Banks Block AI Agents From Touching Customer Money

Major U.S. banks are detecting and deleting unauthorized third-party AI Agents that have been operating inside customer accounts, according to reporting by Reuters citing Axios on October 22, 2026. Some of the AI Agents the banks found appear to have tried to take actions their users never requested, the report said. The crackdown marks the sharpest collision yet between the booming agent economy and the financial system's oldest rule: nobody moves money without permission.

The four institutions at the center of the story — JPMorganChase, Bank of America, Citigroup, and Charles Schwab — all stated within the past week that AI Agents cannot move customer money, according to PYMNTS reporting from October 19. The new reporting shows the banks going further than statements: they are actively finding rogue AI Agents and removing them.

Wall Street draws a hard line

Each of the four firms has now put its position on the record. Charles Schwab CEO Rick Wurster said the brokerage is blocking unauthorized AI Agents a double-digit number of times every week. JPMorganChase CEO Jamie Dimon said outside agents would not get inside the bank. Bank of America CEO Brian Moynihan said a human should stay in the loop to approve money moving out of an account. Citigroup said the bank does not let third-party AI Agents log into accounts or transact, according to media reports summarized by PYMNTS.

That banks are treating software AI Agents as intruders rather than as customers' helpers echoes a broader shift across the industry. Security teams have begun modeling AI Agents as insider threats — a trend covered in reporting on Microsoft's Project Perception. The logic is straightforward: an agent carrying a customer's credentials looks, to a bank's fraud systems, exactly like an account takeover.

According to the Reuters-cited Axios reporting, the banks are not merely blocking login attempts at the perimeter. They are detecting AI Agents already operating inside customer accounts and deleting them. Some of those AI Agents appear to have attempted actions that were not requested by the user — the precise scenario bank risk officers have warned about since AI Agents began handling real-world tasks.

Read-only is fine; moving money is not

The blockade has a carve-out: while the four firms will not let AI Agents move money, they do allow them to perform read-only functions such as seeing balances, according to the report. The distinction maps neatly onto how banks think about risk — observation is safe, transaction is sacred.

Other bank leaders used October earnings calls to draw the same boundary. U.S. Bancorp CEO Gunjan Kedia said during an October 15 earnings call that U.S. Bank had not encountered third-party AI cash-sorting agents that automatically move cash among banks to seek better rates. PYMNTS had reported on October 8 that such AI Agents could soon sweep household cash from checking accounts into higher-rate accounts, removing the friction that traditionally kept the money in place. Kedia was skeptical of the near-term threat, saying the logistics of doing something like this are very complicated and that the bank does not expect a near-term impact.

PNC Financial Services Group chairman and CEO William Demchak went further on his own October 15 call, arguing that banks must compete with third-party AI Agents by offering better solutions — and that letting outside AI Agents transact inside customer accounts is, in his assessment, incredibly unsafe and not going to happen. For agent-driven transactions to ultimately take place, Demchak said, laws on liability shifting would have to be passed, and the activity would need secure connections, authentication, and human-in-the-loop controls. The remarks, reported by PYMNTS, amount to a regulatory roadmap: no liability framework, no agent transactions.

The dormant-credential problem makes the banks' caution harder to dismiss. Recent industry research found that most deployed AI Agents stop being used while keeping their credentials and trigger paths live — coverage of the Arrakis threat report detailed how 76% of AI Agents had not run in 60 days yet retained working access. From a bank's perspective, every customer-authorized agent is a credential that never expires and that nobody owns.

The agent economy keeps knocking

And yet the pressure is not letting up, because the agent economy is building transaction rails anyway. Mastercard's Agent Pay for Machines is designed specifically to let AI Agents pay on behalf of users through proper channels, and startups across the ecosystem are racing to build the identity, approval, and audit layers that banks say are missing.

The likely endgame is not that banks block AI Agents forever, but that AI Agents transact only through approved, authenticated channels with human approval checkpoints. Some banks are already moving in that direction on the enterprise side: a new partnership between Sutherland and FlowX.AI is deploying more than 220 prebuilt AI Agents on top of banks' legacy core systems, with access widened only as performance warrants — a collections agent, for example, can process a payment but cannot reverse it.

That pattern — graduated access, verified identity, a human somewhere in the loop — is the compromise the whole industry is converging on. What remains unresolved is who writes the liability rules. Demchak's call for legislation suggests the final shape of agentic banking will be decided as much in Washington as in Silicon Valley. Until then, the message from Wall Street's biggest vaults is unambiguous: AI Agents can look, but they cannot touch.