Big U.S. Banks Restrict Outside AI Agents as Hong Kong Regulator Floats 'Know Your Agent' Rules

Banks are drawing a hard line on AI agents that act inside customer accounts. U.S. lenders are doing it with access limits and account terms. Hong Kong's central bank is doing it with a discussion paper.

U.S. banks block agents that log in with customer credentials

Schwab CEO Rick Wurster put it plainly on the company's Oct. 14 third-quarter earnings call. "We are blocking unauthorized agents who try to log in on behalf of clients," he told analysts. Schwab reported $13.3 trillion in client assets at the end of the quarter.

Wurster said the concern is not AI itself. It is outside agents using a customer's credentials inside Schwab's systems without controls the brokerage sets.

Schwab's alternative is to let third-party AI models connect through Model Context Protocol (MCP) servers. Under that setup, an outside model could pull account balances or investment research but would be blocked from higher-risk actions like moving money.

JPMorgan CEO Jamie Dimon took the same stance a day earlier, on the bank's Oct. 13 call. "You don't want rogue agents, and there could be thousands of them," he said.

Dimon also put responsibility on customers. "There's a liability transfer. They should understand the liability transfer," he said. A customer who hands an agent account access owns that decision.

Banks say they cannot tell authorized agents from rogue ones

Axios reported that Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and other large banks are finding AI agents inside customer accounts, some apparently taking actions the account holder never asked for. In Axios's account, one bank official called the situation horrifying and another cited grave concerns.

The typical path is simple. A customer gives an AI assistant a username and password so it can manage part of their financial life. That already violates most banks' rules, which require a human to log in. The risk escalates if the customer has also authorized the agent to buy things or move money.

According to Axios, banks have tracked agents calling customer service centers and taking steps that did not come from direct user instructions. One bank executive told the outlet the core problem is that banks struggle to differentiate between agents, and cannot tell whether an agent was authorized by the customer or has gone rogue.

Morgan Stanley disputes part of that picture. A spokesperson denied reports of rogue AI agents accessing its platforms. Axios reported the bank has nonetheless begun blocking third-party agents outright, while JPMorgan, Bank of America and Citi are restricting agent access.

Most banks are landing on read-only access, according to the Axios reporting. That lets an agent view account data but not act on it, the same arrangement banks already offer budgeting apps like Quicken.

A Chase spokesperson boiled the security question down to one sentence: customers should not give their usernames and passwords to anyone.

Banks are also running "day after" scenarios so they can lock down or restore customer access quickly if an agent causes damage, per Axios.

Hong Kong opens a discussion on 'Know Your Agent'

On Monday, Nov. 2, the Hong Kong Monetary Authority (HKMA) unveiled Project SAGE, short for Securing Agentic Finance with Governance and Enablement, at Hong Kong FinTech Week 2026. It formed a cross-sector expert group and published a discussion paper on supervisory requirements for banks that use agentic AI.

The paper explores how responsibility should be allocated when an agent acts, and floats a unified registry of trusted agents. It also raises "Know Your Agent" (KYA), a mechanism to identify and verify the credentials of autonomous software. Tech Times reported the project also contemplates intervention powers, including a kill switch.

This is a discussion paper, not a rule. It asks what KYA should require in practice.

The move follows the HKMA's Oct. 15 announcement of an "ART" framework, for accountability, resilience and trust. The regulator said more than 60% of use cases in the second cohort of its GenAI Sandbox explored agentic AI. HKMA Deputy Chief Executive Arthur Yuen called the shift from generative to agentic AI "an important new stage of innovation for the banking sector."

The HKMA is also moving toward testing agentic applications in a GenAI Sandbox++, and it described its approach as built around intent-anchored accountability, a registry of material AI agents, and intervention mechanisms.

Can anyone verify an agent finished the job?

A separate problem is whether an agent did what it says it did. A paper from Google and the University of Hong Kong, listed on arXiv as 2610.40578 and submitted Oct. 29, introduces VeriCUA. It checks the actual state of apps and files rather than accepting an agent's claim that a task is complete.

The authors report that on the OSWorld benchmark, VeriCUA cut the false-positive rate, meaning sign-offs on tasks that were not completed, from 27.9% to 13.9%. On ScienceBoard it fell from 24.8% to 5.4%. On the AndroidWorld mobile benchmark, the authors report 90.5% accuracy and a 7.7% false-positive rate, against 82.4% and 16.9% for an auto-generated script verifier.

Those are the researchers' own benchmark figures. The paper was released days ago and is a research result, not a banking product. It does show that verifying agent behavior is an open technical problem, not a settled one.

Economics beyond security

Apollo Global Management chief economist Torsten Slok warned in September that capable financial assistants could eventually produce what he called an "agentic bank run." Software that constantly hunts for yield could shift a household's cash out of low-paying checking accounts into higher-paying alternatives without human hesitation.

What comes next

U.S. banks are setting the terms themselves through access restrictions and customer agreements. Hong Kong is asking industry what a formal identity and accountability system should look like.

The unresolved question is the one the bank executive described: how a bank tells, in real time, whether an agent acting in an account has the customer's authorization. Schwab's MCP plan and the HKMA's KYA proposal are both attempts to answer it. Neither has been tested at scale. When the HKMA announced its ART framework on Oct. 15, it had not given a date for its planned agentic AI discussion paper.