An Agent With
Your Password
Is You.

Why the banks had only one switch.

Between October 13 and October 28, nine of the ten largest banks in North America blocked or limited personal AI agents, by their own account or in press reports. The tenth has said nothing in public. The headlines said the banks had banned AI agents.

Read what the banks actually wrote and the agent they describe is narrower: one that reaches the bank by logging in as you, with your password. That distinction is the whole story. It explains why the banks had only one switch to pull, why one banking regulator had already described the agent they could let in, and why the one firm that has said yes drew its line in exactly the same place.

What Happened, in the Banks’ Own Words

JPMorgan Chase spoke first. On October 13, its chief executive, Jamie Dimon, told analysts: “We’re not going to allow just any ... outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan.” A spokeswoman put the bank’s position more precisely: “Because it is not safe, we do not permit third parties to access accounts by obtaining customers’ banking credentials and logging in on their behalf.”

On October 27, RBC sent its employees a memo and published a notice to clients. The notice says: “RBC has decided to block third-party personal AI agents from direct access to authenticated RBC digital properties including online banking.” The memo, from Naim Kazmi, group head of technology and operations, and Erica Nielsen, group head of personal banking, gives the reason: such agents “accessing banking systems can create unacceptable customer risk, including acting beyond customer expectations or creating liability exposure.”

Here are the ten largest banks in North America by assets, and where each one stands. Words in quotation marks are the bank’s own.

The pattern holds below the top ten. CIBC said it does “not support personal AI agents directly opening or accessing accounts”, and National Bank said it was monitoring.

Nobody says “ban”. The banks say block, do not permit, limit. And look at what is being blocked. JPMorgan names it exactly: third parties “obtaining customers’ banking credentials and logging in on their behalf”. RBC and TD say third-party, personal, authenticated. The banks are not describing AI in general. They are describing a specific kind of visitor at a specific door.

The Sentence the Whole Story Turns On

RBC’s notice to clients explains what these agents are, and it is the most important sentence anyone wrote that week: “To perform these tasks, personal AI agents need access to your online accounts, including financial ones, and may store your passwords to get there.”

Meta’s own description of Muse, the agent most often named in the coverage, says the same thing from the other side. Muse runs on a dedicated machine in the cloud, Meta wrote in September, and that is “where the data and credentials for any service a person connects are securely stored.”

So the agent arrives at the bank the way you do. Same login page, same password, same session. To the bank’s systems it is not an agent at all. It is you.

JPMorgan’s website terms show how far that is from what a bank wants. They require that any AI agent “identifies itself as an AI agent” at all times, and that agents “clearly and deterministically label all agentic traffic”. An agent that signs in with your password has no way to do either.

Three things follow, and together they explain why the only available control was a wall.

A fourth consequence is legal, and the banks are now writing it into their contracts. The version of Wells Fargo’s online access agreement that takes effect on November 24 has a new section on AI agents. If you give an agent your login credentials, it says, then unless law or regulation provides otherwise, “Any instructions, actions, or transactions initiated by the AI Agent are deemed to have been initiated and authorized directly by you, without further verification, and we have no obligation to investigate the validity or scope of such authority”.

RBC’s Digital Banking Security Guarantee, reproduced at the foot of its notice, reimburses unauthorized transactions, but not if “you share any of your Passwords or Personal Verification Questions”. Dimon said it in plain words: “They should understand there’s a liability transfer.” Under terms like these, an agent’s mistakes are yours. That is the scenario RBC’s memo calls “acting beyond customer expectations”: an agent with your full authority doing something you did not intend.

Why a Wall Was the Only Switch

Given all that, the banks had two options: stop every agent at the door, or stop none. In FN-14 we wrote that a kill switch which cannot tell good agents from bad is not a kill switch, it is an outage. This is the same trade-off at continental scale. The banks chose the outage.

TD’s statement says why, from the inside. It blocked agents “while we ensure the appropriate safeguards, authorization mechanisms and oversight are in place.” The wall is a placeholder for a mechanism that does not exist yet. The Cloud Security Alliance reached the same diagnosis in a research note on November 2: “The central security problem is identity, not AI.”

On the day RBC moved, Canada’s banking regulator said the choice was the banks’ to make. Peter Routledge, Superintendent of Financial Institutions, told reporters at Tech Festival Canada on October 27: “To the extent a board of directors and their CEO decide now we’ve got to mitigate this risk from agents that are perhaps issuing transaction instructions on behalf of a human being – maybe that board and that CEO decides that’s too risky,” adding, “Provided it’s done in a responsible way, that to me is indicative of sound risk management.” Three weeks earlier he had named the worry exactly: “agents are interpreting their task authorizations liberally”.

One Regulator Had Already Written the Spec

In July, Routledge’s office, OSFI, published a technology risk bulletin on generative and agentic AI. Two honest caveats first. OSFI says its bulletins “are not regulatory expectations” and “describe sound practices that financial institutions (institutions) can apply at their discretion”. And the bulletin is written for the agents an institution runs itself. It does not mention customers’ agents anywhere.

Read its section on agent autonomy and access against the consumer agent at the login page, though, and it reads like a diagnosis. The bulletin names the risk: “Key risks include over-privileged access and the use of shared or inherited credentials that undermine accountability.” An agent carrying your password is the purest case of an inherited credential there is.

Then it lists what it would take. Here is what it names, in its own words, set against the agent the banks blocked.

Every item on that list presupposes one thing: an identity that belongs to the agent. Not one of them is available to an agent that logs in as you, and that is the only kind of agent the banks have so far been offered.

The Other Door

On November 5, Wealthsimple announced the opposite decision. From early 2027, it wrote, “clients will be able to securely connect their Wealthsimple accounts to ChatGPT or Claude, and determine the level of access granted to them. Each connection will require client approval during setup, and critical actions will receive an extra check, keeping clients firmly in control.”

Its senior product director, Sam Newman-Bremang, told The Globe and Mail where the line sits: “Canadians – we agree with the big banks – should not be doing this. They’re giving them their ID, their password. We don’t believe that that is the right way to do it.”

Same line as the banks. Opposite conclusion. The difference is not a policy on agents. It is that Wealthsimple is building the agent a way in that is not the client’s password: a connection the client sets up, with a level of access, an extra check on critical actions, and, in the words of its director of software development, Jordan Deutsch, “a trail of all of that over time.” Set those against OSFI’s list and most of it is there: a scoped grant, an approval checkpoint on critical actions, a trail per agent.

The largest US banks are pointing at the same door. JPMorgan left it open in the same breath as its block: “We support secure, customer-authorized data sharing through open banking providers and are committed to enabling agentic connections securely.” Wells Fargo’s new agreement reserves the right to change its requirements for AI agents, “including requiring that you register your AI Agents with us”. A registered agent is an agent with an identity of its own.

The card networks are building the cross-organization version. Mastercard’s Agent Pay Trust Framework, it says, “brings together identity, intent, controls, execution and intelligence”, and its partner Skyfire’s chief executive, Amir Sarhangi, put the requirement in one line: “Every AI agent that transacts on someone’s behalf should be identifiable, accountable and auditable.” FN-03 made the same case in June, from Mastercard’s own questions.

So the blocks are not an end state. They are the state a financial institution is in before agent identity exists at its door.

Where AgentID Stands

Honesty first. AgentID does not sit between Meta’s Muse and a bank’s login page. How a member of the public’s agent proves itself to a bank it has no relationship with is being worked out by the banks, the open banking providers and the card networks, and it is not finished.

What AgentID does today is the institution’s half, for the agents an organization runs itself, whether they triage fraud alerts, reconcile ledgers or answer support tickets. Each of those gets its own identity, issued to the agent rather than borrowed from a person. The organization sets how long that identity lives, from a single transaction to anything between one minute and twelve months. Every action that passes through its gateway is checked against the agent’s certificate, its scope and whether it has been revoked, and refused if any of the three fails. One agent can be revoked on its own; a tenant-wide kill switch stops all of them, and needs two administrators to fire. Each agent’s invocations are kept in an audit log of its own, built from the cloud providers’ own records. Those are the properties OSFI’s list names. Whether they satisfy any particular control is for the institution’s own assessment, not ours.

One item is still ahead of us. AgentID will map each agent to its owner’s user ID in the organization’s own identity system, Okta or Microsoft Entra ID, so that when that person leaves, their agents are suspended together. That is planned, not shipped. FN-10 explains why it matters.

Why this matters to a bank is simple. An institution cannot move from “block all” to “admit some” until something issues, scopes, expires and revokes agent identities and checks each action against them. That is the half AgentID is. The other half, an outside agent proving who it is, needs the industry work above. Both halves need the one thing a shared password can never provide: an agent that is not you.

Five Questions Before You Let Any Agent Through

If the answer to the first question is “a person’s”, the other four are already answered, and the only switch you have is the one the banks just pulled.