JPMorgan Chase, Citi, Bank of America, Morgan Stanley and Wells Fargo are limiting the access external AI agents have to customer accounts. These restrictions raise a governance question beyond cybersecurity: how can a bank establish what a customer allowed software to do? And who bears the loss if that permission is disputed?
Delegated Payments Complicate Proof of Consent
Consumer AI agents can search for concert tickets or complete purchases with authority granted by a user. For banks, this changes the task of assessing a payment. They must consider both whether the request is genuine and whether the agent stayed within the customer’s instructions.
Justin Herring, a partner at Mayer Brown, warns that distinguishing a malicious request from legitimate customer activity can be technically close to impossible. When an instruction appears to come through the customer rather than through a direct attack on the bank, its origin may remain uncertain.
That leaves two questions for internal controls to address. Did the customer delegate authority to the software? And did that delegation cover the particular transaction? Evidence of the first may help without settling the second.
Julie Hill, dean of the University of Wyoming College of Law, explains that existing protections generally shield consumers from liability for unauthorized transactions. Delegated purchasing complicates that framework because a customer and a bank may disagree about whether the agent’s action was authorized. Hill cautions that a bank’s potential liability rises substantially when it cannot establish authorization.
Access Restrictions Buy Time, but Leave Liability Unresolved
Blocking outside agents gives banks a way to limit exposure while they work through these questions. It also creates a trade-off: tighter access controls may constrain the convenience that makes automated purchasing attractive.
JPMorgan Chase has said customers must understand the potential liability they take on when they give agents permission to act. An explanation can help customers know what to expect, but it doesn’t resolve who will bear responsibility if a dispute arises.
Industry stakeholders draw a distinction between fraud and accelerated deposit withdrawals, with many viewing fraud as the more immediate problem. Their distinction is useful for governance. Transaction authorization calls for evidence about individual instructions; faster outflows call for attention to the effects of automated activity on funding stability. One control framework should not assume those risks are interchangeable.
Where Delegated Authority Can Become Disputed
Consider a hypothetical customer who permits an agent to purchase shoes, then challenges the resulting charge because the purchase differs from what they intended. The bank’s review would need to distinguish among several possibilities:
- The customer never granted the agent purchasing authority.
- Permission existed, but the software acted outside its scope.
- The agent had permission to make the purchase, but the customer was unhappy with the result.
The investigation would need to follow a different path for each possibility. Treating all three as ordinary fraud or assuming blanket customer consent could hide the evidence needed to resolve the complaint.
Oversight Is Moving More Slowly Than Adoption
Industry insiders expect prudential regulators to take up agent-related risks, though they see that as a future step. Herring sees future rules as a way to bring more consistency to decisions about authorization and liability. He points to existing banking oversight, the CFPB and state and federal statutes, while noting that those arrangements do not directly address the present situation.
Regulatory attention has already reached the issue. In late October, Comptroller of the Currency Jonathan Gould expressed confidence in banks’ defenses against malicious AI activity and described government efforts to ensure access to current defensive tools.
Confidence in security, however, leaves the consent question open. A bank may have strong protection against intrusion and still face uncertainty about a purchase made through software the customer deliberately engaged.
Hill also identifies commercial reasons why adoption is unlikely to pause for legislation: banks welcome additional payment activity with less friction, customers value delegated tasks, and merchants want sales. Internal governance therefore needs to develop while the legal position remains unsettled.
Build Controls Around Demonstrable Permission
Hill anticipates that banks will take the initial steps toward documenting customer delegation and confirming an agent’s authority. Possible guardrails include disclosure of agent use and confirmation of particular transactions. These remain potential approaches, rather than established regulatory requirements.
For compliance teams, the priority should be a record of permission that reviewers can examine. Policies should distinguish general access from authority to spend. They should also explain how the bank will assess instructions when those instructions are disputed. They should also link customer communications to the evidence the bank retains.
Where that evidence is unreliable, restrictions may still be appropriate. Where access is permitted, banks should be able to explain how they verified the delegation and evaluated its limits. That gives complaint handlers and control reviewers a concrete basis for decisions while more consistent regulatory standards are still developing.
