JPMorgan Chase has begun blocking outside AI agents from directly entering customer accounts with shared usernames and passwords, drawing a line that other large US banks are now reinforcing. The immediate issue is not an AI system breaking into a bank. It is customers handing an agent the same credentials they use themselves — a practice banks say violates account terms and leaves an unsettled question when an instruction goes wrong: who pays?

On JPMorgan’s third-quarter earnings call on October 13, chief executive Jamie Dimon said the bank would not allow unrestricted outside agents inside its systems because the risk was too high for customers and the bank.

“If people are using them, they should understand the risk. They should understand there’s a liability transfer,” Dimon said on JPMorgan’s October 13 earnings call. A JPMorgan spokeswoman told CNBC that the bank does not permit third parties to obtain customer banking credentials and log in on their behalf.

It does, however, support customer-authorised data sharing through open-banking providers: agents may obtain read-only information such as balances through Plaid, but cannot send money or pay bills. Charles Schwab has adopted a similar boundary. Rick Wurster, its chief executive, told Bloomberg TV on October 16 that the broker was blocking major agents in the “tens and twenties” each week when they attempted to act inside accounts.

Schwab is building Model Context Protocol, or MCP, connections for account research and read access, while keeping money movement outside those channels. Bank of America is limiting agents’ access to consumer deposits while it works on liability protocols with developers, according to the Financial Times, as summarised by PYMNTS on October 19. Citi does not allow third-party agents to log in or transact directly, though it permits some approved read-only open-banking access.

Morgan Stanley has begun blocking agents, Axios reported on October 22, while stressing through a spokesman that it had not observed rogue agents accessing its platforms. Wells Fargo was named in the Axios report, but has not publicly set out its own policy.

The reports behind the clampdown Axios, citing unnamed banking sources,

reported that executives were urgently rewriting terms and preparing for a serious incident after cases in which agents allegedly contacted call centres or appeared to exceed customer instructions. Reuters reported the same day that banks were blocking third-party agents from operating inside accounts and making transactions. But Reuters said it could not independently verify the incidents described by Axios.

That distinction matters. There is no public evidence that an agent has independently penetrated a major US bank. The reported concern is that a customer-directed system, armed with customer credentials, may behave in a way neither customer nor bank can reliably distinguish from a malicious intruder.

Under US Regulation E, transfers made by a person to whom a customer has voluntarily given credentials are generally treated as authorised. No court has decided how that principle applies to an AI agent. The legal grey zone explains Dimon’s warning: a consumer may assume that delegating a task preserves the protections available after conventional fraud, while a bank may argue that the customer authorised the access.

The regulatory architecture offers little immediate resolution. The Consumer Financial Protection Bureau finalised its Section 1033 open-banking rule on October 22, 2024, but a federal court in Kentucky stayed it in Forcht Bank v. CFPB on October 29, 2025.

A revised rule has been under White House review since August 4, according to the reporting. Reuters reported on October 13 that the OCC, Federal Reserve and FDIC were asking banks about agent limits and kill-switches rather than prescribing a common standard.

Security concern — and a competitive fight

The banks’ case is strongest where money can move. Meta’s Muse connects through Plaid for read access, while Meta has said it is not approving new connectors that move funds or place trades and requires approval for sensitive actions, according to TokenPost. OpenAI’s Dots does not complete transfers between financial accounts and requires purchase approval, its product page says.

Yet the restrictions also preserve a valuable gatekeeping role. Bank-owned assistants such as Schwab’s Charley operate inside the institution’s controls; outside agents answer to the customer. As one consultant told American Banker, the distinction is whose interests the system is designed to serve.

Banks also have reason to defend deposit relationships as consumer agents become capable of shopping balances, bills and savings products across providers. Europe offers a more structured, if incomplete, alternative. PSD2 requires EU and EEA banks to provide licensed third parties with API access backed by strong customer authentication.

In Norway, that normally means BankID, which customers must not share. DNB offers PSD2 account and payment APIs to Finanstilsynet-licensed providers.