Which banks are blocking personal AI agents?

On 27 October, RBC told its customers it has decided to block third-party personal AI agents from direct access to its authenticated digital properties, online banking included. Existing connections will stop working, and the notice asks customers to bank “directly through our official website and mobile app” instead.

By the next afternoon the Canadian Press had positions from five more Canadian banks, and PYMNTS had set RBC beside four large US banks already turning outside agents away.

Where ten banks stand on customers' personal AI agents

Positions as each bank or its spokesperson stated them, paraphrased; US banks as PYMNTS summarised its 19 October report. Checked 30 October 2026.

No bank in the table offers outside agents an approved route, and neither RBC's notice nor Bloomberg's account of its internal memo mentions one.

Why are banks blocking AI agents?

RBC's notice of 27 October is plain about the mechanics: a personal agent needs access to the customer's online accounts and may store their passwords. RBC adds that the stakes rise as agents grow more autonomous, with risks running from fraud and consumer harm to the wider financial system.

According to PYMNTS, citing a report of 22 October, major US banks are detecting and deleting unauthorised third-party agents in customer accounts, and some appear to have tried actions the user had not requested.

RBC's internal memo, as Bloomberg reported it, warns of agents “acting beyond customer expectations or creating liability exposure.”

In an opinion piece for MIT Technology Review on 29 October, Madhulika Srikumar and Claire Leibowicz of Partnership on AI report that their team studied the four most widely used agent frameworks and found they do not reliably produce key records. Among those missing were “Agent IDs that persist over time” and which person approved an agent's task.

Put that beside RBC's point about passwords and you have our reading: an agent that signs in with a password presents the customer's credentials, with no identity of its own and perhaps no record of who approved the job.

What does a password login write in your audit log?

Every vertical SaaS product has a few writes that matter more than the rest: a payroll change on an HR platform, a court filing in a legal tool, a claim update in an insurance administration system, a shipment release in a logistics product. Each happens in a named user's session, and your audit log records that user as the actor.

Now suppose an outside agent made the change with the user's password. The log still records the user. When the payroll run is wrong or the filing goes in with the wrong exhibit, your conversation with the customer starts from a record naming a person who did not make the change.

Bank of America is writing protocols for its version of this problem, to decide “which party is liable for a payment an AI authorizes.” Swap payment for payroll run or filing and the question lands on your desk, with your log as the evidence.

An agent that signs in with your customer's password writes your audit log in your customer's name.

Why can banks afford to block AI agents?

Banks hold deposits, work inside regulation and sit behind years of switching cost. RBC's spokesperson said the decision may disappoint the small portion of clients who use these tools. Its chief executive, Dave McKay, told Bloomberg Television that RBC was considering blocking Meta's Muse agent from customer information. We read that as a contest over who stands between the bank and its customer.

You compete with AI-first challengers built around your customers' workflows, with AI-forward peers shipping agents, and with agents other people build on your own APIs. A customer told to use your app has places to go.

No source counts how many people use personal agents. We would expect them to be a small group in your base too, and the customers most likely to be weighing what comes next.

Should SaaS block AI agents, tolerate them, or give them an identity?

Only an agent identity records the agent as the actor.

Block. RBC and Citigroup took this route. A policy against outside agents is clean and enforceable on paper. The customers who want an agent get none from you.

Tolerate password logins. Outside agents keep signing in as your users. Your log keeps naming the user, your team carries the liability, and you get no product out of it.

One payroll change, as each choice records it

Give agents their own identity inside your product. Each agent acts for a named user in a named role, is scoped to what that customer granted, can be revoked by the customer, and has every run recorded as the agent. Partnership on AI asks deployers for something close: policies, permissions and roles that set out what agents can safely do. In a SaaS product, that becomes a specification your product team owns.

This third choice gives customers a sanctioned way in. It does not by itself stop password logins, so you can ship it and still set a policy on them.

Decide four things this quarter

1. Count the asks. Ask sales and support how often customers ask whether an agent can use the product, and for which tasks. Owner: the CPO.
2. Name the costliest writes. List the five writes where an agent acting as the user would cost the customer most. Owners: product, with the domain lead.
3. Set a rule for each one. For each of the five, decide whether an agent is allowed, allowed with a recorded human approval, or blocked. Owner: the CPO.
4. Choose the identity model. Before the first agent ships, decide who the agent acts for, what it may write and how a customer revokes it. Owner: the platform lead.

Where SynOS fits

SynOS installs in your cloud and runs white-labelled inside your product, so the agents your customers ask for ship under your name, and customer data, traces and models stay inside your system boundary. Each customer gets a Brain built from their own data and procedures, and their business users can build agents with the SynOS agent builder or another harness such as Claude or ChatGPT. Those agents run in the SynOS Agent Runtime. Each one has its own agent identity, acts as a named user in a named role, and can be revoked by the customer. Every run is traced step by step with its writes recorded, and each customer has a token budget with cost reported per run. If you know which workflow your customers most want an agent for, bring it and we will show it running inside your product.

Questions about customers' AI agents