> ## Content Index
> Fetch the complete content index at: https://vault.up-state.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# This Week in Banking: Decide What a Customer's AI Agent May Do at Your Bank
- URL: https://vault.up-state.ai/decide-what-a-customers-ai-agent-may-do-at-your-bank/
- Published: 2026-10-19T14:49:44.000Z
- Updated: 2026-10-19T14:49:44.000Z
- Author: Ben Nichols
- Tags: Commentary

*Commentary | Upstate AI | October 19, 2026*

JPMorgan Chase and Charles Schwab spelled out a specific boundary around customers' AI agents in October 15 coverage: don't log in with the customer's credentials. [Finextra reported a JPMorgan spokesperson's statement to CNBC](https://www.finextra.com/newsarticle/48585/jpmorgan-chase-blocks-outside-ai-agents-from-directly-accessing-customer-accounts?ref=vault.up-state.ai) that the bank doesn't permit that access. [Schwab CEO Rick Wurster told analysts](https://www.americanbanker.com/news/schwab-blocks-unauthorized-ai-agents-points-clients-to-charley?ref=vault.up-state.ai) that an agent trying to log in for a client isn't safe and won't be allowed.

Neither position amounts to rejecting every outside AI connection. For U.S. community and regional bank leaders, the decision is more precise: what may the customer's agent do, through which connection, and can your vendors enforce that choice?

An assistant comparing products does a different job from one authorized to spend money. In a September 29 speech, [Federal Reserve Governor Christopher J. Waller](https://www.federalreserve.gov/newsevents/speech/waller20260928a.htm) distinguished agent-assisted commerce, where the buyer decides and pays, from delegated commerce, where the agent has authority to shop and pay. An access policy needs that distinction; "allow AI" or "block AI" doesn't tell the team enough.

![Illustration of a secure login](https://storage.ghost.io/c/c5/ce/c5ce462a-7219-48d0-892f-946fcccc5d9e/content/images/2026/10/undraw_fingerprint-login_19qv.svg)

## A login block isn't the whole policy

Chase's statement explicitly supports [secure, customer-authorized data sharing through open banking providers](https://www.finextra.com/newsarticle/48585/jpmorgan-chase-blocks-outside-ai-agents-from-directly-accessing-customer-accounts?ref=vault.up-state.ai). Its objection to credential sharing predates this earnings season: [chief financial officer Jeremy Barnum said the bank is blocking it where it can](https://www.americanbanker.com/news/jpmorgan-warns-of-risks-to-consumers-who-rely-on-ai-agents?ref=vault.up-state.ai). This is a restated boundary, with no new implementation date supplied.

Schwab combines its login restriction with [connections through certain outside large language models for trading, while withholding money movement](https://www.americanbanker.com/news/schwab-blocks-unauthorized-ai-agents-points-clients-to-charley?ref=vault.up-state.ai). Its own assistant, Charley, mainly provides information and synthesis today, with broader actions planned. A proprietary assistant and selective outside access can coexist.

Other banks are exploring how to set those permissions. [American Banker named Bank of America, BBVA, Synchrony and Wells Fargo](https://www.americanbanker.com/payments/news/why-some-banks-are-exploring-bring-your-own-ai-agent?ref=vault.up-state.ai) as participants in the fledgling Personal Agent Protocol. The reported activity is exploration, rather than confirmed live customer transactions.

[Sierra announced the protocol with Meta on October 6](https://sierra.ai/blog/introducing-personal-agent-protocol?ref=vault.up-state.ai). Its proposed design uses OAuth, a standard for authorizing access: customers choose read or write permissions, and companies choose which interfaces to expose. Sierra says anyone can implement it, but its announcement put detailed action limits and payment extensions in the future. That leaves implementation work between an open standard and a usable banking connection.

![Illustration of two parties agreeing](https://storage.ghost.io/c/c5/ce/c5ce462a-7219-48d0-892f-946fcccc5d9e/content/images/2026/10/undraw_handshake-deal_nwk6.svg)

## Ask what your vendors can enforce

Start the vendor conversation with whose agent you're discussing. [FIS's newly available anti-money-laundering investigations agent](https://www.fisglobal.com/about-us/media-room/press-release/2026/fis-aml-investigations-agent-now-commercially-available?ref=vault.up-state.ai) keeps case closure with the analyst, according to its October 15 announcement. [nCino's Mortgage MCP](https://www.ncino.com/news/ncino-releases-mortgage-mcp-connect-ai-agents?ref=vault.up-state.ai), a Model Context Protocol connection between AI agents and mortgage software, operates within lender employees' permissions. Both concern work inside the institution. A depositor bringing an assistant to online banking is a different access decision.

Our recommendation is for the digital banking owner to ask vendors to demonstrate two cases in a test environment: an outside agent presenting customer credentials, and a customer authorizing a read-only data connection. Show the access record, attempt an action outside the permission, then withdraw permission and try again. Ask how the system identifies an agent using otherwise valid credentials; a written prohibition alone doesn't demonstrate detection.

Existing controls may already do the job. If they can demonstrate the intended boundary and revocation, document that result and defer a new purchase. If the vendor can't demonstrate them, don't expand access on the strength of a roadmap. A broad block may also frustrate customers seeking legitimate data sharing, so explain which supported route remains available.

## Record permission without promising away liability

Payments add another question: what did the customer authorize? [American Express's October 13 Intent Intelligence framework](https://www.americanexpress.com/en-us/newsroom/articles/innovation/intent-intelligence-framework-agentic-commerce.html?ref=vault.up-state.ai) describes recording the merchant, budget and other purchase constraints, authenticating the customer, then using that intent to limit a digital payment credential. Amex says the record can support authorization and disputes; integrations are still being developed.

[James Mirfin, Visa's global head of risk and security intelligence solutions](https://www.americanbanker.com/payments/news/visas-james-mirfin-says-e-commerce-risk-is-transferable-to-ai?ref=vault.up-state.ai), argues that multifactor authentication and tokenization can help manage agent risk. But a control that limits spending and a rule that allocates a disputed loss do different jobs.

[Barnum warned that customers could bear responsibility for unwanted agent actions after sharing credentials](https://www.americanbanker.com/news/jpmorgan-warns-of-risks-to-consumers-who-rely-on-ai-agents?ref=vault.up-state.ai). That isn't a ruling on their rights. Regulation E already limits consumer liability for covered unauthorized electronic fund transfers and sets error-resolution duties, as [Wipfli Advisory partner Melissa D. Blaser explains in her July 30 compliance analysis](https://www.wipfli.com/insights/articles/regulation-e-error-resolution-misconceptions-and-common-errors?ref=vault.up-state.ai). An unwanted transaction and a legally unauthorized transfer aren't interchangeable. Have compliance assess the authority actually granted and how the transfer occurred before assigning a loss to the customer.

The emerging proposals address that harder allocation question. [Lead Bank proposes dividing responsibility](https://www.americanbanker.com/news/bankers-grapple-with-liability-when-ai-agents-mess-up?ref=vault.up-state.ai) among the consumer, bank, AI provider and merchant, while [Cross River chief risk and compliance officer Benjamin Melnicki](https://www.crossriver.com/insights/agentic-commerce-needs-rules-consumers-can-trust?ref=vault.up-state.ai) argues for clear disclosures of authority and remedies. These proposals don't replace existing protections.

Before permitting delegated payments, have the payments owner and compliance team reconcile the proposed access with the applicable consumer protections and payment-network terms. We'd want them to recover the customer's instructions, recipient or merchant, spending limit and revocation history. Data access alone doesn't settle payment authority: [Consumer Finance Monitor's June 26 legal analysis](https://www.consumerfinancemonitor.com/2026/06/26/open-banking-regulation-in-2026-federal-regulation-resurfaces-as-states-bring-data-sharing-into-focus/?ref=vault.up-state.ai) distinguishes Section 1033 data-sharing rules from downstream payment obligations. Our recommendation concerns supported connections, not an assumed Section 1033 deadline or right to make payments.

## Find out what customers are trying to do

[M&T chief financial officer Daryl Bible said October 16](https://www.americanbanker.com/news/m-t-says-its-monitoring-impact-of-ai-agents-on-deposits?ref=vault.up-state.ai) that the bank hadn't seen much impact from money moving out through agents and was watching closely. The same report quotes Federal Deposit Insurance Corporation Chair Travis Hill questioning how willing people and businesses will be to delegate money movement. That's reason to monitor customer behavior, not assume a deposit run.

For an initial monthly review, we'd have the deposit team bring the asset-liability committee customer-reported agent use, related service complaints and confirmed agent-access events alongside balance movements. Keep suspected activity separate from confirmed activity. An unusual transfer alone doesn't tell you an agent caused it, and a blocked connection may reveal a service problem before it reveals a lost deposit.

The digital banking owner should draft the paragraph leadership approves: allowed connections, viewing versus transactions, and the credential-login boundary. Payments and compliance should check it against the demonstrated controls and applicable obligations. If permission can't be limited, withdrawn and evidenced, defer expanding it. You can wait for better standards without waiting to understand today's access.

The decision this week isn't which agent to buy. It's what authority you're prepared to recognize when a customer brings one.

*Sources and scope: Upstate AI's AI-assisted editorial review retrieved the linked material and checked the relevant passages and publication dates on October 19\. Sources were published between June 25 and October 16, 2026\. The Federal Reserve page displays September 29 for Waller's speech despite September 28 in its URL. Executive remarks rely on the cited reporting, not independently checked call recordings; vendor capabilities weren't performance-tested. The consumer-transfer discussion concerns U.S. consumer accounts, not business accounts or a blanket rule for every payment type. Applicable Regulation E text and official commentary were checked separately; individual agent disputes remain fact-specific.*

*Additional vendor context:* [*FIS's finance-team suite*](https://www.finextra.com/newsarticle/48568/fis-launches-agentic-ai-suite-for-the-office-of-the-cfo?ref=vault.up-state.ai)*,* [*Q2's developer agenda*](https://www.developer.q2.com/blog/2026-07-31-join-us-at-q2-dev-days-2026?ref=vault.up-state.ai)*,* [*Alkami's discussion of customer agents*](https://www.alkami.com/resources/media/webinars/from-ai-ambition-to-action-strategies-that-deliver-measurable-results/?ref=vault.up-state.ai) *and* [*Jack Henry's security collaboration*](https://ir.jackhenry.com/news-releases/news-release-details/jack-henry-and-google-cloud-expand-collaboration-deliver-ai?ref=vault.up-state.ai) *provide context, but don't specify a retail personal-agent access default.*

*Publisher's interest: Upstate AI advises financial institutions on AI adoption and vendor evaluation and has a commercial interest in that work.*