Everything About AI
NextFin News - Citigroup has become the latest major U.S. bank to restrict artificial-intelligence agents from accessing customer accounts, tightening controls after JPMorgan Chase and Charles Schwab took similar positions. Chair and CEO Jane Fraser said AI agents should not be allowed to move from providing information to executing transactions until their identity, authentication, and oversight can be guaranteed - a stance that closes off the one action that makes agentic AI valuable to consumers, the ability to move money on a user's behalf.
Until then, I am confident I won't have wild agents without the right controls in place.
Fraser delivered the line at Sibos 2026 in Miami, where she opened the conference's plenary session. Inside Citi, that control function already has a name: ARC, a governance and observability layer through which every agent must pass before it can be created. The message to the fintechs and big-tech firms building autonomous assistants is that the door to the account will not open on their terms.
The timing is deliberate. In September, shares of JPMorgan Chase, Wells Fargo, Schwab, and other lenders came under pressure after Meta's Muse agent topped app download charts, reviving a fear that has haunted banks since the first personal AI assistant appeared: that autonomous software will do what human customers rarely do, and sweep idle cash from near-zero checking accounts into whatever pays the most. The banks' response - block the outside agents, then build their own - is less a technology decision than a defense of the deposit franchise.
What the Restriction Blocks, and What It Does Not
Citi's position follows a nearly identical stance taken by JPMorgan Chase on its third-quarter earnings call.
We're not going to allow just any ... outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan.
Jamie Dimon, the bank's CEO, told analysts. A company spokeswoman confirmed the bank currently blocks external AI agents from operating on behalf of retail customers: "Protecting our customers is our top priority. Because it is not safe, we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf."
The distinction matters. Under the policies described by both banks, an agent can still read some account data through open-banking connectors such as Plaid, provided the customer has handed over credentials. What it cannot do is send money or pay a bill - the actions that transform a chatbot from a conversational tool into a financial actor. In practice, the banks are drawing a line between reading the balance and acting on it, and allowing only the former.
Fraser's framing at Sibos was broader than a single product rule. Authentication, she said, is one of the issues that "keeps us all up at night." The problem is not whether an AI model can hold a conversation, but whether the bank - and every other participant in a transaction - can verify that the agent is genuinely acting on behalf of the person it claims to represent.
If you move fast and break things, we are failing in our mandate.
she said, explicitly rejecting the tech industry's old axiom. "If we break trust, it is a huge problem for the macro, for the markets, for everywhere."
Inside Citi, the answer is ARC. "You cannot create an agent without going through ARC," Fraser said. The design inverts the traditional supervision model: where a manager might once have overseen nine employees, a single agent may now face nine separate oversight mechanisms, many of them run by other agents. Fraser conceded the controls are immature - "It is very early days in those controls, as we can all see" - but the direction is clear. The bank is treating agent governance as infrastructure, not as a compliance afterthought.
Why the Deposit Franchise Is the Real Stake
The urgency behind the restrictions is economic, not merely cybernetic. U.S. banks have profited for decades from customer inertia - the simple fact that most people leave checking balances sitting at rates near zero while the bank lends that money at much higher yields. Agentic AI attacks that inertia directly. An autonomous assistant does not feel the friction of opening a rival app, comparing rates, or initiating a transfer. It can do all three in seconds, on command, for millions of users at once.
Torsten Slok, chief economist at Apollo, put the arithmetic plainly: agents "could soon sweep household cash automatically into accounts paying 3.3% to 5.0%, instead of the 0.1% national average on checking accounts." If every household optimized the return on its cash balance, banks would lose a large share of the cheap deposits they rely on to fund loans. The threat is not that customers leave; it is that software leaves for them, at machine speed, with no loyalty and no inertia to slow it down.
The market priced that logic in September, when bank stocks logged some of their steepest single-day declines in months as Meta's Muse climbed the download charts. The selloff was not about any actual deposit outflow - none had occurred. It was about the repricing of an assumption baked into bank valuations: that deposits are sticky. Agents make them unsticky. Citi's average deposits were $1.5 trillion in the third quarter, up 11% from a year earlier, and the bank reported its best third-quarter revenue in a decade at $23.8 billion. The disconnect between strong fundamentals and a nervous share price is the deposit-franchise risk, made visible.
This is why the banks are not simply saying no to agents. They are racing to build their own. JPMorgan has begun a targeted pilot of Smart Cash, a tool that predicts a user's cash flow and moves funds to maximize yield - effectively a defensive agent designed to keep the optimization inside the bank's walls. Citi, for its part, is deploying AI aggressively on its own side: 14,000 engineers use its main agentic coding tool, a move management said has cut technology vendor spend 30% year over year, and AI-powered client-service agents are live in 82 countries, improving response times by 21%.
The pattern is consistent: automate the back office, restrict the front door. Banks want the productivity gains of agentic AI without ceding the customer relationship to an outside model.
The Regulatory and Cyber Dimension
The banks' caution is reinforced by regulators and international bodies. At the same Sibos session, Dan Katz, First Deputy Managing Director of the International Monetary Fund, placed cyber risk "at the top of the list" of AI-related threats. AI, he said, is transforming cybersecurity by accelerating the speed, frequency, and scale with which vulnerabilities can be detected and exploited. Fraser agreed, describing a "tsunami of patches that need to be applied right now" and calling cybersecurity one of the great challenges of the new technological era.
The legal environment is hardening as well. In 2026, U.S. courts began applying computer-access statutes to AI systems that act on a user's behalf, including a preliminary injunction against an AI company found to have accessed a platform's systems without authorization after a cease-and-desist letter. For banks, which operate under stricter access and liability regimes than retailers, the lesson is straightforward: an agent acting on a customer's behalf does not automatically inherit the customer's authorization in the eyes of the law.
Dimon drew that line explicitly on liability: "If people are using them, they should understand the risk. They should understand there's a liability transfer." In other words, if a customer authorizes an outside agent to move money and something goes wrong, the bank intends to make clear where its responsibility ends. That is a powerful deterrent - for customers, for agents, and for the banks themselves.
Cyclical Scare or Structural Shift?
The central question for investors is whether the bank stocks' September wobble was a cyclical scare trade or the first pricing of a structural change. The evidence points to both, operating on different clocks.
In the short run, the deposit-flight fear is cyclical and, so far, unproven. Consumers have not actually moved their money en masse. Citi's deposits grew 11% year over year to $1.5 trillion, and the bank's third-quarter net income rose to $5.2 billion, with earnings per share of $2.85 and a return on tangible common equity of 11.5%, up 180 basis points from a year earlier. The fundamentals are not breaking. What broke was sentiment, and sentiment reverts when the feared outflow fails to materialize.
But the long-run driver is structural, and it does not revert on its own. The friction that has protected bank deposits for a century - the hassle of switching, the opacity of rates, the simple inertia of doing nothing - is being engineered away. Once agents can act on a user's behalf with reliable authentication, the economics of household cash change permanently. The banks know this, which is why they are not waiting for the outflow to begin before building their defenses. They are building the defenses so the outflow never happens in a form they cannot monetize.
The strongest counter-thesis is that banks are overreacting - that regulation, consumer trust in big tech, and the sheer complexity of financial decisions will keep agents on the sidelines for years. Schwab and JPMorgan have already blocked unauthorized agents, and no major lender has opened the door to outside action. If the technology stalls - if authentication proves unsolvable, or if consumers refuse to hand their banking credentials to an autonomous assistant - then today's restrictions will look like a costly overreach that ceded the user experience to nimbler fintechs.
That counter-argument carries weight, but it rests on a fragile premise: that the authentication problem stays unsolved. Citi's ARC layer, and similar systems under construction at peers, are aimed precisely at that gap. The falsifying signal is concrete: if, twelve months from now, no major U.S. bank has enabled authenticated, agent-initiated payments through a controlled interface, and the rate banks pay on household checking remains near the current national average of 0.1%, then the structural-threat thesis is wrong and the restrictions were a panic. If instead one or two large banks launch verified agent-payment rails and measurable balances begin migrating to higher-yield venues, the current blockade will be seen as the opening move of a structural realignment.
What Comes Next
Three scenarios frame the path ahead. In the base case, banks keep outside agents blocked while rolling out their own agent tools - the JPMorgan Smart Cash model - inside a walled garden. Deposits stay put, productivity gains accrue to the banks, and the September selloff is remembered as a scare trade. In the upside case for banks, authenticated agent rails launch successfully, the banks capture the optimization flow themselves, and the agent era becomes a retention tool rather than a threat. In the downside case, authentication holds but consumer trust in bank-owned agents does not; users find workarounds, deposits migrate to higher-yield venues, and funding costs rise faster than banks can reprice loans.
For the near term, the watch items are specific: whether any of the large U.S. banks announces a timeline for allowing authenticated outside agents; whether the IMF and U.S. regulators move from questioning banks about agent shutdown plans to issuing formal guidance; and whether Meta's Muse - or OpenAI's Dots, released weeks later - converts download popularity into actual deposit movement. Citi's full-year guidance, raised to a return on tangible common equity above 11%, assumes the base case holds.
The deeper shift is that banking is becoming an identity-and-control business as much as a credit business. Citi moves roughly $6 trillion every day; as transaction volumes rise with AI adoption, the bank's bet is that resilience and trust travel together. "Let's do it safely, securely, and fast," Fraser said. The industry has chosen safely and securely first. Fast will come later - and only on the banks' terms.
The banks are not afraid of AI. They are afraid of an AI they cannot authenticate, cannot audit, and cannot stop - and until that changes, the door to the account stays locked.
Explore more exclusive insights at nextfin.ai.
