Banks Are Blocking AI Agents: What Finance Agents Can Still Do

In the week of October 13, 2026, four of the largest US financial firms said outside AI agents cannot log in to customer accounts and move money. JPMorgan Chase, Citi, Bank of America and Charles Schwab all drew the same line: an agent that signs in with the customer's own username and password is blocked. All four still allow some read-only access through channels they control.

If your business has been testing an agent that logs in to online banking to check balances, pay bills or move cash, this is the week to change that setup. This post covers what each firm said, what still works, and how we would set up a finance agent now.

Sources: we read CNBC's October 13 report on JPMorgan, which quotes a JPMorgan spokeswoman, and PYMNTS's October 19 summary of statements from all four firms, which draws on reports by the Financial Times and Bloomberg. For banks that offer agent access, we read First Internet Bank's MCP page and Mercury's MCP security guide. We read all of them on October 20, 2026. Where a fact comes from a news report rather than the bank itself, we say so.

JPMorgan Chase. On the bank's third-quarter earnings call on October 13, CEO Jamie Dimon said the bank will not let "just any outside agent" operate inside its systems because it is "too risky for clients and for JPMorgan." A spokeswoman told CNBC: "we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." She added that the bank supports customer-authorized data sharing through open banking providers. CNBC reports that this means an agent can read some data, such as balances, through a connector like Plaid, but cannot send money or pay a bill, and that the bank gave no timeline for allowing more. Dimon also said customers who use outside agents "should understand there's a liability transfer."

Charles Schwab. According to Bloomberg, as reported by PYMNTS, CEO Rick Wurster said on October 16 that Schwab blocks big unauthorized agents, including Meta's Muse, "in the tens and 20s" each week. He said Schwab will set up MCP servers so a client's chosen AI model can check balances and do research under Schwab's rules, but those agents will not be allowed to move money.

Bank of America. The Financial Times reported, per PYMNTS, that the bank is limiting agents' access to consumer deposits while it works with agent developers on rules for who is liable for a payment an AI authorizes. CEO Brian Moynihan said a human should stay in the loop to approve money leaving an account.

Citi. The same FT report says Citi does not let third-party agents log in to accounts or transact, and lets certain authorized open banking providers read account information.

Most of these statements talk about consumer and retail customers. They do not say business accounts are treated differently, so check your own bank's online banking agreement before you assume your setup is allowed.

An agent that logs in with your password looks like you to the bank. The bank cannot tell which actions you took and which the agent took, and it cannot limit the agent to some actions and not others. First Internet Bank's beta agreement puts the liability plainly: you are liable for any transactions started by anyone who signs in with your credentials, including a third-party service. Dimon's "liability transfer" points the same way. If an agent you gave your password to sends a bad payment, expect the loss to land on you.

It also breaks easily. Banks are now detecting and blocking these logins, so an automation built on them can stop working with no warning.

1. 1Read-only data through an open banking provider. JPMorgan and Citi both name this route. An aggregator such as Plaid connects with your permission, and your agent reads balances and transactions from the aggregator's data feed.
2. 2Read-only MCP connections the bank runs. First Internet Bank offers a beta MCP connection for business accounts that lets Claude or ChatGPT read balances and posted transactions. It cannot move money or change anything. You sign in on the bank's own page, never share your password with the AI tool, and re-authenticate every 7 days. Schwab says it is building the same kind of read-only connection.
3. 3Payment requests that a person approves at the bank. Mercury's MCP server lets an AI tool create payment and transfer requests, but the tool cannot approve them. A person approves each one inside Mercury, and your approval rules still apply. Mercury also warns that a confirmation in the AI tool is not a substitute for approval in Mercury. Our post on Mercury's MCP approvals covers that setup in detail.
4. 4Card payments with limits. For purchases rather than bank transfers, a separate payment layer can let an agent pay without seeing the real card and only within caps you set. Our post on Agent Vault covers one example.

• Stop giving an agent, browser extension or AI app your online banking password. If you already did, change the password and review the account's recent activity.
• Stop running browser automations that log in to online banking for you. Even when they work today, the bank may block them, and the liability sits with you. Our post on browser agents vs. MCP explains why a structured connection is the better surface.
• Stop letting any agent send money without a person approving it in the bank's own system.

These are designs we would build. None of them describes a client result.

1. 1A daily cash report. A read-only feed, from an open banking provider or the bank's own MCP connection, gives an agent balances and posted transactions each morning. The agent posts a short summary to the owner: cash on hand, large or unusual payments, and bills due this week from the accounting system. It has no write access anywhere.
2. 2Bill payment drafts. The agent matches incoming bills to purchase orders in the accounting system and prepares a payment batch. A person reviews and releases it in the bank, or in a bank like Mercury that holds agent requests for approval. Our post on human approval gates for finance agents lists which steps should always need a named person.
3. 3A reconciliation check. Each week the agent compares bank transactions with the ledger and flags mismatches for the bookkeeper. It suggests fixes and does not post them.

For each of these we would keep a log of what the agent read and proposed, give every connection its own revocable access, and test on a sandbox or a low-balance account first.

If your bank offers no read-only connection and you do not want to pay for an aggregator, a weekly export into your accounting system may be all you need. If you only have a handful of payments a month, preparing them by hand takes minutes and an agent saves little. And if no one has time to review what the agent proposes, the approval step turns into a rubber stamp and stops catching mistakes. Larger standards are still being written, such as the Personal Agent Protocol for how agents sign in to a company on a customer's behalf, and Bank of America says it is still writing its rules with agent developers.

OrchestriAI builds AI agent systems and systems integrations that connect banks, accounting tools and CRMs through official APIs and MCP servers, with approval steps on anything that moves money. We do not build agents that log in with your banking password. If you want to know which finance tasks you can safely hand to an agent with the access your bank offers today, start with the free automation audit.

OrchestriAI is an independent implementation provider. Product and company names are used for identification only. OrchestriAI is not affiliated with, endorsed by, or sponsored by any bank or company named here. This article summarizes public statements and news reports as of October 20, 2026; several of the bank statements reached us through news reports rather than the banks' own pages. Bank policies and account agreements change, so confirm the rules for your own accounts with your bank. This is not legal or financial advice.