US banks are blocking autonomous agents from moving money—for security and for deposits

Citigroup says third-party AI agents may not log into customer accounts or transact directly through its digital banking platforms. Bank of America is also restricting access while it develops protocols for determining who bears responsibility when an agent moves money. Its chief executive, Brian Moynihan, argues that a human should explicitly authorize funds leaving an account. JPMorgan has raised similar concerns about rogue or mistaken agents.

The immediate problem is authorization. Today’s payment systems can usually identify the customer, bank and recipient; an autonomous assistant adds a software provider, model, delegated instruction and possibly several tools. If an agent misreads “optimize my cash,” follows a manipulated webpage or repeats a transfer, it is not obvious whether the customer, bank or agent provider absorbs the loss. A natural-language request is also a poor substitute for a transaction-specific confirmation that displays amount, destination and reversibility.

Banks have a second motive. Agents designed to maximize household returns could continuously move idle cash out of non-interest-bearing accounts paying roughly 0.1 per cent and into products yielding 3 to 5 per cent. What looks to a customer like elementary optimization threatens the cheap deposit funding on which banks earn substantial spreads. At scale, automated comparison and switching could turn deposits from sticky relationships into rapidly repriced inventory.

These incentives complicate the policy response. A bank can invoke safety to exclude outside agents while offering a captive assistant that rarely recommends a competitor. Conversely, forcing open access before authentication, liability and recovery rules exist could let software move money faster than a customer can notice. The useful regulatory distinction is between read access, recommendations, prepared transactions and final execution—not a binary permission for an agent to “access the account.”

The standoff is an early test of whether agents will act as genuine customer representatives or merely as interfaces inside existing financial institutions. Human confirmation is a sensible present boundary. But durable rules will need auditable mandates, narrow spending limits, transaction receipts and a clear allocation of losses—plus competition safeguards so security does not become a permanent veto on tools that help customers escape low returns.