The first promise of the AI assistant was convenience. It would read our messages, compare products, book appointments and handle the repetitive tasks we keep postponing.
The next promise is much more consequential: the assistant should be able to spend our money.
That is where the financial system is beginning to resist.
Within a single week in mid-October, JPMorgan Chase, Citigroup, Bank of America and Charles Schwab all moved to restrict external AI agents from accessing accounts or moving customer money. The restrictions came as Meta's Muse brought the prospect of consumer-facing agents acting across websites into sharper focus. The banks are not rejecting artificial intelligence as such. They are rejecting an uncontrolled intermediary that logs in with the customer's credentials, sees the account and potentially moves funds.
That distinction matters. The argument is no longer whether AI will enter banking. It already has. The argument is who gets to authorize an action, through which infrastructure, and who carries the loss when the agent makes a mistake.
The new customer is an agent
A conventional banking interaction has a relatively clear chain of responsibility:
- The customer logs in.
- The customer sees the payment.
- The customer confirms it.
- The bank authenticates and processes it.
An AI agent breaks that sequence into separate parts. The customer may express an intention hours or days earlier: "Buy this item if the price falls below €100." The agent may then search several merchants, compare delivery times, select a product and initiate a payment without the customer actively looking at the banking interface.
That sounds like a small change in user experience. It is not.
The agent may misunderstand the instruction. A product page may be manipulated. A merchant may present different terms at checkout. An attacker may hijack the agent's context. Or the customer may simply discover that the phrase "buy the cheapest compatible option" was not precise enough.
With a human clicking through a payment flow, responsibility is already complicated. With an autonomous agent, the key question becomes: was the payment authorized by the customer, by the agent, by the merchant, or by the bank's authentication system? We looked at this liability gap in detail in our analysis of agentic commerce's biggest launch month.
Bank of America is limiting AI agents' access to consumer deposits while it works with agent developers on protocols that determine who is liable for payments authorized by AI. CEO Brian Moynihan wants a human to keep approving money that leaves customer accounts.
This is not a technical footnote. It is the foundation of trust in digital payments.
Why Wall Street is blocking the door
Jamie Dimon put the concern bluntly on JPMorgan's third-quarter earnings call on 13 October: "You don't want rogue agents, and there could be thousands of them." He added that customers who let outside agents in should understand the risk and the "liability transfer" that comes with it.
The risk is not only that one assistant makes one wrong payment. The risk is that millions of agents act simultaneously, each with some degree of access, autonomy and imperfect context.
The banks face at least four separate threats:
- Fraud: A compromised agent could make payments or transfer funds at scale.
- Credential abuse: Agents that use a customer's login details blur the boundary between legitimate access and account takeover.
- Unclear authorization: A customer's general instruction may not constitute approval for every specific transaction.
- Deposit flight: Agents could automatically move idle cash to accounts or products offering higher yields.
The last point is especially uncomfortable for banks. Customer deposits are not just balances shown in an app; they are a central source of bank funding. According to The Paypers, JPMorgan, Bank of America and Wells Fargo together hold about $1.6 trillion in non-interest-bearing deposits.
An analysis by Apollo's chief economist warned that AI assistants could sweep household cash from checking accounts paying a national average of 0.1% into accounts paying 3.3% to 5%.
That does not prove that deposit economics are the main reason for the restrictions. Publicly, the banks lead with security, privacy, fraud prevention and liability. But the deposit question is not hidden either. JPMorgan CFO Jeremy Barnum linked personal AI agents to two issues the bank already faces: deposits moving in search of higher yields and fintechs competing on customer experience.
According to the Financial Times, as reported by The Paypers, regulators have privately welcomed the restrictions.
An agent that optimizes the customer's return may also optimize away the bank's cheapest source of liquidity.
Not every form of access is equal
The phrase "banks are blocking AI agents" hides several very different technical models.
An agent could:
- read balances and recent transactions;
- analyze spending patterns;
- search products and prices;
- prepare a payment for review;
- initiate a payment after a customer confirmation;
- log into the banking website using stored credentials;
- move money autonomously between accounts.
These activities do not carry the same risk. A read-only financial overview is very different from an autonomous transfer.
That is why the emerging bank response is not simply "no AI." It is controlled access.
Citigroup does not allow third-party AI agents or assistants to log into customer accounts or transact directly within its digital banking platforms, while customers can still authorize limited read-only access through certain open-banking providers.
Charles Schwab is taking a similar approach. It is blocking unauthorized agents, including Meta's Muse, that try to move client money. CEO Rick Wurster says the big agents are stopped "in the tens and twenties each week." Instead, Schwab plans to set up Model Context Protocol servers through which a client's chosen AI model can check balances and run research under rules Schwab sets, without being able to move money.
JPMorgan draws the same line between data access and money movement. Outside agents can see balances when a customer authorizes a connector such as Plaid, but they cannot act on the customer's behalf or log in with the customer's credentials. What the bank blocks are unapproved screen scraping and credential sharing.
This is the likely architecture of the next phase of agentic banking:
The agent may observe and recommend. The bank decides what it may access. The customer authorizes the consequential action.
Banks are building their own agents
There is another important detail in the banks' response: they are not abandoning the assistant model. They are trying to own the trusted version of it.
Schwab announced its own assistant, Charley, on 30 September, and Wurster expects it to become "the primary way to connect to AI at Schwab." At launch, Charley handles administrative and informational tasks such as changing an address, rather than trading.
JPMorgan is piloting Smart Cash, a tool designed to move client money automatically between checking accounts and higher-yielding brokerage products. The strategic objective is clear: if an assistant is going to interact with the bank, the bank would prefer to control the identity, permissions, logs and security model.
That creates a predictable tension. One industry consultant summed it up for American Banker: "An outside agent works for the client. Charley works for Schwab."
Technology companies want agents that can work across many services. Banks want agents that operate within a controlled environment. Customers want one assistant that can compare options across providers and act in their interest.
Those three goals are not naturally aligned.
An assistant controlled by one bank may be safer for that bank, but less useful to a customer who wants to compare accounts, cards, loans or investment products across the market. An independent assistant may offer better comparison, but it creates a new layer of operational and legal risk.
The future may therefore involve a permissioned middle layer: standardized interfaces through which approved agents can access specific data or request specific actions, while banks retain authentication and transaction control.
That would be very different from handing an agent a username and password.
Europe is testing another route
While American banks are blocking uncontrolled account interaction, Europe is already testing agent-driven payment journeys inside established payment infrastructure.
On 2 July 2026, Worldline, ING and Visa announced a live end-to-end agent-driven payment transaction carried out in Germany. The consumer defined what to buy and when and instructed a merchant AI agent to act within those boundaries. The agent identified a suitable product, the consumer authenticated the purchase intent with Visa Payment Passkey and biometric confirmation, and ING authorized the transaction as the issuing bank.
The full journey ran on Worldline's infrastructure, and Worldline and ING have since joined Visa's Agentic Ready Programme.
The important point is not simply that an AI agent selected a product. Search and recommendation are already familiar uses of AI.
The important point is that the agent participated in the purchase journey without replacing the customer's authorization.
The model looks more like this:
- The customer defines what the agent may do.
- The agent searches and selects within those conditions.
- The customer confirms the purchase intent.
- Strong authentication is performed.
- The bank authorizes the payment.
The companies describe the transaction as a way to demonstrate agentic commerce within existing requirements, including Strong Customer Authentication, while keeping the consumer and merchant in control. ING's head of payments in the Netherlands credited the combination of biometrics and delayed capture, which gives the purchase a flexible authorisation window.
This is not fully autonomous spending. It is a controlled delegation of the shopping process.
The transaction is evidence that the flow can be implemented, not evidence that European consumers can already delegate unrestricted payment authority to general-purpose AI agents.
That distinction may become the dividing line between viable agentic commerce and a regulatory dead end.
Europe's advantage is also its constraint
European payment infrastructure has an important advantage: the region already has established frameworks for regulated third-party access, payment initiation and strong customer authentication.
That gives banks, payment providers and merchants a vocabulary for assigning permissions. It also creates rails on which agentic payments can be tested without giving an AI system unrestricted access to a customer's account.
But existing rules were not designed around an artificial actor that can interpret natural-language instructions, make choices and act over time.
Traditional authentication asks whether the customer authenticated a particular action. Agentic commerce asks a more difficult question:
Did the customer authorize the agent to make this particular decision under these particular circumstances?
A customer might authorize an agent to buy a train ticket under €80, but not a flexible ticket costing €79. They might authorize a recurring purchase, but not a substitute product. They might approve a payment at one merchant, but not at a visually similar phishing site.
The technical payment can be authenticated. The harder problem is proving that the payment remained within the customer's intent.
The next regulatory debate may require something that looks like a "know your agent" framework:
- Which agent is acting?
- Who operates it?
- What permissions does it have?
- How long are those permissions valid?
- What limits apply?
- Which model or service made the decision?
- Can the action be audited afterward?
- Who is liable if the agent exceeds its instructions?
The missing infrastructure is permission
The essential primitive for agentic payments is not simply an API. It is a permission system that can express intent in a way banks and merchants can enforce.
A useful permission might include:
- merchant or merchant category;
- maximum amount;
- currency;
- valid time window;
- delivery location;
- allowed product characteristics;
- number of transactions;
- whether substitutions are permitted;
- whether the agent may complete the transaction without another confirmation.
For consumers, that could mean a simple interface:
"Buy a black indoor basketball shoe, size 44, from a reputable EU retailer, under €120, before Friday. Ask me again before payment."
For a company, the structure would be more formal. A procurement agent might be allowed to purchase software subscriptions under €500, but only from approved vendors and only when a budget owner has granted a valid approval.
This is where payment infrastructure and banking connectivity become decisive. A company should not need to give an autonomous agent unrestricted access to its operating account simply because the agent needs to initiate a purchase. The safer model is a controlled channel with explicit limits, approval policies, auditability and separation between account information and payment execution.
For European businesses, established corporate banking processes, including EBICS-based workflows, can be part of that control layer. EBICS is not automatically an "agent rail," but its concepts of signing rights, authorization and controlled payment submission are closer to the requirements of enterprise agentic commerce than a shared login and a browser session.
The question is not whether an agent can technically send a payment instruction. The question is whether the organization can prove that the instruction was within policy.
The customer could benefit
The debate should not be framed only as banks protecting themselves. Properly designed agents could solve real customer problems.
An agent could:
- identify cheaper alternatives;
- move excess cash according to a customer's rules;
- detect duplicate subscriptions;
- negotiate or compare insurance offers;
- prepare supplier payments;
- monitor invoices;
- alert customers before a payment exceeds normal behavior;
- execute routine purchases without forcing users through repetitive interfaces.
But convenience is only valuable if the customer remains able to understand and control the outcome.
A useful agent should therefore make its decisions legible. Before completing a payment, it should show:
- what it found;
- why it selected the offer;
- which instruction it relied on;
- the total cost, including delivery and fees;
- what will happen next;
- whether the action can be reversed.
The worst version of agentic commerce is an invisible automation layer that quietly converts vague instructions into irreversible financial actions.
The best version is a delegated assistant with narrow permissions, visible reasoning, strong authentication and a reliable audit trail.
The real battle is over the interface
The banks' restrictions reveal a deeper conflict between two versions of the internet.
In the first version, users visit websites and apps. The bank controls the interface, authentication and payment flow. Businesses compete for the user's attention.
In the second version, agents visit services on the user's behalf. The user may never see the merchant's website. The agent compares offers, negotiates actions and requests permission to pay.
That shift threatens more than bank security. It threatens the distribution of power across the digital economy.
If agents choose products, merchants may compete to become machine-readable and machine-preferred. If agents move money automatically, banks may compete on permission quality, execution reliability and policy controls rather than on the attractiveness of their apps.
The customer's primary financial interface may no longer be a banking application. It may be an agent that sits above several banks, cards, merchants and payment providers.
Wall Street is responding by trying to keep that interface inside the bank's perimeter. European payment providers are testing whether the agent can operate across the commerce journey while the customer and issuer retain control.
Neither model has won yet.
What to watch
The next stage will likely not be a sudden world in which agents freely move money. It will be a gradual expansion of permissions.
First, agents will read more data. Then they will prepare actions. Next, they will receive limited transaction authority for narrowly defined use cases: capped amounts, approved merchants, short time windows and explicit customer policies.
Banks will favor authenticated, permissioned connections over screen scraping and shared credentials. Merchants will need to prove that their product information and checkout flows can be interpreted reliably by agents. Payment networks will develop new credentials and authorization models for agent-to-merchant interactions.
Regulators will have to determine whether existing concepts of customer authorization and strong authentication are sufficient when the customer's instruction is separated in time from the final transaction.
The central question is therefore not:
Will banks allow AI agents?
They probably will, under carefully controlled conditions.
The real question is:
Will banks allow independent agents to act in the customer's interest, even when that action moves money away from the bank?
That is the point at which security, liability, competition and deposit economics collide.
America's largest banks are currently saying: not through our front door, not with our customer's password, and not without a clear answer to who pays when the agent gets it wrong.
Europe's early payment pilots suggest a different answer: let the agent participate, but keep the customer's intent, the authentication step and the bank's authorization firmly inside the transaction.
The winning model will be the one that makes delegation safe without making it useless.
This article was researched and drafted with AI assistance. All factual claims are linked to their sources and were reviewed before publication.
