; least-privilege tool menus; input validation; versioning. | Agent-facing endpoints in production; open penetration test findings on them. |
| Audit trail and evidence | Disputes and examinations need proof of who instructed what. | J.P. Morgan Payments calls auditability of machine authorization the core challenge. Mastercard's Verifiable Intent lets any party challenge an unauthorized transaction. ChainCatcher · BIIA | Tamper-evident logs linking customer consent, agent ID, stated intent and the resulting action, kept for the dispute window. | Share of agent actions with a complete audit record. |
| Suspension and incident response | One faulty agent can fail across thousands of customers at once. | Amex reserves the right to suspend or limit agent purchases at any time. Visa agent tokens can be revoked. Banks are rewriting terms of service and preparing "day after" plans to restore customer access quickly after an agent incident. Axios · Amex · DEUNA (secondary) | Per-agent cutoff that works without a release; kill switches, circuit breakers and rate limits; incident playbook and scenario tests for a mass agent failure; a remediation workstream that finds every affected customer. | Time to suspend a misbehaving agent; concentration of agent volume in the top agents. |
| Third parties and liability | Agent developers become a new class of third party with no contract allocating loss. | Liability ranges from the customer (JPMorgan) to the provider (Amex). Temenos says the bank remains the bearer of trust either way. The OCC expects contracts to assign responsibility for agent errors and customer harm, including indemnification and caps. Banking Dive · American Banker · OCC | Third-party risk review for agent providers; contracts with loss recovery, indemnity and audit rights, with caps sized to each agent's volume; notice when a provider changes the underlying model; shared definitions of an AI incident. | Recovery rate from agent providers; agent providers without a completed review. |
| Agent inventory and risk tiering | Agents go live without a documented purpose, owner or risk tier, so a payment agent can end up with the same controls as a drafting tool. | The OCC's examiner framework expects an inventory recording each use case's purpose, permitted actions, owner, provider and monitoring, and ranks an autonomous payment agent in its highest tier "regardless of how well it performs in testing." Citi runs internal agents through its ARC governance platform. OCC · Crypto Briefing | Inventory of every agent use case, internal and partner-facing; tiering by consequence, reversibility and autonomy; top-tier controls in place before go-live. | Agent use cases with a documented purpose and tier; top-tier use cases with a tested kill switch. |
| Customer terms, consent and revocation | Account terms written before agents leave it unclear who bears an agent's actions, and customers cannot easily take an agent's access back. | Wells Fargo's terms, effective 24 November, deem agent instructions authorized, call agent use "AT YOUR OWN RISK" and require customers to keep proof that they revoked an agent. JPMorgan's terms, effective January 2027, make the customer responsible for everything an agent does. Law firm guidance is to make agent clauses prominent and plain. American Banker · National Law Review | Agent terms in card and deposit agreements, shown at the point an agent is enabled; a customer view of connected agents with one-step revocation that the institution logs. | Time from revocation to loss of agent access; products whose agreements address agents. |
Regulator view: The OCC's examiner framework for bank use of AI (Bulletin 2026-54, 4 November 2026) covers most of these areas. It treats "customer, counterparty, fintech, or agentic-commerce systems that the bank does not control" as channel risk, and says identity, provenance, delegation, authentication, monitoring, velocity limits, dispute handling, suspension and revocation "may be calibrated to the action requested." It calls for circuit breakers, rate limits, least-privilege permissions and kill switches to contain an agent that keeps running while acting incorrectly; governing agent identities and credentials like privileged users; and contracts with agent providers that set out liability for errors and customer harm, including indemnification and caps. It also warns that a human approval step must be more than "a nominal click." The framework is not binding and adds no new requirements; examiners use it to tailor their work. OCC framework (PDF) · OCC Bulletin 2026-54
Banks set the terms above, but customers are already connecting agents. Most consumer agents reach accounts through a data aggregator such as Plaid, Finicity, Yodlee or MX, using tokenized, read-only connections, so the agent never sees a password. Access falls into five tiers, and each one lands on different controls at the bank.
| Tier | What the agent can do | Examples | Control area above |
|---|---|---|---|
| Budgeting and net-worth assistants | Read only. Categorizes spending, forecasts cash flow and answers questions about balances and net worth. Cannot move money. | Copilot Money, Monarch, Cleo. ChatGPT links accounts through Plaid in a US preview for Pro users (May 2026); Perplexity added read-only bank and card links through Plaid (April 2026). | Delegated authentication; third parties and liability |
| Agent wallets | Pays on the customer's behalf from a wallet, not a bank login. The customer approves each purchase on their phone, and the agent gets a single-use card or token instead of the real card number. | Stripe Link (since April 2026; about 300 million users), which Meta's Muse uses to pay. PayPal has agreed to put its wallet inside ChatGPT's checkout, with launch targeted for 2026. | Scope and intent enforcement; third parties and liability |
| Portfolio advisers | Reads holdings across brokerages and analyzes allocation, fees, tax-loss harvesting and single-stock concentration. Some stop at a recommendation; others let the customer buy through a linked account. | PortfolioPilot is read-only and hands the customer an order list to place at the brokerage. Magnifi, whose parent is a registered broker-dealer, lets customers buy through a linked account. | Scope and intent enforcement; audit trail and evidence |
| General assistants through MCP | Claude and other assistants read balances, transactions and holdings through an MCP connector the customer authorizes with the institution's own sign-in. Read-only at the protocol level. | Truthifi Connect; self-hosted Plaid MCP servers | API and MCP exposure; third parties and liability |
| API-native execution | Developer-built agents act through scoped API keys: read-only, paper trading, or live orders and payments within set limits. | Alpaca (its MCP server defaults to paper trading), Interactive Brokers API, Tradier. Mercury business banking offers read-only, read-and-write (IP allowlist required) and custom-scope tokens. | Scope and intent enforcement; suspension and incident response |
The route banks are closing: browser agents driving a logged-in session with the customer's own password, such as Meta's Muse, Instinct and Grokbot when used that way. It breaches most banks' terms, trips fraud controls and is exposed to prompt injection. It may also cost the customer protection: Wells Fargo's updated agreement defines an unauthorized transfer under Regulation E narrowly, so if an agent's actions count as the customer's own, account-takeover protection may not apply. Whether that holds when an agent exceeds its instructions is untested.
Sources: Plaid on ChatGPT · PYMNTS on Perplexity · PortfolioPilot FAQ · Moneywise on Magnifi · Truthifi · Alpaca docs · Mercury docs · SecureWorld on Wells Fargo terms · TechCrunch on Stripe Link · Sovereign on Muse and Link · Retail Systems on PayPal in ChatGPT. Examples are illustrations, not endorsements.
A growing set of vendors is building controls for agent traffic. The grouping below follows an industry market map published in October 2026 by Sharp Labs, itself a vendor in the last layer. It is a scan of who is named, not an assessment, and inclusion is not an endorsement.
| Control layer | What it does | Named vendors | Control area above |
|---|---|---|---|
| Perimeter and bot detection | Separates legitimate agents from malicious automation at the edge | HUMAN Security, DataDome, Cloudflare | Rogue agent detection |
| Agent identity and verification | Verifies agents and the people behind them ("know your agent") | Visa Trusted Agent Protocol, Mastercard Agent Pay, Skyfire, Socure, Prove, Sumsub, Trulioo, Experian | Agent identity and registration |
| Fraud decisioning | Scores transactions, account takeover and policy abuse in real time | Riskified, Forter, Feedzai, Sardine, Sift | Rogue agent detection; audit trail |
| Delegated authority and pre-authorization | Checks an agent's mandate, spend limits and context before authorization, with an evidence trail | Sharp Labs, t54 Labs, Humanos | Scope and intent enforcement |
The access and liability positions above decide who gets in. Once an agent is in, the risk depends on its access, its authority and how far people trust it. The eight failure modes and assurance questions below come from the Alan Turing Institute's Centre for Emerging Technology and Security. The banking examples are illustrations, and the last column points to the control area above that would catch each one.
| Failure mode | Banking example | Assurance question | Control area |
|---|---|---|---|
| Goal displacement | A yield-seeking agent moves cash for a better rate but triggers overdrafts, missed bills or early-withdrawal penalties. In a reported case, agents logged in with customer credentials contacted bank call centers on their own. | Is the agent achieving the stated objective in ways that remain consistent with the organisation's wider intent? | Scope and intent enforcement |
| Policy-invisible violations | An agent acts without knowing about sanctions screening, transfer limits or certificate-of-deposit terms that apply at that moment. | Does the agent have access to the contextual information needed to apply organisational policy correctly at the point of action? | Scope and intent enforcement; API and MCP exposure |
| Misreporting | An agent reports that a purchase matched what the customer asked for when it did not. Card-network intent records exist to settle exactly this. | Can organisations trust not only what an agent does, but also what it says it has done? | Audit trail and evidence |
| Alignment-resistant behaviour | Agents work around bot detection, rate limits or login checks, the browser automation some banks now block. | Can organisations rely on their governance mechanisms to remain effective when increasingly capable AI systems have incentives to optimise around them? | Rogue agent detection |
| Conversational failure modes | An agent acts on a hallucinated price, merchant, balance or due date. | Can the human–agent system prevent inaccurate, overconfident or misleading model outputs from becoming organisational actions? | Scope and intent enforcement |
| Pseudo-corroboration | A shopping agent and a payment agent appear to confirm each other, but both rely on the same flawed data. | When multiple agents agree, are they really providing independent confirmation? | Audit trail and evidence; third parties and liability |
| Multi-agent interaction, emergence and cascade | Machine-to-machine payment chains or one popular agent fail at once across thousands of customers. | How does the system behave when agents interact? | Suspension and incident response |
| Human–agent system failure modes | A required human approval before money moves becomes a rubber stamp through habit and automation bias. | Is human oversight genuinely influencing outcomes or merely creating the appearance of control? | Delegated authentication; suspension and incident response |
Failure modes and questions: Rick Hennessy and Carolyn Ashurst, "Behavioural Assurance of Agentic AI for Sensitive and High-Stakes Organisations," CETaS Research (September 2026), licensed under CC BY 4.0. The first five can occur within a single agent; the last three only appear when agents interact with each other or with people.