AI Agents in Banking: What They Can Do and Where the Risk Sits

Banks can use agents without giving them payment authority

An internal bank agent might summarise documents, assist staff, investigate patterns or prepare a case for review. A customer-facing agent might explain transactions or help complete forms. Neither role necessarily requires permission to move money.

Separating information access from transaction authority lets institutions use agentic tools while keeping the highest-impact action behind existing payment controls.

Agent-initiated payments are now a real infrastructure problem

In 2026, banks and payment companies announced production and controlled-environment demonstrations in which AI agents initiated authenticated payments through existing networks. The significance is not that AI suddenly received a bank account of its own. It is that payment systems are learning to recognise an agent as a governed participant acting under a customer's authority.

That requires a clear chain from the human identity to the agent, the mandate, the merchant and the final transaction. Without that chain, disputes and fraud become much harder to resolve.

Banking needs stronger identity than ordinary browsing

A shopping recommendation can be wrong without changing an account balance. A banking agent may see transaction history, account details or payment credentials. It therefore needs strong authentication and an identity model that distinguishes the customer, the agent and the service operating the agent.

NIST work on agent identity and authorisation reflects this challenge: software agents need identities and access controls that can be managed separately from the humans on whose behalf they act.

Fraud controls must understand delegated behaviour

Traditional fraud systems look for suspicious transactions by people and devices. Agentic payments add new normal patterns: software may compare merchants quickly, transact outside human browsing hours or execute several linked actions. Banks need to distinguish legitimate delegated activity from compromised or manipulated agents.

That makes transaction context useful. A payment that matches a pre-authorised mandate, merchant and amount is easier to trust than an unexpected purchase made by an agent with broad credentials.

Customer service agents still need escalation boundaries

A bank may use AI to answer questions, collect information or guide customers through standard processes. Sensitive complaints, vulnerable customers, suspected fraud and unusual account restrictions require more careful handling. The system should know when to transfer responsibility rather than improvise a confident answer.

The human role can therefore move toward exceptions and oversight even as routine interactions become automated.

Never give a general-purpose agent unrestricted bank access

For personal use, broad authenticated access to the primary financial account creates an unnecessary blast radius. If a service supports delegated payment controls, prefer narrow mandates, low limits and explicit approval for new payees or large amounts. Keep bank alerts independent of the agent.

An agent that needs to analyse spending may only need read access. An agent that prepares a transfer can stop before authorisation. Separate those functions instead of granting the maximum capability at the beginning.

Disputes need an audit trail humans can understand

If an agent buys the wrong item or transfers the wrong amount, the customer, merchant and bank need to know what instruction was given and what authority existed. Logs and signed mandates make that reconstruction possible. A natural-language conversation alone may be too ambiguous for a financial dispute.

Good systems should preserve the important evidence without forcing the customer to understand the model's internal reasoning. The practical question is what was requested, approved and executed.

The safe future is constrained autonomy, not invisible autonomy

Banking can benefit from agents that prepare work, monitor conditions and execute routine authorised actions. The risk rises sharply when the system can expand its own scope, create new payees, change security settings or move large sums without independent approval.

For households, the useful rule is straightforward: keep the bank's own authentication and alerts in the loop, grant the agent only the transaction authority needed and make unusual financial actions stop for a human.

Read-only financial analysis is a lower-risk starting point

An agent can categorise spending, explain recurring charges or prepare a budget without having authority to transfer money. That separation is useful because the information value can be tested before the household delegates any transaction rights.

If write access is later added, keep it task-specific. Paying a known bill below a limit is different from creating a new beneficiary, changing contact details or moving savings. Those actions should not inherit the same approval rule.

Social engineering can target the agent as well as the customer

A malicious message or webpage may try to influence an agent that can see financial information or initiate actions. Banking workflows should therefore treat external text as untrusted input and prevent content from silently expanding permissions or overriding payment controls.

For consumers, independent bank notifications remain valuable. A transaction alert from the bank creates a separate signal that something happened, even if the agent's own conversation history is incomplete or manipulated.

Keep recovery outside the agent

Do not make the same agent the only route to passwords, recovery codes, bank contacts or identity documents. If the agent account fails, is compromised or simply becomes unavailable, the user still needs a direct route to the financial institution.

Store critical recovery information through the bank's normal secure channels and know how to revoke delegated access without relying on the agent itself.

New payees should be treated as a separate security event

Paying a known bill is different from creating a new beneficiary or changing the destination of funds. Keep new payees, security-setting changes and unusually large transfers behind the bank's strongest independent approval step, even when routine payments are delegated.