Big US banks are tightening the account access granted to third-party AI agents. On October 16, 2026, the Financial Times reported that Citigroup had become the latest major US bank to restrict third-party AI agents from accessing customer accounts, with Bank of America and other institutions tightening similar channels. What the banks are closing is not the chat window but the most sensitive door of all: an agent may no longer take a customer's login credentials and move money on their behalf.
What is being closed is logging in and moving money, not checking balances
The line being drawn is clear. JPMorgan Chase chief executive Jamie Dimon said on the bank's third-quarter earnings call on October 13 that outside agents would not be allowed inside the company to operate accounts for clients, because it is too risky for both clients and the bank; he warned in particular that a rogue agent could make the same mistake across thousands of accounts at once. A JPMorgan spokesperson later confirmed that third parties may not obtain a customer's bank login details and sign in for them. Citigroup chief executive Jane Fraser, speaking at the Sibos conference in Miami in late September, took a governance angle: identity verification and authentication have to be nailed down before agents execute transactions, and Citi's own internal agents all run through its ARC governance platform.
The read-only channel, however, has not been blocked. Reading balances and transaction history through customer-authorized open-banking connectors such as Plaid remains allowed. What is prohibited is the next step: signing in with customer credentials, transferring funds and paying bills. In short, banks accept agents as something that can look at the books, not as something that holds the keys.
Banks fear two things: who pays when it goes wrong, and where deposits go
Security and liability are the stated reasons. When a human employee makes an error, it usually affects one account. When a widely used agent misjudges, the same error can land on thousands of accounts simultaneously, and both losses and blame scale with it. Once credentials are handed to a third party, a bank can no longer easily tell which step was the customer's intent and which was the agent acting on its own.
The second concern is about money. The most natural feature of an agent that manages your accounts is moving idle deposits to wherever they earn more. That is good for customers, but for large banks that profit from cheap deposits it means funds can be swept away in bulk by software. The Financial Times reporting pointed at exactly this worry: security, liability and deposit flight, stacked together, led the banks to close the door first and discuss terms later.
The move does not clash with regulators' direction. The Financial Stability Board's financial AI practices, finalized on October 15, call for human approval before high-risk agents act (see FSB's 12 financial AI practices); the banks are in effect applying the same principle at their own front door: prove it is controllable first, then talk about access.
For personal-finance agents, the only road left is authorized, read-only access
The same day offered a useful contrast: Perplexity announced a Plaid integration that lets its assistant do personal-finance analysis on top of read account data — exactly the authorized, read-only route the banks accept. It can look, calculate and remind, but it cannot move your money for you.
For teams building personal-finance agents, the signal is blunt: product designs built on asking users to hand over account passwords, in pursuit of fully automatic money management, no longer get through at the big banks. The shape that can work next is most likely authorized connectors, read-only data, and human confirmation for consequential actions. Whoever gets identity, scope of authorization and audit trails right first earns the right to discuss execution access; the shortcut of collecting credentials directly is closing.
