The Banks Aren’t Just Afraid of Rogue AI Agents. They’re Afraid of What Good AI Agents Might Do.

Key takeaway

The largest US banks are not only worried that AI agents will misbehave. They are worried that agents will behave exactly as customers want, sweeping idle cash out of accounts paying about 0.1% into accounts paying 3.3% to 5%, across hundreds of thousands of households at once. That risk breaks no rule and trips no permission check. It shows up as a pattern in deposits, competitor pricing, rates and agent adoption. Governing it takes continuous reasoning: watching whether the conditions behind a decision still hold, and knowing when enough has changed that leadership needs to act.

Five things to know

• A well-behaved AI agent can still create material business risk. An agent acting with full customer authorization can improve that customer’s position while eroding a bank’s cheapest source of funding.
• Traditional AI governance is necessary but incomplete. Permissions, evaluations, audit trails and policy controls govern what an agent can do. They do not explain the combined business consequence of what agents decide to do.
• AI changes the speed and scale of ordinary decisions. Thousands of individually reasonable actions can add up to an outcome that matters to an entire institution or market.
• The governance question is shifting from “Did the AI follow the rules?” to “Is this still the right decision?” That requires connecting market, regulatory, competitive and internal signals as they change.
• This is the layer Polaris I/O was built for. Polaris I/O connects signals into developing patterns and decision-ready context, so leaders know what is changing, why it matters and when the response should change.

The $100,000 decision that could change banking

Imagine waking up tomorrow and finding that your AI financial assistant has found a better home for your money.

You have $100,000 sitting in a checking account earning almost nothing. Your agent compares alternatives and finds an account paying 4%. With your explicit authorization and the right safeguards, it moves the money.

You earn thousands more in interest. The agent did exactly what you asked. No hallucination. No unauthorized transaction. No broken instruction.

From your side, it was an excellent decision. From your bank’s side, it just lost $100,000 in deposits.

Now run the same decision across hundreds of thousands of accounts in the same month.

What looks like a good decision for one customer can become a strategic problem for an entire bank.

This is an illustrative scenario, not a claim that agents have already executed these transfers at scale. But this week the largest banks in the country started acting as if they might.

Why are Citi, Bank of America and JPMorgan blocking AI agents?

On Tuesday, October 13, JPMorgan’s Jamie Dimon told analysts on the bank’s third-quarter call, “You don’t want rogue agents, and there could be thousands of them” (Benzinga). CNBC reported the same day that JPMorgan already blocks outside agents like Meta’s Muse from operating retail customer accounts (Let’s Data Science, citing CNBC).

Three days later, on Friday, October 16, the Financial Times reported that Citigroup and Bank of America have restricted third-party AI agents from accessing customer accounts too. Citi says it does not allow outside agents or assistants to log into a customer’s account or transact directly on its digital banking platforms, a policy it frames as protecting accounts and customer information (Traders Union).

Bank of America CEO Brian Moynihan was direct about the line he is drawing: a human should be involved in authorizing money before it leaves an account (NewsBytes). His bank is holding its restrictions while it works out who is liable when an AI initiates a payment (OnInvest).

Those are legitimate security and consumer protection concerns. But read the coverage closely and a second motive sits right next to them. Banks fear deposit outflows driven less by AI mistakes than by AI making prudent decisions on customers’ behalf (OnInvest).

The signals that led here

This did not come out of nowhere. The pattern has been building since early September.

• September 8: Meta launched Muse, a personal AI agent that can shop, book and pay on a user’s behalf. Within a week it was the top free app in Apple’s US store (Shelly Palmer). According to Crypto Briefing, Muse does not initiate bank transfers today. It observes (Crypto Briefing).
• September 22 and 23: Bank stocks sold off as Muse climbed the app charts. JPMorgan and Wells Fargo each lost more than 3% for the week (TIKR).
• Late September: Amazon blocked Muse from shopping on Amazon.com, saying Meta never notified it and the agent did not identify itself while browsing (Retail Gazette). Shopify went the other way and opened Shop Pay to Muse transactions (TechRepublic).
• September 27 and 28: Apollo’s Torsten Slok warned in a note titled “Is an Agentic Bank Run Coming?” that agents like Muse could speed deposit flight from banks (Crypto Briefing).
• October 8: The FT reported that JPMorgan, Bank of America and Wells Fargo hold about $1.6 trillion in deposits that pay no interest, money that stays put mainly because moving it takes effort (PYMNTS).
• October 13: On JPMorgan’s third-quarter call, Jamie Dimon warned of “rogue agents,” and CNBC reported that the bank already blocks outside agents from operating retail customer accounts.
• October 13: On Wells Fargo’s third-quarter call, Charlie Scharf said the bank will evaluate how third-party models and agents can add value for clients while weighing the risk those tools create for clients and for the bank (CNBC).
• October 16: Citi and Bank of America restrictions reported by the Financial Times.

That is Signal Escalation playing out in public. One agent launch is a signal. A retailer block, an economist’s warning, a stock move and a deposit count become a pattern. A pattern that threatens the cheapest funding in the banking system becomes a decision.

Why the deposit math matters

Most checking accounts pay about 0.1%, while the accounts an agent could move money into pay roughly 3.3% to 5%, according to Apollo’s Torsten Slok (Traders Union). Customers have always had that choice. What kept the money in place was friction: noticing, comparing, logging in, moving funds and moving them back before bills came due. An agent removes all of it.

The effect does not need to be dramatic to matter. McKinsey’s 2025 banking report estimates that if just 5% to 10% of checking balances migrated to top-of-market rates, deposit profits across the global banking industry could fall 20% or more (American Banker).

Not everyone agrees on the size or the speed

That disagreement is important. Fitch’s Mark Narron describes AI-driven deposit movement as an acceleration of an existing competitive trend rather than a new kind of banking risk, and many analysts expect consumers to stay cautious about handing an agent control of their money (CU Today). Citi’s own European bank analyst expects trust and regulation to limit third-party agents and push banks to build agents into their own apps instead (PYMNTS). JPMorgan is building its own answer, a tool called Smart Cash that aims to move client money automatically between checking accounts and higher-yielding brokerage products (PYMNTS).

Good governance should not start by assuming the worst case. It should define the evidence that would make the worst case more or less likely, and then watch for it.

That is the difference between monitoring and continuous reasoning.

The AI did nothing wrong. So what is the governance problem?

Most AI governance programs start with the right questions. Which models are approved? What data can they reach? What actions can an agent take, with what permissions? Is the activity logged? Can unauthorized behavior be blocked?

Those controls are essential, and the banks are leaning on them hard. Citi has described an internal platform, ARC, that it requires for monitoring and governing all of its own AI agents, and its leadership has stressed identity verification for any agent before it can transact (Crypto Briefing).

Now go back to the $100,000 transfer. An agent could pass every one of those checks, with valid authorization, an approved workflow, a complete transaction record and a verified identity. And the combined impact of hundreds of thousands of similar transfers could still be significant.

The harder problem is whether the organization understands what those actions mean inside an environment that keeps changing. That raises a different set of questions:

• What is the agent trying to accomplish, and for whom?
• Who benefits from its decision, and who absorbs the consequence?
• What happens when the same decision repeats across thousands of customers?
• Which market or regulatory developments would change the right response?
• When does a developing pattern become important enough to act on?

We made a version of this point earlier this month in Signing Is the Easy Part. An approval is a snapshot. The risk lives in everything that happens after it. A bank can approve an agent’s access on day one and still be blindsided by what that access adds up to on day ninety.

These questions move governance beyond compliance and technical control. They connect AI behavior to business judgment.

One good decision is not the same as one million good decisions

For a single customer, moving idle cash to a better account is perfectly reasonable. The trouble starts when the same reasonable decision spreads.

At first it looks routine. A few more transfers. Slightly higher deposit movement. More interest in savings products. Then the pattern shifts. Competitors sharpen their offers. More customers switch on automated optimization. A rate move makes a different set of accounts attractive. The assumptions a bank built its funding plan on stop holding.

No single decision was wrong. The meaning of the decisions changed once they became a pattern.

This is the problem we called Signal Escalation in AI Governance Has a Threshold Problem. A single event is a signal. Related events become a pattern. A pattern becomes consequential when its scale, velocity and potential impact justify a different decision. In The Hero Isn’t the AI we described the same mechanic as stacking signals: no single signal has to be the smoking gun, because the intelligence lives in the pattern underneath them.

Applied to agent-driven deposit movement, the five escalation levels look like this:

What does continuous reasoning look like in practice?

Monitoring tells you what happened. Continuous reasoning connects new information to existing assumptions, judges what is changing, and flags when an earlier conclusion needs to be revisited. Here is how one week could play out at a bank.

Monday: everything looks normal. Agents begin recommending higher-yielding alternatives to some customers. Activity is limited. No business response is needed.

Tuesday: a pattern begins to form. More customers are comparing rates and authorizing transfers. A competitor announces a more aggressive savings offer. Each signal is explainable on its own. Together they suggest customer behavior is shifting.

Wednesday: the economics move. The pattern starts to touch deposit retention and funding assumptions in specific segments. The question is no longer whether individual transfers were authorized. Leadership needs to know which segments, products and competitive positions are exposed.

Thursday: a decision is made. Management weighs changes to customer offers, retention strategy, risk controls or agent access policy. The response has to balance customer interest, regulatory obligation, financial impact and competitive position.

Friday: the world changes again. A competitor reprices. New guidance arrives on agent authorization and liability. Customer behavior stabilizes, accelerates or moves toward a different product. Thursday’s decision may need to change.

The intelligence cannot stop just because a decision has been made.

That is continuous reasoning. The goal is an evidence-based view of which developments matter, what they affect and when conditions justify a different response, without trying to predict every outcome. As we wrote in AI Does Not Eliminate Belief. It Industrializes It., the danger is holding onto yesterday’s answer after the evidence has moved.

Where does Polaris I/O fit in AI governance?

AI governance platforms provide valuable controls: model inventories, permissions, approvals, runtime activity and audit evidence. Those should stay in place. What they rarely capture is the world the AI is making decisions in.

A bank does not operate in isolation. Rates move, competitors launch products, regulators issue guidance, and customer behavior evolves. Now AI agents, some the bank controls and many it does not, add another fast-moving source of change.

Polaris I/O is built to connect that outside world. Signal Monitoring tracks relevant developments across markets, organizations, financial conditions and regulation. The Pattern Engine connects isolated developments into emerging situations. Decision Activation helps teams understand the implications and decide what to do next.

The opportunity in AI governance is to combine that continuous external intelligence with an organization’s own AI inventory, agent activity, policies and decision records. Together they give leadership something neither provides alone: a view of consequential AI decisions in context.

Declared authority versus observed consequence

In Signing Is the Easy Part we separated declared authority, what policy says an AI may do, from observed authority, what it can actually accomplish. The banking story adds a third layer: observed consequence. Citi still permits limited, read-only access to account data through certain open banking providers (OnInvest). A read-only agent can still tell a customer exactly where to move their money. The declared authority is narrow. The consequence may not be.

The five-step operating model, applied to a bank

This builds on the framework Polaris I/O Strategic Advisor Peter Sondergaard, former head of research at Gartner, laid out in Governing the Autonomous Organization: See it, Spot it, Steer it. We added Escalate it and Prove it to make it operational.

• See it: what is changing? Track deposit offers, rates, regulatory guidance, customer behavior and agent activity, inside and outside the bank.
• Spot it: what pattern is forming? Decide whether isolated signals add up to a material change in conditions. Knowing which developments are connected matters more than generating more alerts.
• Escalate it: when does the pattern matter? Weigh impact, urgency, confidence and the decision authority required. Some changes need watching, some need investigating, and a few justify intervention.
• Steer it: what should leadership do? Put the evidence, affected business areas, response options and tradeoffs in front of the people accountable. Decisions touching customer accounts, regulatory obligations or material financial exposure stay under organizational controls and human accountability.
• Prove it: what happened, and why? Preserve the evidence, assumptions, decisions and what followed. Keep testing whether the decision still holds.

The goal is to understand what an AI agent’s actions mean in a world that keeps changing.

One boundary matters. External intelligence does not enforce banking permissions, execute transfers or replace operational risk systems. Those functions need the right connected controls and integrations. Polaris I/O provides the changing business context and Decision Intelligence that those systems alone do not capture.

The new governance question: is the decision still right?

This is not only a banking story. Amazon blocked Meta’s Muse from shopping on Amazon.com too. Amazon’s stated reasons were that Meta never notified it and the agent did not identify itself. Adweek’s read is that a shopping agent that compares and buys on the customer’s behalf also bypasses the browsing, personalization and advertising Amazon’s economics depend on (Adweek). Either way, the agent was doing its job.

The same shape shows up everywhere agents act:

• A procurement agent picks the lowest-cost supplier. A new geopolitical development makes that choice far riskier, the kind of hidden concentration we traced in Technology Is Not Capability. Capability Is a System.
• An insurance agent prices a policy correctly under one set of conditions. New climate, legal or market information changes the risk.
• A public sector assistant answers in line with approved policy. Then the policy changes.
• A corporate strategy agent recommends a market that looked attractive last month. New competitive or regulatory evidence undercuts it.

In each case the agent works exactly as designed, and the failure is a missed change in the conditions behind the decision.

That is why AI governance has to be more than an approval process. The NIST AI Risk Management Framework treats risk management as continuous across the AI lifecycle, organized around Govern, Map, Measure and Manage. As we argued in America Cannot Govern AI at the Speed of Bureaucracy, the answer to fast-moving AI is not less governance. It is governance that runs continuously.

Governance keeps running after a system is approved, while the system operates and the world changes around it.

Five questions every board should ask about AI agents

The banks’ decision is a useful starting point for any board. Before agents make or initiate consequential decisions, leadership should be able to answer these in writing.

• What decisions are our AI agents authorized to make? The scope of autonomy, permissions, approval requirements and potential financial or operational impact.
• What could happen even if the agents behave exactly as intended? How individually reasonable actions could add up to effects on customers, revenue, liquidity, suppliers or regulatory obligations.
• What outside developments would make those decisions wrong? The market, policy, financial, competitive and organizational assumptions the decisions depend on.
• How will we know when those assumptions change? Continuous monitoring, evidence-based reasoning, escalation thresholds and accountable review.
• Can we explain what happened, why, and whether the outcome justified it? Decision records, provenance, oversight and the ability to revisit or correct a decision.

Question two is the one the banks are answering right now, under pressure. Question four is the one most programs have not answered at all. These questions give AI governance an executive purpose. They connect technical control to economic, strategic and operational accountability.

The next frontier is better decisions

The banks restricting third-party agents are confronting a technology that can act for customers, reshape financial behavior and speed up changes to a business model that has worked for decades.

Security, authorization and consumer protection all matter. But the harder problem is the decision that is technically permitted and economically rational, and still wrong for the institution once you see it at scale.

That takes a new level of continuous business intelligence: seeing relevant change, connecting developments that look unrelated, recognizing the pattern as it forms, knowing when the implications turn significant, supporting an accountable response, and reasoning again when new evidence arrives.

The most important AI governance question may no longer be “Did the AI follow the rules?”

It may be “Given everything that has changed, is this still the right decision?”

That is where Decision Intelligence becomes essential. The world does not stop changing when an AI makes a decision. Neither should the reasoning behind it.

See what your agents’ decisions add up to

What would happen if your AI agents made a thousand perfectly authorized decisions tomorrow? Would you see their combined consequence? Would you know when market or regulatory conditions called for a different response? Could leadership explain what happened, why it mattered and what was done?

Polaris I/O connects signals, identifies developing patterns and puts decision-ready context in front of the people accountable for the call. Schedule a demo to see continuous Decision Intelligence applied to AI governance.

See it. Spot it. Escalate it. Steer it. Prove it.

Nothing gets by you.

Frequently asked questions

Why are Citigroup and Bank of America blocking AI agents from customer accounts?

According to Financial Times reporting on October 16, 2026, Citi does not allow third-party AI agents to log into customer accounts or transact on its digital banking platforms, and Bank of America is restricting agent access while it sets rules for liability on AI-initiated payments. The stated reasons are security and customer protection. Coverage also points to a strategic concern: agents automatically moving low-interest deposits into higher-yielding accounts.

Is JPMorgan also restricting AI agents?

Yes. CNBC reported on October 13, 2026, that JPMorgan blocks external agents such as Meta’s Muse from operating retail customer accounts. On the bank’s earnings call, CEO Jamie Dimon said, “You don’t want rogue agents, and there could be thousands of them.”

Could AI agents cause deposit flight from banks?

They could accelerate it. Most checking accounts pay about 0.1% while alternatives pay roughly 3.3% to 5%, and agents remove the effort that kept money in place. McKinsey estimates that if just 5% to 10% of checking balances moved to top-of-market rates, deposit profits across the global banking industry could fall 20% or more. Fitch and other analysts see it as an acceleration of existing competition rather than a sudden run risk.

How can an AI agent create risk without breaking a rule?

An authorized agent can make individually sensible decisions that add up to an unexpected aggregate effect. Thousands of customers moving deposits with agent help could raise a bank’s funding costs even though every transfer was approved.

What is AI governance for autonomous agents?

It is the oversight of agent authorization, model and system risk, data access, permitted actions, monitoring, accountability and the consequences of AI decisions across the system lifecycle.

What is continuous reasoning in AI governance?

Continuous reasoning is the ongoing work of connecting new evidence to existing assumptions, judging the consequences of emerging developments, and identifying when an earlier decision should be reconsidered.

How is Decision Intelligence different from AI monitoring?

Monitoring observes events and system behavior. Decision Intelligence connects those events to business context, emerging patterns, implications and choices, so organizations know what deserves attention and what action may be appropriate.

What is Signal Escalation?

Signal Escalation is the discipline of deciding when individually minor signals, taken together, form a pattern serious enough to require a decision. Polaris I/O describes five levels: Normal, Watch, Investigate, Intervene and Escalate.

How can Polaris I/O support AI governance?

Polaris I/O provides continuous monitoring of relevant external and connected data, signal identification, pattern detection and decision-ready context. Integrated with an organization’s AI activity, permissions and governance systems, it can help assess how changing conditions affect consequential AI decisions. Integrated use cases depend on data access, integrations and deployment.

Does continuous reasoning replace human approval?

No. It supports decisions and reassessment with timely evidence and context. Human approval, regulated decision processes and technical enforcement controls remain necessary where they apply.

Related Polaris I/O reading

This post builds on earlier Polaris I/O work on continuous AI governance.

• Peter Sondergaard, Governing the Autonomous Organization. The whitepaper that frames the AI governance gap as a visibility gap and introduces See it, Spot it, Steer it.
• The Hero Isn’t the AI. It’s the Person Who Knows What to Do Next. Stacking signals and why continuous reasoning gives decision makers lead time.
• AI Does Not Eliminate Belief. It Industrializes It. Why AI can harden outdated assumptions, and why outside evidence has to keep testing them.
• America Cannot Govern AI at the Speed of Bureaucracy. Why governance has to run continuously instead of acting as a one-time approval gate.
• AI Governance Has a Threshold Problem. Signal Escalation, the five escalation levels and the five-step operating model.
• Signing Is the Easy Part. Continuous Assurance, and the gap between declared and observed authority.