Agentic Banking Is Here. Here’s What Financial Institutions Should Consider Today

This week, Axios reported that major U.S. banks are detecting third-party AI agents operating inside customer accounts. Banks are blocking some of that access and rewriting their terms of service. Their core problem is that they often can’t tell whether an agent is acting on a customer’s instructions or has gone off script.

The concern is legitimate. But the long term answer isn’t to shut the door on agents, because customers want them. People will use AI to budget, find savings, and manage their money, and banks know it. The better answer is to give agents a safe way in, and provide clear guard rails around how they are allowed to operate in the financial data world to keep consumers safe.

Much of what’s alarming the industry is customers handing their usernames and passwords to an AI assistant or enabling screen sharing via open windows. That is screen scraping with a new face. The industry spent years moving away from credential-based access toward tokenized, consented APIs, and the agentic era shouldn’t reverse that progress.

Many groups are working on the answer, and that’s healthy. Standards bodies, financial-data networks, banks, regulators, emerging open initiatives like the Agentic Financial Services Protocol (AFSP), and AI platform providers are all developing approaches to agent identity, authorization, and risk. Each group brings its own focus and its own equities, and the technology is moving faster than any one of them can set the rules. We don’t think this is a race for one group to win. Whichever standard or standards the industry ends up adopting, they should hold to the same core principles. That is what we laid out in our response to FDX’s call for input on agentic AI, and here is the short version.

In our response to the Financial Data Exchange’s call for input on agentic AI in May 2026, we laid out how to do this. Here are the principles we believe the industry should adopt.

1. Credentials are never the door.
   Agents should access accounts through tokenized, API-based connections, not logins shared with a bot. Credential access weakens accountability for any kind of client, and agents make that weakness more dangerous.
   
   
2. Know your agent operator.
   An agent is software. The accountable party is the organization that deploys it. Operators should be identifiable legal entities with published data-handling commitments, incident-notification obligations, and testing evidence proportionate to their risk. This should map to the third-party risk processes banks already run.
   
   
3. Make agents distinguishable from humans on every request.
   Banks can’t govern what they can’t see. Agent identity, such as operator, agent type, and deployment, should travel as signed claims in the authorization token, so it can’t be stripped or altered along the way. Only then can a bank require human-in-the-loop verification for sensitive actions, like account opening or money movement.
   
   
4. Consent must be bounded by purpose, time, and scope.
   Consent should describe what an agent may do, not just what it can read. We recommend layered action classes, ranging from viewing data to acting on an account, with the exact definitions set through industry standards work. Each class implies the ones below it and requires additional consent. Customers should be told plainly when an agent is involved, what it can do with and without a human-in-the-loop, and how to revoke access.
   
   
5. Keep a human in the loop for anything irreversible.
   Agents can work autonomously on reversible tasks like summarizing or budgeting. For money movement or account closure, the agent should propose an action that the customer approves through a separate channel. That keeps most of the benefit and protects the rare moments where mistakes are permanent.
   
   
6. Limit what data the agent can see.
   A common trick against AI tools uses hidden instructions inside plain text, like memo lines or payment names. Sending clean, structured data (like standard merchant names and clear amounts) instead of raw text reduces these safety risks. Restricting AI to set commands also keeps it on track if someone tries to trick it.
   
   
7. Be realistic about deleting data and accountability.
   Today’s AI models can’t completely "unlearn" information they’ve processed. What companies can and must offer is zero data retention at the model level, no training on user information, and strict rules for any sub-vendors handling data.
   
   
8. Build on standards, don’t fragment them.
   The industry doesn’t need a net new standard for every new technology. It should extend work like FAPI, NIST’s emerging agent guidance, and FDX’s existing risk frameworks, and define only what is specific to financial data. An “Agent-Safe” profile combining signed metadata, action-class scopes, standardized tool-call formats, and operator certification would give banks a simple standard to require and give AI platforms one integration to build.

What This Means for Banks and AI Builders

Banks that block all AI access will frustrate customers over time without removing risk, as users will simply look for workarounds. A stronger path is offering a secure, visible, and controllable way in, and asking AI companies to use it.

AI developers should expect to meet these standards. Banks will grant access to known providers whose AI tools are well-controlled and open to audits. As such, we strongly encourage leading LLM developers and AI platform providers to join these open industry dialogues and help co-create these expanded frameworks. Their experience, insights, and participation would be invaluable to building safe, innovative standards that empower consumers and move the entire ecosystem forward.

At MX, we build the data and AI infrastructure that financial institutions run on. We believe agentic banking can be safe, consented, and accountable, but only if the industry builds the rails before significant traffic arrives.