Blog

Five of the largest US banks now block AI agents like Meta's Muse, and the block already leaks. A badge, a signed credential naming the agent, who sent it and what it may do, lets a bank do what it already does with customers: check, then say yes selectively.

On October 16, Schwab's chief executive, Rick Wurster, told Bloomberg that his firm was blocking Meta's Muse, an AI assistant app launched on September 8, and other outside agents trying to move client money. Eleven days later, American Banker reported JPMorganChase, Citi, Bank of America, Wells Fargo and Morgan Stanley doing the same.

The day Schwab spoke, in The Agentic Bank Run Clock Just Moved Closer to Midnight, we argued that the tools that could make a deposit run fast had arrived. By Sensor Tower's estimate, Muse passed 10 million US downloads in its first 40 days. Customers want these agents, and a bank that refuses every one of them refuses the customers who sent them.

A blanket ban may be reasonable as a first move, but it is poor policy. It treats every agent the same, the rogue one and the one a good customer set up on purpose, and no bank has ever treated every customer the same. Banks check who a customer is before they serve them; bots deserve the same check.

Why a Blanket Ban on AI Agents Is Not Viable

Forrester put it in the title of its analysis: "Banks Can't Block Their Way Into The Agentic Future." It calls the blocks a reasonable short-term response but not a long-term plan. It asks banks to move from yes-or-no decisions to graduated trust: a framework for which agents may reach what, under what conditions, and with which permissions.

The ban already leaks. American Banker reported that one bank, unnamed, watched an agent move $100,000 out of a customer's account. Transmit Security, which sells fraud controls to banks, says some agents get through despite the blocks, because they copy human behavior, rotate devices and route through proxies. An agent turned away at the front door logs in as the customer, and the bank cannot tell the difference.

The ban also shifts the risk rather than removing it. Banks' user agreements put the responsibility for an agent's actions on the customer. The customer will still call the bank when the money is gone. Schwab's Wurster put the question plainly: when an agent no one controls goes wrong, who is liable? Jeff McMillan, who ran firmwide AI at Morgan Stanley, called blocking reasonable until standards exist, and warned that agents will open accounts elsewhere if banks stay too restrictive.

The Counterargument: Security, or Protectionism?

Ron Shevlin of Cornerstone Advisors answered Forrester on LinkedIn. He agrees that blocking is no long-term plan, and disagrees about what the blocks are. In his reading, banks are not shutting out outside agents. They are shutting out agents that log in with the customer's own password, which leaves the bank no identity for the agent and nothing to hold its limits against. Ending that, he argues, is the precondition for what Forrester calls graduated trust. His evidence: Citi and Chase still allow some read-only access through approved providers, and Schwab is building controlled connections through its own servers.

Then he turns to competition, and this is the harder point. An outside assistant can already steer a customer to a rival just by recommending it. Letting it move the money as well makes switching one tap away and pushes banking toward a commodity. Banks have every reason to keep their best capabilities for their own agents, and the likely result, in his view, is a more secure walled garden rather than an open market. His closing question is the right one: where does security end and protectionism begin?

That is the gap. Forrester asks for graduated trust. Shevlin says trust needs an identity for the agent, and warns that banks may use the lack of one as cover. Neither says how a bank, on a Tuesday morning, decides that this agent may move this customer's money and that one may not. Nor does either say how the bank shows that the line it drew was about risk and not about rivals.

Bank CEOs and Fraud Experts Agree the Shared Password Is the Problem

Jamie Dimon, Transmit Security's Matt Thompson and Mickey Boodaei, Linas Beliūnas, Katja Forbes and Lead Bank each see a different part of the problem.

Jamie Dimon, chairman and CEO of JPMorganChase, gave the incumbent case on the bank's third-quarter earnings call: "You don't want rogue agents." His bank still supports customer-authorized data sharing through open banking providers. What it refuses is an outside agent holding the customer's password.

Matt Thompson, CEO of Transmit Security and a former senior director of identity services at Capital One, pinpoints the irony: "They're blocking agents that are self-identifying," he told American Banker. The honest agents announce themselves and get stopped; the evasive ones slip through.

Mickey Boodaei, Transmit's co-founder and chairman, explained why the evasive ones win: an agent that can pass for a human has every reason not to identify itself. That is the strongest objection to any badge, and it is exactly why a badge has to be the only way an agent can move money.

Linas Beliūnas, who writes the FinTech & AI is Eating the World newsletter, looked at who carries the loss. Customers who keep sharing passwords with agents, he warns, may be signing away their fraud protection. Wells Fargo's updated online access agreement, effective November 24, is reported to treat an agent's instructions as the customer's own.

Katja Forbes, author of Machine Customers, named what the bans protect: "Inertia was the business model." Her advice runs the other way from a ban: build the agent that other agents want to talk to.

One bank has gone past the argument. Lead Bank, American Banker reported, has proposed a framework for allocating liability when an outside agent's transaction goes wrong.

Put together, these voices agree on more than they dispute. Beyond the password, liability has no owner. Both point to the same missing piece: an identity for the agent that the bank can check.

The Missing Piece: Know Your Bot, Not Just Know Your Customer

Know Your Bot is know-your-customer for the software that acts for a customer: identify the agent, verify its mandate, tier each action, watch it and revoke it.

The industry is building the doorbell. In early October, Sierra and Meta released Poppy, a draft protocol for a personal agent to identify itself and carry the customer's permissions. Bank of America, Wells Fargo, BBVA and Synchrony signed on as design partners. Visa and Mastercard are building agent identity for card payments. These standards describe how a bot knocks. None of them decides who the bank lets in. That decision belongs to the bank, under its own policies, the way account opening always has.

Banks already know how to make that decision. Every account starts with know-your-customer work: the Customer Identification Program identifies and verifies the person, due diligence records what the account is for, and monitoring watches it until the risk changes. Know Your Bot runs the same discipline in five steps.

Identify the agent: who built it, which model and version it runs, and who answers for it. Verify the mandate: which customer sent it, what that customer authorized, up to what amount and until when. Tier it: place each action it asks to take by impact and reversibility, the way a loan authority grid places a credit. Watch it: compare what it does with what its mandate allows, every time it acts. Revoke it: withdraw the badge in one step, the moment the customer, the bank or the behavior says so.

The badge carries those five answers with the agent, which presents it with every request: the agent's identity, the customer's delegation and its limits. The bank checks it against its own register on every request, and the rule is simple. No badge, no action, the way no employee gets past the vault door without one.

How a Badge Lets a Bank Say Yes Selectively

A badge turns a ban into a menu. An unbadged agent gets no agent privileges: at most it is treated as the customer at the keyboard, step-up checks and all. A badged agent asking to read a balance gets an answer. A badged agent with a verified mandate can move money between the customer's own accounts at the bank, within its limit. A transfer out of the bank above a set amount waits for the customer to confirm on a channel the bank trusts. A request to open an account still runs the customer through identification, because the badge vouches for the bot, never for the person behind it.

On CloudNine Bank, a simulated bank from Amberoon, a borrower's AI assistant gets exactly this treatment: its badge lets it apply for credit and check status, nothing more. Leave your name at the end of this page and we will send you that walkthrough.

The limits come from the bank's policies, not from the agent's maker. A $500 transfer between a customer's own accounts is low impact and easy to reverse. A $50,000 wire to a new payee is neither. The same agent can be trusted for one and held for the other, and every decision traces to a policy sentence an examiner can read.

That is how a bank can be selective in a way a ban cannot. The customer whose agent behaves is served faster. The rogue agent stands out sooner, because it is either unbadged or acting outside its mandate. And when a badged agent does err, the bank holds what a dispute turns on: what the customer authorized, what the agent asked and what the bank answered.

Why Banks Must Badge Their Own AI Agents Too

The bots at the door are only half of the problem. Banks are putting agents to work inside, too. Two of the largest core processors announced agent platforms in May, starting with AML investigations, commercial loan onboarding and deposit analysis. A bank that badges a customer's agent but not its own wire agent has the rule backward. Examiners will ask the same questions about both: what may it do, who answers for it, and how fast can you switch it off.

So the badge has to cover three populations under one register: the bank's own agents, its vendors' agents working inside its processes, and the outside agents acting for customers. One record, one set of limits drawn from one set of policies, one switch.

The same register answers Shevlin's question. When the bank's own agent and an outside agent are badged against the same policies, the line between them is written down. If an outside agent meets the same badge, mandate and limit requirements as the bank's own agent, refusing it is protectionism, and the record shows it. Refusing one that cannot meet those terms is security, and the record shows that too. A community bank does not have to wait for its core processor to decide this for it; the policies that set the limits are already its own.

Where Manatoko Agency Fits

A bank that wants to badge its bots needs one register for all three populations, and that is what Manatoko Agency provides. It gives every agent that touches a bank a badge, sets what each may do from the bank's own board-approved policies, and lets the bank revoke any of them in real time. Its identity module, Manatoko KYA (Know Your Agent), is Know Your Bot run as software: it keeps the badge record for the bank's own agents and its vendors' agents today. The check for outside agents runs in the CloudNine demonstration and is the next piece we are building for banks. The Manatoko Agency Matrix scores every decision the bank makes on impact and reversibility and sets the level of human oversight each one needs. It is built to govern the agents a bank's core processor ships rather than replace them, so the bank sees every vendor's bots in one place.

Manatoko Agency runs today on CloudNine Bank, operated by 82 agents, each with a badge, under 147 policies and a catalog of 1,830 scored decisions. On CloudNine an agent can approve a $336,000 loan on its own. The same agent hands a $5.86 million loan to the chief lending officer, the chief credit officer and the Officers Loan Committee, because the policy says so.

The bank does not need a new core or an AI team to start. It needs its policies. The walkthrough offered at the end of this page follows that loan from the agent to the committee.

Now Count the Bots at Your Door

Ask your operations team one question this week: how many automated sessions logged into your customers' accounts last month, and how many did you recognize? If the answer is a guess, the ban is already leaking, and the agents getting through are the ones you cannot see.

A bank does not open accounts for strangers, and it does not turn away every customer it has not met. It checks who they are and decides. Badge your bots the same way, and the next time someone asks how many agents are at the door, the register answers.

Amberoon builds Manatoko Agency, credentials for the AI agents that act for and with a bank: who they are, what they may do, and real-time revocation. To see CloudNine Bank's 82 badged agents at work, and which decisions they hand to a person, leave your name, email and bank below.