Banks have an agent problem. Here is the control that answers it.

In ten days, five of the largest US financial institutions restricted outside AI agents. In the same window, the Federal Reserve, the OCC and the FDIC started asking banks four questions about agents. This week Anthropic opened a research preview of Claude Duet, a personal agent that waits for the user's approval before it makes a payment, pays with a virtual card, and will not move money between accounts even with approval. Approval on the agent's side is arriving in consumer agents. The bank on the other end of the transaction still needs its own.

Regulatory references verified as of October 23, 2026.

What the banks are facing

JPMorgan Chase said on October 13 that it will not allow outside AI agents inside the company. Charles Schwab said on October 16 that it is not allowing agents that act on a client's password to move money. On October 22, Axios reported Morgan Stanley, Bank of America and Citi detecting unauthorized third-party agents in customer accounts, some of them reaching call centers, with Morgan Stanley blocking them.

Reuters reported the regulators' questions on October 13. Can agent decisions be tracked and audited? What stops an agent exceeding its authority? Do humans remain involved in key decisions? Can an agent be shut down?

Our earlier post, The agents banks can block, and the ones they cannot, sets out the problem. A block catches the agent that announces itself. A login proves a credential and nothing about authority. Agent traffic splits into a population that cooperates with protocols and one that never identifies itself. Under Regulation E, a transfer by someone the consumer gave the access device to is not unauthorized (12 CFR 1005.2(m)(1), verified October 23, 2026), so the customer carries the loss. The control that covers both populations sits at the action.

Owned intelligence, governed from the first call

Banks are deploying their own agents, on their own data, with their staff's delegated authority. Enterprises will rent some intelligence and own more of it. The regulators' four questions land on those agents first, because they are the ones the bank answers for.

APERION's Smartflow is an on-premises control plane that sits in the path between a bank's agents and the models and tools they call. It runs on the bank's infrastructure, including air-gapped. Here is what it does today, mapped to the four questions.

Can agent decisions be tracked and audited? Every decision produces one record: the agent's key, the action and its arguments, the policy that applied, the approver and the time. Records are hash-chained, and every sealed record carries an RFC 3161 timestamp. Smartflow exports to Splunk, Datadog, OTLP and JSON logs a SIEM can ingest. The record is the bank's, inside the bank's walls.

What stops an agent exceeding its authority? Each agent gets its own key, with allowlists for the models and routes it may use. Every model call and MCP tool call routed through Smartflow is checked against those allowlists and the bank's policy. Its MCP gateway can front the MCP servers the bank's agents call, so tool rules apply to every tool call that passes through it.

Do humans remain involved in key decisions? When an action is outside policy, it pauses as an approval ticket. A person with approval rights approves or denies it, and the bank can require that person to step up and re-verify their identity first. The agent proceeds only on approval. A ticket is redeemed once and expires after 24 hours if no one answers. The bank decides where the line sits: reading a balance passes and is recorded; moving money pauses.

Can an agent be shut down? An agent that runs on its own key, through one control point, gives the bank one place to act on it, and one record of everything it did before it stopped.

This is the proof that follows. An agent tried to wire $50,000 nobody approved. The amount exceeded the authority delegated to the agent. The action paused and went back to the person whose authority the agent was using, who decided with proof they were there. The accountable human decides, and the record shows who decided, when and under which policy.

The agents that call the bank

Agent traffic that comes to a bank through its own APIs and MCP servers can be put on the same footing. Smartflow can serve as the control point in front of those servers, so a call from an outside agent meets the same scope check, the same approval step and the same record as a call from an agent the bank runs. The cooperating population, the agents that arrive through a protocol and present a signed statement of what the customer approved, belongs here.

Closing the browser gap

On today's web and mobile channels, a customer's agent driving the customer's own browser meets one checkpoint, the login, and passes it. Nothing on that channel evaluates the actions that follow.

That changes when the bank moves the channel. A bank that retires its legacy web and mobile back ends and serves customers through MCP-enabled apps and sites can route every customer action through one control point, whether a person typed it or an agent drove it. With Smartflow on that path, the browser stops mattering. A balance read passes and is recorded. A transfer pauses, and the step-up prompt goes to the account owner, who decides.

One condition. The step-up has to be one the agent cannot answer for the customer. A one-time code the agent can read from the customer's messages or password manager proves nothing new. The bank chooses the check, and the answer has to come from the person.

Read-only access is the first version of this control. It will not be the last.

Why now

The questions are being asked bank by bank, in writing and in conversation, without a published standard. Supervisory guidance on model risk, SR 26-2, places generative and agentic AI outside its own scope (attachment footnote 3, April 17, 2026). The answers have to come from controls the bank runs, on traffic the bank sees, with evidence the bank keeps.

APERION is in production with a global insurance and financial-services leader.

A verified person, the authority that person delegated, the agent that used it, the policy that applied, the decision and the record of all of it. That chain is the product.

Watch the four-minute version: Banks Are Blocking AI Agents. Here Is the Agent They Cannot Block.

Talk to APERION

Sources

• Anthropic, "Claude Duet," October 21, 2026 (research preview; approval before a message, payment, signature or deletion; purchases through Link pay with a virtual card): https://claude.com/resources/articles/claude-duet. Opened October 23, 2026.
• Axios, "Scoop: Unvetted AI agents are accessing U.S. bank accounts," Madison Mills, October 22, 2026: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access. Opened October 23, 2026.
• Fortune, "'You don't want rogue agents': Jamie Dimon bars outside AI agents like Meta's Muse from JPMorgan accounts," October 15, 2026: https://fortune.com/2026/10/15/jamie-dimon-ai-agents-meta-muse-jpmorgan/. Opened October 23, 2026.
• The Next Web, "Schwab and JPMorgan are blocking AI agents from moving customer money," October 16, 2026: https://thenextweb.com/news/schwab-blocks-ai-agents-meta-muse. Opened October 23, 2026.
• Reuters exclusive, "Banking watchdogs ramp up AI scrutiny as stability fears mount, sources say," October 13, 2026 (syndicated copy): https://www.cp24.com/news/world/2026/10/13/banking-watchdogs-ramp-up-ai-scrutiny-as-stability-fears-mount-sources-say-reuters-exclusive/. Opened October 23, 2026.
• Regulation E, 12 CFR 1005.2(m)(1), definition of unauthorized electronic fund transfer. Verified October 23, 2026 on eCFR.
• Federal Reserve SR 26-2, April 17, 2026, attachment footnote 3. Re-checked October 23, 2026.
• APERION, "The agents banks can block, and the ones they cannot," October 23, 2026: https://aperion.ai/blog/agents-banks-can-block/.