RBC, TD, BMO, and JPMorgan Block AI Agents
On October 27, Royal Bank of Canada told clients it would block third-party personal AI agents from online banking and its other authenticated digital properties. An internal memo said letting those agents into banking systems "can create unacceptable customer risk, including acting beyond customer expectations."
By the next day, the rest of Canada's largest banks had said where they stand. TD is blocking all third-party personal agents from direct access to banking information. BMO said it "does not permit AI agents to access our digital properties or execute transactions." CIBC does not support agents opening or accessing accounts, and Scotiabank plans to limit them. Two weeks earlier, Jamie Dimon told JPMorgan's analysts the bank is "not going to allow just any outside agent to come inside the company." Schwab's CEO says his firm is actively blocking unauthorized agents that try to move client money.
If you work in fraud, security or digital banking, you are probably being asked some version of the same question right now. Do we block them too?
Why the banks said no
These are reasonable decisions, made by banks protecting customers with tools that were built for people.
RBC described how a personal agent gets into an account: agents "need access to your online accounts, including financial ones, and may store your passwords to get there." The agent signs in as the customer, with the customer's credentials, and from then on every request looks like the customer. Your fraud stack sees a valid login on a familiar pattern. It has no way to see that software is driving, which software it is, or what the customer actually asked it to do.
So when an agent sends $8,000 to a new payee at 2 a.m., the bank is left with a question it can't answer. Who authorized this? The customer might have. The agent might have misread an instruction. Someone might have taken over the agent. Each of those calls for a different response, and the login record treats them all the same way.
Someone still absorbs the loss
Think about the customer who connected an assistant to pay her utility bills and now sees a transfer she never meant to make. She calls the bank. The bank sees her password, her device and a clean session, so her claim reads like a change of heart. She may be telling the truth, and nothing on file can show it either way.
Shared credentials also blur who carries the loss. As Global News reported, transactions made this way "cannot be deemed unauthorized if credentials were shared by the customer." That protects the bank on paper. It does little for the customer relationship, and it gives the bank no better idea of what really happened.
Blocking avoids that call for now. It also turns away customers who want these tools, and RBC acknowledged the decision may disappoint the clients already using them. A block also only holds while the bank can recognize the agent, and an agent signing in with a real password is built to look human.
What it would take to say yes
Most of these statements leave room for a later answer. TD described its block as a step while it puts safeguards in place. JPMorgan gave no timeline. The open question is what those safeguards need to prove.
Detection can flag a session that looks unusual, but whose agent it is and what that person approved are identity questions, and they need an answer before the agent acts:
- A verified person behind the agent, proofed to NIST IAL2 with a government ID and a live biometric check
- A mandate that person signed, scoped to a specific agent, merchant, action, amount ceiling and time window, so anything outside it is rejected
- A tamper-evident record, created before any dispute, tying that person to that authorization at that moment
That is the model behind x401, the open protocol we built so a service can ask an agent to prove the human behind a request. The customer verifies once and holds a credential in a cloud wallet. When an agent asks to act, the bank checks the credential, its assurance level and its scope. The check runs on a signed credential, and the customer's banking password stays with the customer.
Where this is heading
Card networks grew because banks agreed on rules about who was verified and who paid when something went wrong, and those rules are what let them say yes to merchants they had never met. Agents are likely to follow a similar path. The banks that blocked them this month are asking the right question, and the ones that can answer it with a record will be the first to let agents back in.
If you'd like to see how a bank can verify the person behind an AI agent before it acts, you can book time with our team here.
.jpg)
.jpg)