TL;DR: Wells Fargo's updated Online Access Agreement adds a Section 15 on AI agents, effective Tuesday, November 24, 2026. From that date, anything an AI agent does with your account is treated as "initiated and authorized directly by you" — including transactions you did not want or intend. JPMorgan Chase, Bank of America, Citi and Schwab have already blocked outside agents outright. If an agent has your bank login, you have a decision to make before November 24.
Agent Brief: On Oct 13–16, 2026, JPMorgan Chase, Bank of America, Citigroup, Charles Schwab and Wells Fargo restricted third-party AI agents' access to customer accounts (Reuters via PYMNTS, Oct 22). Wells Fargo's updated Online Access Agreement, Section 15 ("Third-Party Artificial Intelligence Agents or Agentic AI"), effective Nov 24, 2026, deems agent transactions "initiated and authorized directly by you, without further verification," states "Your use of any AI Agent is AT YOUR OWN RISK," and assigns customers responsibility for an agent's unintended actions and mistakes (USA Today, Oct 23; Forkast, Oct 21). Black Friday follows on Nov 27.
What did the banks actually do?
In the second week of October, the biggest names in American banking reached the same answer to the AI agent question — just by different doors.
JPMorgan Chase blocks agents that log in with customer credentials; outside tools can view data but cannot move money. CEO Jamie Dimon, on the bank's third-quarter call, warned against "rogue agents," adding: "It could be thousands of them." Citi stated flatly that it does not permit "third-party AI agents or assistants to log into a customer's account or transact directly within our digital banking platforms," while still allowing limited read-only access through open-banking providers. Bank of America restricted access to consumer deposits; CEO Brian Moynihan's principle: "We strongly believe there should be a human in the loop to authorise money moving out of your account." Schwab CEO Rick Wurster said the firm blocks unauthorized agents — the agent most often named in the reporting is Meta's Muse — "in the tens and twenties" every week.
Four banks said no. Wells Fargo said something more interesting.
What does Wells Fargo's Section 15 actually say?
Wells Fargo did not simply block agents. Its updated Online Access Agreement — effective Tuesday, November 24, three days before Black Friday — adds an entire section on third-party AI agents, and the section is a liability transfer written in plain contract language:
- Every agent transaction is yours. Transactions by an agent you authorized are "deemed to have been initiated and authorized directly by you, without further verification."
- It is explicitly at your risk. "Your use of any AI Agent is AT YOUR OWN RISK."
- Even the mistakes are yours. Customers are responsible for an agent's unintended actions, its errors, and even "manipulated inputs" — and the agreement counts transactions "including those you did not want or intend" as authorized.
- The bank is not watching. Wells Fargo disclaims any duty to monitor, screen or review what your agent does.
- It ends when you say so — and not before. Your responsibility continues until you revoke the agent's access and notify the bank, and the bank has had a reasonable opportunity to act.
Read that last point twice. Under Section 15, silence is consent: an agent you connected once keeps spending with your legal signature until you affirmatively cut it off.
Why are the banks doing this now?
The stated reason is authentication: a bank can verify which credentials logged in, but not whether the activity behind them was really directed by the customer. Banks say they have detected agents inside accounts taking actions that appeared to go beyond their users' instructions.
The unstated reason is deposits. Agents are very good at boring optimization — like moving idle cash out of zero-interest checking into accounts that pay more. JPMorgan, Bank of America and Wells Fargo collectively hold about $1.6 trillion in non-interest-bearing deposits. Paying just 3% on that money would cost the three banks roughly $47 billion a year — nearly half their combined annual earnings. An agent that sweeps your cash is, from a bank's perspective, a machine for draining its cheapest funding. Blocking that machine, or contractually disowning it, is not a technology decision. It is a margin decision.
There is a quiet irony underneath: several of these same banks — Bank of America and Wells Fargo among them — have joined a "Personal Agent Protocol" group exploring standards for agent access. The banks are writing the rules for agent banking while locking the current generation of agents out. They do not fear agents. They fear agents they do not control.
What should you do before November 24?
- Know what has your login. List every AI agent, assistant or automation that can reach a bank or brokerage account — including ones you connected once and forgot.
- Read your bank's agent terms. Wells Fargo customers get Section 15 on Nov 24. Other banks have their own restrictions; violating them can itself be a terms breach.
- Prefer read-only. Balances and alerts are one thing; transaction authority is another. If an agent can move money, treat it like giving someone a signed blank check.
- If you revoke, notify. Under Section 15-style terms, your liability runs until the bank is notified and has had reasonable time to act. Revoking inside the app alone may not stop the clock.
- Set limits where you can. Spending caps, allowlists and approval thresholds are the difference between an agent with a job description and an agent with your signature.
What happens next?
November 24 is the first hard date, but the direction is set. Expect official, bank-controlled agent channels — APIs, partnerships, "approved agent" programs — to replace the login-sharing free-for-all, and expect every one of them to come with the same core bargain Wells Fargo wrote down: the convenience is yours, and so is the risk. The open question is whether anyone builds the alternative: agent wallets with scoped permissions, hard limits and kill switches, where responsibility follows the permission you actually granted — not a signature you gave once and forgot.
That is the fight worth watching. The banks have drawn the liability line. November 24, it takes effect.
Sources: USA Today (Oct 23, 2026); Forkast (Oct 21, 2026); Reuters via PYMNTS (Oct 22, 2026); WinBuzzer (Oct 23, 2026); FStech (Oct 19, 2026).
The White Report publishes news and analysis about crypto and AI markets. Nothing on this site is financial advice, and nothing here is a recommendation to buy or sell any asset. Do your own research before making investment decisions.