Dev.to AI 🤖 Ai 👁 0 📖 12 min read

AI Agent Bank Account Access: Why Banks Block Password-Sharing Bots, and the Open Finance Consent Spec for Gulf Apps

The short answer AI agent bank account access just became a flashpoint. Giving an AI agent your bank password is the one way of connecting an agent that every bank now treats as a red flag. On 22 October 2026, Axios re

The short answer

AI agent bank account access just became a flashpoint. Giving an AI agent your bank password is the one way of connecting an agent that every bank now treats as a red flag. On 22 October 2026, Axios reported that major US banks were detecting unvetted third-party AI agents operating inside customer accounts, often logged in with the customer's own username and password, and in some cases contacting call centres or taking actions that appeared to go beyond the user's instructions. Reuters confirmed the same day that banks were blocking those agents. Morgan Stanley has begun blocking third-party agents, and JPMorgan, Bank of America, Citi and Wells Fargo are restricting them. What banks still allow, or are moving towards, is read-only access through approved, consent-based connections.

For Gulf fintech teams this is not just a US story. The UAE and Saudi Arabia already have the infrastructure the US banks are reaching for: the CBUAE Open Finance framework, with the Al Tareq consent layer and a central API Hub run by Nebras, and SAMA's licensed open banking regime. Both are built on explicit consent, a registered third party, strong customer authentication in the bank's own app, and revocation. The UAE regulation goes further and expressly prohibits data scraping. This article explains what happened, why password sharing fails, and gives a concrete spec for letting an AI agent use a bank account in the UAE or Saudi Arabia through consent instead of credentials.

What happened: the facts, with dates and sources

  • 13 October 2026, JPMorgan Q3 call: CEO Jamie Dimon said the bank was developing tools for the risk of AI agents carrying out tasks on their own: "We're not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan." (Quoted by Reuters via Investing.com)
  • Early October, Charles Schwab: CEO Rick Wurster said he gets a daily report of how many agent logins Schwab has blocked. He said the number is not large and that Schwab blocks them "because we want to have control over authentication and the experience." (Reuters, same link)
  • 22 October 2026, the Axios scoop: banks including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo are "racing to contain agent risks". These are generally cases where an agent logs in with the user's permission and login credentials, which breaks most banks' rule that humans log in to their own accounts. Some agents contacted call centres or appeared to act independently of user instructions. A Chase spokesperson said customers should not give their usernames and passwords to anyone. Morgan Stanley said it had not seen "rogue AI agents accessing our platforms". Most banks have authorised, or are moving towards, read-only access. (Axios)
  • 22 October 2026, Reuters: two people familiar with the matter said major US banks have been blocking third-party agents from operating inside accounts and making transactions. One banking-industry source said such transactions "cannot be deemed unauthorized if credentials were shared by the customer". (Reuters via Investing.com)
  • 19 October 2026, Citi at Money20/20 (published 23 October): Naveed Anwar, Citi's global head of AI, digital and data platforms in its services business, said Citi has "blocked anything that is trying to access our walls agentically, beyond some open banking read-only access", and called for a "know your agent" process, similar to know-your-customer checks. In the same coverage, Fifth Third said it does not currently allow agents to initiate transactions, and PNC's CEO said no bank will let agents transact without a human in the loop. (Banking Dive, 23 Oct)
  • 23 October 2026, Gulf readers: Gulf News carried the story for regional readers and noted that there are no confirmed reports of customers losing money from the activity described. (Gulf News)

Why is giving an AI agent your bank password dangerous?

Credential sharing, also called screen scraping when software drives the bank's website, leaves the bank, the customer and the agent provider unable to answer three basic questions:

  1. Who is acting? If an agent logs in with your password, it looks like you. Axios reports that banks broadly cannot tell whether account activity is user-directed, or whether an agent was authorised or "has gone rogue".
  2. What is it allowed to do? A password grants everything you can do: transfers, adding payees, changing limits, calling support. There is no "read balances only" mode.
  3. Who pays when it goes wrong? Reuters' source said transactions made with shared credentials cannot be deemed unauthorised. In plain terms, the customer may carry the loss, and the dispute process was never designed for "my agent did it".

A consented API connection answers all three: the third party is registered and identified, the scope is written into the consent, and the record shows what the customer approved and when. That is why the banks' fallback is read-only API access, not "no access".

Can an AI agent access a bank account in the UAE?

Yes, but through the right door. Under the CBUAE Open Finance Regulation (Circular 7 of 2023, updated by Circular 3 of 2025, in force since 10 July 2025), third-party providers can access customer-permissioned data and initiate payments and other services through APIs. Key rules, as summarised by Pinsent Masons:

  • Consent must be explicit, informed and securely recorded, and data may be used only for the purpose the user authorised.
  • The regulation expressly prohibits data scraping.
  • Participation is mandatory for CBUAE-licensed banks and other licensed financial institutions. Third-party providers need a CBUAE licence, or must notify the CBUAE and get a no-objection certificate if they are already deemed licensed.
  • Al Tareq provides the standard, centralised consent and authentication experience, and powers account-to-account payment initiation. The regulation applies to mainland UAE and excludes the DIFC and ADGM, which have their own regulators.

The technical design matters even more for agents. Nebras' LFI integration guide says UAE Open Finance is "strictly mediated": third parties never call banks directly. All traffic goes through the API Hub, which acts as the OIDC/FAPI authorisation server and the consent source of truth. The customer is redirected to their bank to authenticate and authorise the consent, and every bank must provide a Consent Management Interface where users review and revoke active consents. The published release roadmap lists variable recurring payments, request to pay and delegated SCA for Tier 1 banks' individual customers. Those are exactly the building blocks a bounded agent mandate needs.

Nebras also has agents in view. In a recap of a Dubai event on 11 September, Perfios reported that Nebras' CEO listed agentic AI and an "agentic consent layer" on the roadmap, with v3.0 targeted for early next year. Treat that as a direction of travel, not a published standard.

Can AI agents use Saudi open banking under SAMA rules?

SAMA has no rule written specifically for AI agents that we could find. But the payment services rules already describe the safe pattern. On 26 March 2026, SAMA announced it had begun licensing fintechs to provide open banking services after the sandbox phase (The Global Banker; see also our post on Lean and Neotek's SAMA licences). The Implementing Regulations of the Payments and Payment Services Law, Part 8, say:

  • A Payment Initiation Service Provider must obtain consent before providing its service, must not modify the amount, the payee or any other feature of a payment it initiates, must keep the user's security credentials secure and inaccessible to other parties, and must identify itself in every communication session with the bank (Article 97).
  • A Payment Account Information Service Provider must obtain consent, delete the data when consent is withdrawn, access only the designated accounts, and must not request sensitive data that could be used for fraudulent transactions (Article 99).
  • A bank may deny a provider access for "reasonably justified and duly evidenced reasons relating to unauthorized or fraudulent access", but must tell the provider why, notify SAMA immediately, and restore access when the denial is no longer justified (Article 96).

Read through an agent lens, that is a ready-made "know your agent" framework: a licensed, identified party, a consent the bank can see, an exact amount and payee that cannot be altered, and a regulated way to cut access when something looks wrong. Password sharing has none of those.

A consent spec for letting an AI agent use a bank account in the Gulf

This is iFynx's product and engineering spec for Gulf banks, licensed third parties and super-apps that want agents in the flow without repeating the US mistake. It is our analysis, not legal advice. Check each scope with your licence and your regulator.

1. Fail closed on credentials. Your agent product should never ask for, store or type a bank password, OTP or card PIN. If a user pastes one, refuse and route them to the consented connection. Banks should do the same in reverse: when a session looks like an automated login, show a clear path to the approved channel instead of a silent block.

2. Register the agent as a party, not a user. The connecting app should be the licensed TPP (or its registered client) and should name the AI agent in the consent: "Assistant X, operated by Company Y, on behalf of [customer]". Log the agent identifier on every call, which matches SAMA's per-session identification rule.

3. Use a scope ladder, and start at the bottom.

  • Level 0, read-only: balances, transactions, product data. This is what US banks still allow and what most budgeting and advice agents need.
  • Level 1, request only: the agent prepares a payment, and the customer approves it in the bank app with SCA through Al Tareq or the bank's own flow. Mercury's MCP connection, launched in mid-October 2026, is a good public model: agents can create payment requests, but "payments and transfers still require approval in Mercury", and a confirmation in the chat is not approval.
  • Level 2, bounded mandate: only after Level 1 works well. A variable recurring payment style consent with a per-payment cap, a monthly cap, a payee allow-list and an expiry date.
  • Never by agent: adding payees, raising limits, changing contact details or credentials, or calling the contact centre as the customer.

4. Approve in the bank, not in the chat. The approval screen belongs to the bank or the hub and must show the agent's name, the amount, the payee, the fees and a cancel option, in Arabic and English. Agents should treat "request created" as the result, never "payment sent".

5. Re-consent to go up a level. Read-only connections should not gain write powers automatically. Mercury requires users to re-authorise to grant write scopes, and this is the right default.

6. Make the consent dashboard agent-aware. In the Consent Management Interface, list each agent separately, with the human who granted it, its scopes, the date of its last action and a one-tap revoke with a receipt number. Revoking should cut access right away.

7. Log intent next to action. Store what the customer asked the agent to do, the structured request the agent sent and what the bank executed. When disputes arrive, that trail decides liability. With a shared password, the trail does not exist.

8. Teach the contact centre. Axios reports agents calling call centres. Scripts should ask whether the caller is a person or an automated assistant, and route agents to the API.

Bilingual consent copy you can adapt

  • Read-only (EN): "Assistant X will see your balances and transactions for 90 days. It cannot move money. You can stop this at any time in your bank app."
  • Request-to-pay (EN): "Assistant X can prepare payments for you. Nothing is sent until you approve each one in your bank app."
  • Bounded mandate (EN): "Assistant X can pay up to AED 500 per payment and AED 2,000 per month to the payees you listed, until 31 January 2027."

The Arabic versions of these lines are in the Arabic edition of this article. Write the Arabic first, not as a translation afterthought: the consent screen is the moment of trust.

What Gulf banks and fintechs should do this quarter

  • Banks: publish a clear position for customers ("never share your password with any app or AI assistant; use connected apps instead"), monitor automated logins and point them to the open finance channel, and add agent labels to the Consent Management Interface.
  • Licensed TPPs and fintechs: ship read-only agent features first, design Level 1 request-to-pay with approval in the bank app, and keep an evidence pack (consent records, intent logs, revocation times) ready for the regulator.
  • Super-apps and AI assistant builders: do not build browser automation against bank websites in the UAE. The regulation prohibits scraping, and the US experience shows banks will block it anyway. Partner with a licensed TPP instead.

Frequently asked questions

Is it safe to give an AI agent my bank password?

No. Banks, including Chase, tell customers not to share their username and password with anyone. An agent with your password can do everything you can do, banks cannot tell it apart from you, and a Reuters source said transactions made with shared credentials cannot be deemed unauthorised, which can leave you carrying the loss. Use an app connected through your bank's open banking or open finance consent instead.

Why are US banks blocking AI agents?

Because many agents log in with customers' shared passwords, and banks cannot tell whether an agent is following instructions or acting on its own. Axios reported on 22 October 2026 that some agents contacted call centres or appeared to act beyond user instructions. Morgan Stanley, JPMorgan, Bank of America, Citi and Wells Fargo are restricting agents, while most banks allow or are moving towards read-only access.

Can AI agents access bank accounts in the UAE?

Only through the right channel. Under the CBUAE Open Finance Regulation, a licensed third party can access data or initiate payments with the customer's explicit consent, through the Al Tareq consent and authentication layer and the Nebras API Hub. The regulation expressly prohibits data scraping, so password-based bots are not the compliant route.

Does SAMA allow AI agents to make payments in Saudi Arabia?

We found no SAMA rule written specifically for AI agents. Payment initiation is a licensed activity under SAMA's payment services rules: the provider must obtain consent, identify itself in every session with the bank and must not change the amount or payee. An agent product would need to work through such a licensed provider, with the customer approving payments.

What should a Gulf fintech build first for AI agents?

Start with read-only access through open finance consent, then add request-to-pay where the agent prepares a payment and the customer approves it in the bank app. Add bounded mandates with caps and payee lists only after that works, and give every agent its own entry in the consent dashboard with one-tap revoke.

Related reading

Sources

Originally published on iFynx.

📰 Read the original article on Dev.to AI

Originally published by Dev.to AI. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

Share 𝕏 Twitter ✈ Telegram ↗ Reddit 🟧 HN
← News 🤖 Ai 🏠 Home