After Amazon moved last month to block Meta's viral personal assistant Muse from browsing and executing purchases on its site, America's largest banks have joined the bot-wall era. Citigroup and Bank of America have formally restricted third-party AI agents from accessing customer accounts, JPMorgan Chase CEO Jamie Dimon signaled this week that his bank will enforce strict limits too, as reported by the Times of India on October 17, 2026. Money-moving agents are getting locked out of the financial system's front door — and behind the PR language sits a $1.6 trillion deposit problem that explains why.
What the banks actually said
Citigroup laid out the policy in explicit terms: the bank does not allow third-party AI agents or assistants "to log into customer accounts or conduct transactions directly within our digital banking platform," framing the block as necessary to protect account security and private financial data.
Bank of America CEO Brian Moynihan went further, describing the philosophy behind the restriction: "We feel very strongly that there should be a human involved in authorizing before money moves out of your account." He noted that lenders cannot absorb a world where customers dispute transfers after the fact, claiming an agent moved money without their full awareness. Moynihan also indicated Bank of America is working on protocols defining who carries liability when an AI-initiated payment goes wrong — the question regulators are now openly asking.
Dimon's signal this week completes the picture across the three largest U.S. consumer banks.
The $1.6 trillion reason
The banks' defensive pivot is usually narrated as a security story. The commercial one is bigger. Apollo Chief Economist Torsten Slok estimates approximately $1.6 trillion in non-interest-bearing deposits held across JPMorgan Chase, Bank of America, and Wells Fargo could be jeopardized if AI agents routinely sweep idle household cash out of low-yield accounts into higher-yielding alternatives. Low-cost deposits are the funding base banks lend against; an assistant that optimizes a household's cash automatically attacks the cheapest liabilities in banking. Slok pegs the cost of that automated migration at roughly $47 billion in additional annual interest expense for lenders.
That is the uncomfortable calculus behind the guardrails: a personal agent doing precisely its job — maximizing its user's return — erodes the deposit franchise. Protections framed as anti-fraud are, at least in part, deposit-base defense.
From cease-and-desist to standard practice
The banks' move follows the sequence retail set. Last month, Amazon implemented a technical block preventing Meta's Muse from browsing and executing automated purchases on Amazon.com, after failing to persuade Meta to voluntarily exclude Amazon from the assistant's autonomous shopping routines. That was itself a sequel: Amazon previously sent a cease-and-desist letter to Perplexity demanding it remove the e-tailer from its Comet browser's agentic integrations.
| Open-agent era (2025 — early 2026) | Bot-wall era (now) | |
|---|---|---|
| Default assumption | Agents may act wherever they can log in | Money-moving agents are blocked at the door |
| Who moved first | Assistants and startups (Comet, Muse) | Platforms with something to lose (Amazon, Citi, BofA, JPM) |
| Instrument | Rate limits, informal tolerance | Technical blocks, formal policy, human-authorization requirements |
| Open question | Will users adopt agent shopping? | Who is liable when an authorized agent errs? |
March through the coverage of Muse's launch and Amazon's block, and the striking part is how quickly "ban the agent" went from unthinkable to standard operating procedure. Citi's phrasing could be copy-pasted into any bank's policy manual by Monday.
What blocked commerce means for the agentic-web build-out
Blocking is friction, not an end state. Regulators, as the Times of India notes, have largely welcomed the banks' restrictive guardrails while acknowledging that future legislation will be required to define legal authorization standards and clarify financial liability when autonomous software executes transactions. In other words: the industry is building the door while the law decides who gets a key.
The key-manufacturing layer is already visibly forming. American Express published an Intent Intelligence Framework for trusted agentic commerce just this week (October 13, 2026), designed to capture, authenticate, and preserve customer purchase intent as agents transact on their behalf. Meta and Sierra's Personal Agent Protocol is standardizing how an agent proves the human behind it actually consented. ServiceNow's AI Passport, announced October 15, applies the same verified-credential logic inside the enterprise. And the polarization is not even universal on the retail side: while Amazon walls off, Shopify opened its catalog to any personal AI agent, betting that structured, permissioned access beats blocking.
Money will eventually move through scoped, revocable, auditable authorization rails — or it will not move at all. The banks blocking agents today are the same banks drafting the protocols for admitting them tomorrow, because Moynihan's other stated priority, defining liability for AI-triggered payments, only matters in a world where such payments exist.
What to do if you run a brand, a store, or a financial product
- Assume agent traffic is arriving whether you invited it or not. It is already default behavior on consumer devices; your logs just cannot distinguish it yet. Fix that first.
- Decide your door policy explicitly. Block like Amazon and Citi, or open like Shopify — but publish the policy, so buyers and builders know which side of the wall you are on.
- Design the agent-accessible surface for the day it opens: scoped credentials, transaction caps, human-authorization checkpoints for irreversible actions, and per-session audit trails.
- Watch the liability debate. Legislation defining agent authorization standards is coming; products designed around consent-receipts and verified agent identities will be ready for it, and products built on session tolerance will not.
Conclusion
The week of October 17, 2026 marks the moment America's largest banks made blocking AI agents formal policy rather than posture. Citigroup and Bank of America have the policies, Jamie Dimon is promising strict limits, and Amazon's block on Meta's Muse set the template. The decisive driver is not fear of fraud but $1.6 trillion in zero-cost deposits that a competent personal assistant would rationally sweep away. Yet the same week also produced Amex's Intent Intelligence Framework, consent protocols, and verified agent credentials — the rails for letting agents back in, on terms auditable enough for a regulator. The bot wall is not the end of agentic commerce; it is the intermission while the authorization layer gets built.
Deciding whether your business blocks, allows, or upgrades agent access is an architecture question. We design both sides: agent-resistant systems and agent-ready ones. Talk to us.
Read next
- AI Overviews tripled on brand searches, today's map of the branded SERP takeover.
- Bing Topics Portfolio: how to read your AI search footprint, today's guide to Microsoft's new AI visibility beta.
- CERT-In: AI agents reached live systems, undetected, today's security wake-up call for agent deployments.
- Agentic payments: fraud blind spots and controls, our earlier framework for money-moving agents.
