US Banks Block Third-Party AI Agents as Open Banking Rule Stalls

Major US financial institutions are actively restricting or blocking third-party AI agents that access customer accounts using usernames and passwords. Reports from Axios and Reuters indicate that banks have detected outside tools operating within customer environments, prompting security concerns and defensive actions.

Credential Sharing and Security Concerns

Banks argue that credential sharing—where users provide their login details to automated tools—poses significant security and liability risks.

• Account Responsibility: Major lenders, including JPMorgan Chase, Bank of America, and Wells Fargo, have clarified that customers who share their login details remain responsible for any resulting activity.
• Autonomous Actions: Reports noted instances where outside agents attempted actions appearing independent of user instructions, heightening institutional caution.
• Risk Framing: Executives, such as JPMorgan CEO Jamie Dimon, have framed the restrictions around risk mitigation and client protection, while critics suggest financial motives regarding low-interest deposits may also play a role.

The Regulatory Vacuum

The defensive measures arrive while a key federal open banking regulation remains stalled in court.

• Section 1033 Stalled: The Consumer Financial Protection Bureau's Section 1033 rule, finalized in late 2024 to phase out insecure screen scraping via a regulated API framework, has been enjoined by a federal court.
• Unregulated Environment: Without active enforcement of the rule or a finalized alternative, no standardized, regulated pathway exists for third-party AI agents to interface with bank accounts.

Emerging Standards and Industry Response

Financial institutions and technology developers are exploring technical frameworks to manage agent access safely.

• Personal Agent Protocol: Institutions such as Bank of America, Wells Fargo, and BBVA have joined the Personal Agent Protocol—an open standard built on OAuth to help agents identify themselves and limit permissions.
• Read-Only Access: Many banks are evaluating or moving toward controlled read-only access, permitting tools to view data without executing financial transactions.

How to Verify

Readers can review official updates directly from financial institutions, monitor the Consumer Financial Protection Bureau's announcements regarding Section 1033 litigation, and consult terms of service agreements, such as Wells Fargo's updated online access policies.