Know Your Agent: Why US Banks Are Blocking AI Agents and What It Means for Agent Architecture
aiarchitectureorchestrationenterprise

Know Your Agent: Why US Banks Are Blocking AI Agents and What It Means for Agent Architecture

Know Your Agent: Why US Banks Are Blocking AI Agents and What It Means for Agent Architecture Charles Schwab blocks unauthorized AI agents a doubledigit number of times every week, and major U.S.

·6 min read·Yano.AI Research

Know Your Agent: Why US Banks Are Blocking AI Agents and What It Means for Agent Architecture

Charles Schwab blocks unauthorized AI agents a double-digit number of times every week, and major U.S. banks are now detecting third-party agents inside customer accounts and removing them (Source: PYMNTS, 2026). Some of those agents held the customer's own login credentials, and still took actions the customer never requested (Source: Axios, 2026). This is not a fraud story with a new disguise. It is an architecture that cannot tell an agent apart from the human in charge of it.

Infographic

The Trust Model Credential Sharing Breaks

Most of the detected access is not a stolen credential. It is a customer who voluntarily gave an assistant their username and password, which then logged in as the customer would have, breaking bank terms that require humans to log in themselves (Source: Axios, 2026).

The real problem is that a password is an unbounded grant: whoever holds it can read balances, call the support line, and move money, and the bank cannot tell which actions the human requested. One bank executive told Axios that the difficulty in distinguishing a human from an unauthorized bot is forcing banks to block the technology and rewrite their terms of service (Source: Axios, 2026). JPMorgan made its position explicit in October, stating that because it is not safe, the bank does not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf (Source: CNBC, 2026).

The Part That Already Works: Read-Only Delegation

Most banks drew the same line: agents may look, agents may not spend. JPMorgan lets agents read customer data in read-only fashion through connectors such as Plaid, but they cannot send money or pay a bill, and there is no timeline for safeguards that would allow direct account interaction (Source: CNBC, 2026). Morgan Stanley has begun blocking third-party agents outright, while JPMorgan, Bank of America and Citi are restricting them (Source: Axios, 2026).

Why Read-Only Is the Architectural Fault Line

Read access is enforceable because it is a scope on a token. A payment is not, because a transfer cannot be un-sent once it clears. Banking leaders frame the gap in liability terms: CEO Jamie Dimon said customers using outside agents should understand there is a liability transfer (Source: CNBC, 2026), and PNC chairman and CEO William Demchak called agent transactions inside customer accounts "incredibly unsafe" until laws on liability shifting, secure connections, authentication and human-in-the-loop exist (Source: PYMNTS, 2026).

Know Your Agent: Five Layers of Verification

The proposed answer extends identity verification to non-human actors. A PYMNTS Intelligence study with Trulioo surveyed 350 compliance, risk and fraud leaders and found that 57.1% of companies with at least $1 billion in annual revenue report incidents or losses involving adversarial bots and agents, against 32.4% for firms in the $50 million to $250 million revenue group (Source: PYMNTS Intelligence, 2026).

The Know Your Agent framework has five layers: verify the person or business behind the agent, define specific permissions, issue agent credentials, monitor continuously, and run behavioral checks. The report recommends checking authority throughout an agent's activity rather than once at connection time (Source: PYMNTS Intelligence, 2026). Over-blocking carries its own cost: firms with at least $1 billion in revenue report an average false-positive rate of 3.3% on digital transactions (Source: PYMNTS Intelligence, 2026).

The Pattern Agent Architects Can Copy

The plumbing for accountable agents already exists. OAuth 2.0 token exchange, specified in RFC 8693, lets an agent request a narrower token for a downstream service while preserving who acted for whom, so the agent never holds live credentials and instead carries a finely scoped access token issued only after the end user triggers the exchange (Source: Ping Identity, 2026). Each hop appends a nested act claim, so a token can show that Agent A is acting for Agent B on behalf of User C (Source: Ping Identity, 2026).

On the Model Context Protocol side, the design converged on one rule: MCP servers act as OAuth resource servers only, and clients obtain tokens from a separate authorization server (Source: Kontext Security, 2026). That separation lets a single policy engine decide what an agent may do across many systems instead of every server becoming its own authorization server (Source: Kontext Security, 2026).

The Stakes Are Not Theoretical

About $7.12 trillion sits in U.S. consumer and business checking accounts, and JPMorgan, Bank of America and Wells Fargo hold roughly $1.6 trillion in deposits that pay no interest (Source: PYMNTS News, 2026). Agents like Meta's Muse, launched September 8 and top of Apple's App Store charts 10 days later, connect to accounts through Plaid (Source: PYMNTS News, 2026). Robinhood says agents use its trading tools almost 30 million times a day (Source: PYMNTS News, 2026).

FAQ

Q: Are banks blocking all AI agents from customer accounts?
A: No. Most permit read-only access through connectors such as Plaid, so an agent can see balances and transactions, while blocking agents from moving money or paying bills (Source: CNBC, 2026).

Q: Is sharing my own bank login with an AI assistant fraud?
A: Generally no. The reported cases describe customers who authorized an assistant and shared credentials voluntarily, which still violates bank guidelines requiring humans to log in themselves (Source: Axios, 2026).

Q: What does a Know Your Agent check actually cover?
A: It extends know-your-customer verification to the agent acting on a user's behalf, checking authority continuously rather than only at connection time (Source: PYMNTS Intelligence, 2026).

Q: What is the fastest fix for an architecture that shares raw credentials with agents?
A: Replace long-lived API keys and shared passwords with short-lived, scoped tokens issued by a separate authorization server, and preserve the delegation chain with RFC 8693 token exchange so agent actions stay attributable to a human request (Source: Kontext Security, 2026).

Key Takeaway

The pattern across banks is consistent: institutions are not rejecting agents, they are rejecting credential sharing. Read-only delegation works today, write access requires a token model that can prove who authorized the action, and both halves of that plumbing already exist in standards rather than vendor roadmaps. If your architecture hands an assistant a person's password, the first audit finding will be the same one Morgan Stanley, JPMorgan, Bank of America and Citi already acted on this month. What would it take to move the first agent in your stack from shared credentials to scoped, attributable tokens?

Sources

Sources — external references open in a new tab.