The heads of Canadian banks RBC and BMO are the latest bank chiefs to warn customers about linking accounts to AI agents. BMO's CEO urged customers not to give agents their username, password, card details or PIN, while RBC is considering whether to block Meta's Muse agent from accessing client data. Earlier, JPMorgan, Citi, Bank of America and Charles Schwab confirmed restrictions, allowing only read-only access through approved open banking providers. According to CNBC, the banks have also discussed the issue with US Federal Reserve officials.

What it means: What began as a JPMorgan decision is turning into a shared position among large banks in the US and Canada: AI agents will not sign in with customers' credentials, and any access that is allowed will run through controlled open banking channels. The new elements are the scale, with Canadian bank chiefs now speaking publicly, and the involvement of supervisors. In Europe the question already has a framework: PSD2 provides for third-party access through APIs with strong customer authentication and effectively rules out third parties using a customer's login, while PSD3 and the Payment Services Regulation will tighten fraud rules further. For Greek banks the question is not whether to allow agents but on what terms: through licensed providers, with amount limits and with the customer's explicit approval for every transfer. For fintechs building payment agents, the message is that account access will come through licences and agreements, not through automated logins to a bank's website. For customers, the simple rule still applies: passwords, PINs and one-time codes are not handed to any tool, however clever it seems.

Read the original on Finextra

Related service: myDATA integrations

Related stories