Banks block AI agents. Open banking has been here before

JPMorganChase, Citi, Bank of America, Wells Fargo and Morgan Stanley are all blocking external AI agents from customer accounts, American Banker reports, and Charles Schwab is blocking Meta's Muse and similar tools. The reasons are familiar by now: customers handing their bank passwords to third-party software, security and fraud risk, and no clear answer on who is liable when an agent gets it wrong. The article asks whether blocking is sustainable. Open banking already knows the answer, because it has been here before.

We've seen this before

Ten years ago, intermediaries were logging into bank accounts with customers' usernames and passwords to scrape their account information for budgeting and personal finance apps. Some banks assumed the automated logins were fraudsters and blocked them. The standoff ended when banks and intermediaries agreed to share data through application programming interfaces (APIs) using proper authentication, so a bank knew who was connecting and what they were allowed to see. American Banker expects history to repeat: agreements on identity, authentication and liability, and then the bans lift.

The same three questions

Jeff McMillan, who until March led firmwide AI at Morgan Stanley, sums up what's missing. There's no agreed way yet for a bank to verify an agent, to know what the customer actually authorized it to do, or to settle who is liable when it goes wrong. Firms want to know who the agent is, what it can do, and, in his words, “who owns it and takes the blame.” None of that is agreed.

In the meantime, banks are answering the liability question on their own terms. Wells Fargo's online access agreement treats anything an agent does with a customer's credentials as authorized directly by the customer, without further checks. That's the liability transfer Jamie Dimon warned about. Customers are uneasy too: in a Morning Consult poll for the American Bankers Association, 77% of US adults said they were concerned about letting an AI agent move money for them, and 19% said an agent had already asked them for login credentials or card details.

Blocking won't hold

Banks know they can't stop every agent. Those that announce themselves can be blocked, but many don't. They run through cloud browsers stripped of identifying information, change devices every time they log in, and quickly learn to mimic a customer's typing and clicking. The tools banks use to verify customers were built to recognize people, not software. Transmit Security's Mickey Boodaei doubts agents will ever declare themselves voluntarily, because staying anonymous gives a smoother customer experience. And as McMillan points out, if banks keep agents out, customers can simply take their agents, and their deposits, to firms that let them in.

Don't repeat the mistakes of the past

The fix for screen scraping worked, but in the US it took years and arrived one agreement at a time, each bank negotiating separately with each intermediary. If AI agents follow the same path, every bank will end up negotiating separately with every agent provider over identity, permissions and liability, and each will reach its own answer. The early proposals are already multiplying: Lead Bank's liability framework, the new Poppy protocol from Meta and Sierra with Bank of America and Wells Fargo as design partners, and industry white papers on authorization and liability. Bank of America says it's developing its own protocols for working out liability, and the same standoff is forming in Canada, where RBC is considering blocking Muse and BMO has warned customers not to give agents their banking details.

This time, the questions can be answered once, for the whole network: which company stands behind an agent, whether that company is accredited, its real-time risk score, and whether it’s covered by warranty should something go wrong. Open banking took its time learning that lesson. Invela is building the Network, so the industry doesn't have to learn it twice.

Invela is the infrastructure layer that makes open finance trustworthy - accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.