JPMorgan, Citigroup, Bank of America Move to Block Third-Party AI Agents From Customer Accounts
Key Takeaways
- •JPMorgan Chase, Citigroup and Bank of America have moved to block third-party AI agents from accessing customer bank accounts, per an Oct. 25, 2026 COINOTAG report.
- •The restrictions focus autonomous software that logs in with legitimate customer credentials and can move or spend funds without human approval for each individual action.
- •Banks worry that agent-driven sessions undermine security models built on the assumption that a human is behind every login, raising risks of unauthorized transfers, fraud, and liability disputes.
- •The action follows an Oct. 13 warning from JPMorgan CEO Jamie Dimon, who has highlighted cybersecurity threats to the financial system even as he champions AI at the bank.
- •While Visa and Mastercard have announced frameworks allowing verified AI to make payments for users, direct access to customer bank accounts remains a far more sensitive area, and the three banks' technical measures for detecting automated logins are undisclosed.
Some of the largest banks in the United States — JPMorgan Chase (JPM), Citigroup and Bank of America — have tightened their systems to shut third-party artificial intelligence out of customer accounts, according to a report published by COINOTAG on Oct. 25, 2026.
The restrictions are aimed at software that can log in using legitimate customer credentials and then move or spend money without a human approving each individual action, the report said.
Why Banks Are Drawing a Line at AI Agents
AI agents are autonomous software programs capable of carrying out multi-step tasks on a user's behalf — browsing websites, filling in forms and completing transactions with limited or no human intervention. As such tools have moved from experimental projects into mainstream consumer products, banks have faced a new question: what happens when an automated program signs in to an account with a customer's real username and password?
Traditional online-banking security assumes a person is behind every session. When an agent holds valid credentials, it can initiate transfers or payments without the per-action human authorization that lenders have long relied on, raising concerns about unauthorized transactions, fraud and disputes over who is liable when something goes wrong. Sharing credentials with third-party software can also leave customers exposed if the agent or its operator is compromised.
Industry Context
The move by the three banks comes as the financial sector grapples with the rise of so-called agentic AI. Major card networks, including Visa and Mastercard, have announced frameworks intended to let verified AI make payments on behalf of users, while direct access to customer bank accounts has remained a far more sensitive area for lenders.
Per the report's headline, the development follows an Oct. 13 warning from JPMorgan chief executive Jamie Dimon. Dimon, who leads the largest US bank by assets, has repeatedly addressed both the promise and the risks of artificial intelligence — describing the technology as critical to the bank's future in his annual shareholder letters — while also warning about cybersecurity threats facing the financial system.
The report did not specify the technical measures any of the three banks uses to identify and block automated logins, so how each institution distinguishes agent-driven sessions from human ones in practice remains undisclosed — the key detail to watch as these restrictions come into focus.
Source
This article is based on reporting first published by COINOTAG: JPMorgan (JPM) Blocks Third-Party AI Agents From Customer Accounts After Dimon's Oct. 13 Warning. The available source text did not specify the full details of the banks' individual measures.
