Banks Are Blocking AI Agents From Customer Accounts to Protect $1.6 Trillion in Zero-Interest Deposits

Four of the largest US financial firms have now said, in one form or another, that outside AI agents are not welcome inside customer accounts. Citigroup and Bank of America restricted access, JPMorgan Chase said it will not let just any agent in, and Charles Schwab says it is blocking unauthorized agents that try to log in for clients.

The stated reasons are security and accountability. The numbers in the same reporting point to a second one: a pool of cheap deposits that a well-built agent could move. This post covers what was said, what the deposit math shows, and what it means if you are building agents that touch money.

What Actually Happened

FStech reported on October 19 that Citigroup and Bank of America have restricted AI agents from accessing customer accounts. Citi said it would not allow "third-party AI agents or assistants to log into a customer's account or transact directly within our digital banking platforms," citing the need to protect accounts and information. Customers can still authorize limited, read-only access to account information through certain open-banking providers.

Bank of America CEO Brian Moynihan confirmed the lender is restricting access while it develops protocols to establish who is liable for payments authorized by an AI. "We strongly believe there should be a human in the loop to authorise money moving out of your account," he told CNBC, per FStech.

The Epoch Times reported that Schwab, which had $13.3 trillion in client assets at the end of the third quarter, is on the same side. "We are blocking unauthorized agents who try to log in on behalf of clients," CEO Rick Wurster told analysts on October 14. Wurster framed the problem as outside agents using a customer's credentials inside Schwab's systems without controls imposed by the brokerage, and not as a problem with AI itself.

JPMorgan CEO Jamie Dimon said on an October 13 earnings call, "You don't want rogue agents, and there could be thousands of them." He added that customers who give third-party agents access to their accounts are making a choice with consequences: "There's a liability transfer."

The Financial Times, as relayed by KuCoin on October 16, reported that Wall Street executives have raised the use of AI agents for financial transactions with the Federal Reserve. FStech adds that the central bank declined to comment, while regulators have privately welcomed the blocks as questions remain over how customers authorize autonomous transactions and who bears responsibility when something goes wrong.

The Deposit Math Under the Security Argument

The security case is real, and we will come to it. The economic case is easier to put a number on.

FStech reports that JPMorgan, Bank of America and Wells Fargo together hold $1.6 trillion in non-interest-bearing deposits, equal to 16% of their liabilities. Paying 3% on those deposits would cost the three banks $47 billion a year, almost half their combined yearly earnings, per the figures cited from a report by Apollo Global Management chief economist Torsten Slok.

Those deposits are cheap funding. A bank lends against them and pays the customer nothing, so any mechanism that moves the money elsewhere shows up directly in the margin.

The Epoch Times describes the mechanism Slok warned about in September: an "agentic bank run," driven not by fear that a bank will fail but by software that constantly looks for better yield. An assistant could compare rates and shift a household's cash from a checking account into a higher-paying one. Apollo noted that some fintech and online accounts offer 3.3% to 5%, against a national average of roughly 0.1% for checking accounts. If moving money becomes nearly frictionless, Slok argued, banks could lose some of the inexpensive deposits they use to fund loans.

KuCoin's summary of the FT report ties the timing to Meta's September launch of its Muse AI personal assistant, which intensified the industry's concern about deposit outflows. FStech says the restrictions follow that launch.

None of the executive quotes we reviewed name deposit economics as a reason for the blocks. The reasons given on the record are security, customer protection and liability. We are noting the deposit exposure because the same reports put the figures next to the decision, and because it explains why the blocks are happening at several banks in the same week.

The Counterargument: Is This Overdone?

Not every bank executive agrees the risk is large. The Epoch Times reports that Wells Fargo CEO Charlie Scharf called the idea of an AI-driven exodus to higher yields "completely overdone" on October 13. "High-rate alternatives exist today. They've existed for a long time," he said. "If you want to move to a high rate, you can just go online and do it yourself in no time. That's not something new."

That is a fair point. A customer who wants 4% on idle cash can already open a high-yield account, and many have not. An agent lowers the effort, but it does not create the option. Whether the effort was the binding constraint is an empirical question that no one has answered yet, and the reporting we reviewed contains no data on deposit movements attributable to agents.

What the blocks do show is that banks would rather test that question on their own terms than on an outside developer's. The cost of being wrong is large and lands on the bank, which is a rational reason to hold the line until protocols exist.

Liability Is the Slower Story

The liability thread will probably matter longer than the deposit thread. Moynihan said Bank of America is developing protocols to establish which party is liable for AI-authorized payments. Dimon told customers they should understand the liability transfer. Regulators, per the FT, believe the law may need to say more about how consumers authorize agents to transact for them.

The Epoch Times adds the legislative context. It reports there is no single federal law that comprehensively assigns liability between an AI developer, the company deploying the system and the user when an autonomous agent causes damage, though existing laws may apply depending on the facts. It also reports that Sens. Josh Hawley and Chris Murphy introduced the bipartisan AI Agent Accountability Act this month, which targets hacking by AI agents and would allow civil and criminal liability for operators who knowingly run an agent that recklessly causes hacking-related damage. That bill concerns hacking rather than payments, so it is adjacent to this story rather than part of it.

We covered the earlier version of this question in our October 1 post on payment authority. The new development is that the largest account holders have answered it in practice, by refusing the login.

What Builders Should Take From It

• Assume credential-sharing logins will be blocked. Citi, JPMorgan and Schwab have each said outside agents logging in as the customer are not allowed. A product that depends on screen-scraping or stored passwords at a major bank has a short shelf life.
• Build for read-only first. Citi still allows limited read-only access through open-banking providers, and Schwab plans to offer controlled access through Model Context Protocol servers where an outside model can retrieve balances or research but cannot move money. Design the product so it is useful with reads and treats writes as a separate, approved capability.
• Put a human approval step on money movement. Moynihan's stated position is that a person should authorize funds leaving an account. If your agent can prepare a transfer and ask for a confirmation, you are aligned with where the largest banks are heading.
• Write down who is liable. Until protocols exist, banks say liability sits with whoever authorized the agent. Your terms, logs and consent flows should make clear what the user approved and when.
• Do not pitch yield-chasing as the headline feature. The deposit figures explain why banks react strongly to agents that move idle cash. A product built around automatic rate-hopping will meet the most resistance.
• Watch the regulators. The FT reports the Fed has been approached and that regulators privately welcome the blocks. Rules on agent authorization, if they come, will set what access is even possible.

The practical read is that access to the banking system is being set by the banks for now, and they have chosen narrow, permissioned doors. Builders who design for that, instead of around it, will spend less time rebuilding when the rules harden.

Developer312 covers the AI business signals builders actually need to act on. Get the weekday briefing at developer312.com.