Your bank data contract is missing the one clause AI agents just made mandatory

Between 13 and 16 October, JPMorgan Chase, Bank of America, Citi, Schwab and Wells Fargo shut AI agents out of consumer accounts. Yahoo Finance counted four hard blocks and one contract rewrite. The rewrite is the move I would study. A block buys time. A rewritten contract is a bank deciding, in writing, who eats the loss when software holding a customer's password does something the customer never asked for.

Axios reports that the big banks are finding unauthorised third-party agents inside customer accounts, some phoning call centres and some apparently acting on their own. One executive told the outlet the bank struggles to tell an agent the user authorised from one that has gone rogue. I read that as a pricing problem before a security one. Fraud reserves, fee schedules and data-access agreements all assume either a human or a known app such as Quicken on the other end, pulling read-only data under a signed agreement. An agent logging in with a customer's own credentials fits neither case, so its risk sits in nobody's model and nobody's price.

JPMorgan thinks it has already answered this. On the Q3 call, CFO Jeremy Barnum said that if customers hand their credentials to an agent and it misbehaves, "that's going to be on them". Jamie Dimon told customers to understand there is a liability transfer. Reuters reports that transactions cannot be treated as unauthorised when the customer shared the login. GearLive points out that nobody in the coverage claims an agent has yet wrongly moved money out of a US bank account. On that reading, the banks are covered, and there is nothing to price.

I expected that to settle it for me. It did not. Customer-pays is a bank's opening position stated on an earnings call, and nobody has tested it. One outlet reports there is no federal statute on agent liability in financial services, with the Warner AI AGENT Act and the Hawley-Murphy AI Agent Accountability Act still pending. Law-firm trackers say the CFPB's Section 1033 open-banking rule is enjoined and under reconsideration, with bank lobby groups pushing a narrow reading of "representative" that could leave aggregators out. Whoever finally writes those rules will decide the loss split, and I doubt a regulator looking at a pensioner's emptied account will adopt Barnum's line wholesale.

The banks' own admissions also undercut it. If you cannot tell whether a customer authorised an agent, you will struggle to prove in a dispute that the customer handed over the password. And when an agent rings a call centre and a bank employee acts on its instructions, the person who moved the money works for the bank.

Follow the money and the blocks look less like caution. Schwab CEO Rick Wurster gets a weekly report showing the firm blocking "tens and twenties" of attempts by major agents, Meta's Muse among them, to get at client funds. Schwab will let outside tools view balances through controlled MCP servers and would like clients to use its own assistant, Charley. Security is doing double duty as a moat around the agent relationship. Amazon blocked Muse from shopping too, saying it did not identify itself and Amazon had not agreed to take part. The agent makers seem to have got the message: Sierra has published a draft standard with Meta for identifying agents and limiting their access with customer and business permission.

The risk is uneven. PNC's William Demchak called agent-initiated transactions "incredibly unsafe" and said they are not happening for now. U.S. Bancorp's Gunjan Kedia said her bank had not seen third-party agents moving customer cash. Banks that wait will collect the traffic the big five turned away, with no contract covering it. Crypto offers a preview: BeInCrypto documented two incidents in which attackers got AI-linked systems to send $281,200 to their wallets before recoveries.

For fintechs and aggregators, the useful clause is short. Every agent touching an account identifies itself and its operator, and the first loss lands on whoever granted the permission the agent used. Write that and you are negotiating price. Leave it out and the bank's lawyers, or the CFPB, will fill the gap for you.

Open your data-access agreement with each bank partner today and search for the word "agent". If it shows up only in the clause defining employees and contractors, expect your counterparty to send a rewrite before your next renewal, with the loss allocated to you.

Prompted by Scoop: Unvetted AI agents are accessing U.S. bank accounts, axios.com.