Why this question arrived in 2026
AI assistants can now log into websites and take actions for people. When customers point them at online banking, the agent usually signs in with the customer's own password. In October 2026 several of the largest US banks restricted or blocked third-party agents for exactly that reason, and pointed customers toward read-only data access instead.
Read-only access helps with insight, but the work businesses most want help with is paying: supplier invoices, payroll top-ups, card balances, sweeps between their own accounts.
The five controls
1. Agent identity
The bank needs to know which agent is calling, which company runs it and which customer it acts for. Several "know your agent" providers now offer this signal. Identity tells you who is asking. It does not tell you what they may do.
2. A signed mandate
A mandate is a written permission the account holder signs, for example: "My agent may pay approved suppliers up to $2,000 each and $15,000 a month from Operating, until 31 March." It should name the agent, payees, per-payment and monthly limits, account and expiry, and be signed with a strong method such as a passkey. The bank sets ceilings the customer cannot exceed.
3. Human approval for exceptions
Anything outside the mandate (a new payee, a larger amount, an expired mandate) should stop and ask the account holder to approve or decline. No approval, no payment.
4. Off switches on both sides
The bank should be able to stop one agent, one customer's agents or every agent. The customer should be able to stop their own. Both should take effect immediately and be recorded.
5. An evidence pack per action
For disputes and examinations, each action needs one record: the identity signal, mandate version, checks run, who approved, what was sent to the payment rail, and a tamper-evident hash.
Where existing tools stop
| Approach | Gives you | Missing |
|---|---|---|
| Shared passwords | Payments work | Identity, limits, approval, evidence |
| Read-only data access | Safe insight | Payments |
| Agent identity providers | Who is calling | Customer mandate, approval, evidence |
| Blocking agents | No new risk | Customer value; deposits may move |
Why business accounts first
Commercial payments are governed by UCC Article 4A, which recognises agreed, commercially reasonable security procedures. A mandate plus approval plus evidence can be designed as that procedure. Consumer liability under Regulation E is less settled. See our guide to UCC 4A and AI agent payments.