Following similar developments in the United States, major Canadian banks are restricting third-party personal AI agents. Meanwhile, new banking regulations and payment technologies are changing how financial applications can access customer information and carry out authorized transactions.
On October 25, TechiesJournal examined reports of AI agents accessing U.S. bank accounts, including restrictions described by JPMorgan Chase and Charles Schwab. The reporting showed that banks were already responding to outside agents attempting to access customer accounts. It did not establish a specific, independently verified case of an unauthorized AI-agent transaction, and it did not confirm a financial loss.
A few days later, several of Canada’s largest banks confirmed similar restrictions.
On October 27, Royal Bank of Canada announced that third-party personal AI agents would no longer be allowed to access authenticated RBC services directly, including online banking. TD, BMO, CIBC and Scotiabank also described restrictions on outside agents accessing their platforms.
The timing is interesting. Canada is also changing the rules for how financial applications can access customer information. New consumer-driven banking legislation is in place, the government is developing regulations for secure third-party access, and the Competition Bureau wants approved financial services to eventually be able to initiate transactions.
So while banks are restricting certain types of AI-agent access, the broader financial system is moving toward more structured ways for outside applications to work with customer accounts.
The developments are connected, even though they address different forms of access.
Canadian banks confirm restrictions on personal AI agents
RBC explained its decision on October 27, citing concerns about security, privacy, fraud and potential consumer harm.
The bank acknowledged that AI assistants could help customers with financial tasks. But as these systems become more capable of acting independently, RBC said it needed to protect customers from risks associated with giving outside agents direct access to banking services.
Existing connections through affected agents would also stop working.
Bloomberg reported an internal RBC memo that described such agents as an “unacceptable customer risk”, citing agents that act beyond customer expectations or create liability exposure. The memo itself has not been released publicly.
The following day, Global News reported statements from several other major Canadian banks.
TD confirmed that it would block third-party personal AI agents from directly accessing banking information requiring authentication while appropriate security measures, authorization processes and oversight were developed.
BMO said it did not permit AI agents to access its digital properties or execute transactions. CIBC said it did not support personal agents directly opening or accessing customer accounts. Scotiabank said it would limit access by third-party AI agents.
The banks are not all describing their restrictions in exactly the same way. Their public statements do not provide complete details about when each measure was introduced, how agents are identified or which approved services might be treated differently.
The restrictions also concern external agents accessing banking services. They should not be confused with a general ban on AI within financial institutions.
Sources: RBC’s official explanation, October 27. Bloomberg’s reporting on RBC’s internal memo, as syndicated by The Star, October 28. Global News, October 28.
Canada’s banking regulations are changing at the same time
Canada’s current Consumer-Driven Banking Act received Royal Assent on March 26, 2026. It replaced the earlier 2024 Act and establishes a framework for people and businesses to share financial information with participating financial institutions and approved third-party services.
Today, some financial applications retrieve account information through a method known as screen scraping. The customer provides banking credentials, and the application uses them to collect information from the bank’s online services.
The new framework is intended to replace that approach with secure application programming interfaces, or APIs.
Instead of receiving the customer’s banking password, an authorized service would obtain only the information covered by the customer’s permission, subject to the framework’s security and other requirements.
On June 26, the federal government announced proposed Consumer-Driven Banking Regulations covering accreditation, security, liability, access to information and the responsibilities of participating organizations.
The Bank of Canada is designated to oversee the framework.
The rollout is staggered and begins with accreditation, and Payments Canada describes read access as the first phase. Read access would allow an approved provider to retrieve permitted information, such as account balances or transaction records, without receiving general access to the customer’s online banking session.
This could support financial applications that analyze spending, track accounts or help customers manage their money.
The law has been enacted, but the full system is not yet operating nationwide. The regulations and implementation arrangements are being developed in stages.
Sources: Consumer-Driven Banking Act, 2026. Department of Finance Canada, Proposed consumer-driven banking regulations, June 26, 2026.
October 23: The Competition Bureau recommends expanding financial access
Four days before RBC’s public announcement, Canada’s Competition Bureau submitted its recommendations on the proposed Consumer-Driven Banking Regulations.
The Bureau supports the direction of the framework but wants it to go beyond sharing account information.
One of its main recommendations is to introduce write access.
Read access lets an approved service retrieve information. Write access would allow it to initiate certain actions with the customer’s permission and under appropriate safeguards.
Depending on the eventual rules, those actions could include payments, transfers, opening or closing accounts, or helping customers move between financial providers.
The Bureau also wants accreditation and compliance requirements to be proportionate, so smaller providers are not unnecessarily excluded by the cost or complexity of participation.
It recommends simpler processes for consumers and closer monitoring of competition and access to financial data.
These proposals have not become transaction-initiation permissions. They are recommendations about how the framework should develop.
But they matter for AI-powered financial services.
An AI financial assistant could eventually move beyond analyzing account information to preparing or initiating an authorized action. Whether that becomes possible will depend on the services available, the regulations in force and the permissions granted by the customer.
Using AI would not, by itself, give a provider permission to perform financial transactions.
The Bureau’s submission also reflects a wider concern: opening financial services to approved providers should encourage competition without compromising privacy, security or customer protection.
Source: Competition Bureau, Consultation on the Draft Consumer-Driven Banking Regulations, October 23, 2026.
Payments Canada emphasizes safeguards before payment initiation
On October 26, Payments Canada published recommendations on how consumer-driven banking should develop.
Its recommendations support establishing secure and reliable read access before expanding into services that initiate payments or other financial actions.
Payments Canada emphasizes the importance of fraud controls, security, clear responsibilities, liability arrangements and processes for resolving disputes.
It also recommends prohibiting screen scraping after a transition period, one that begins only once API-based data sharing is available, tested and operational.
These are practical concerns for an organization responsible for operating Canada’s national payment systems.
Allowing another application to view a transaction is one thing. Allowing that application to initiate a payment introduces additional requirements because the instruction can move money and create consequences that may be difficult to reverse.
Payments Canada’s recommendations address those operational realities as Canada works toward a broader financial-access framework.
Source: Payments Canada, Recommendations for Canada’s consumer-driven banking framework, October 26, 2026.
What changes when an agent receives permission to act?
Financial applications have been accessing customer-approved information and initiating certain services for years. What makes AI agents different is their ability to interpret instructions and decide which actions to take.
A conventional application may follow a fixed sequence of steps. An AI agent can select tools or operations based on the task and the information it encounters.
That makes permission boundaries particularly important.
Authentication establishes the identity associated with a request. Authorization determines what that identity can do.
An online banking session may provide access to several functions even when an outside application needs only one of them. A properly designed API can limit the application to specific information or operations.
For payments, authorization may also depend on the account, recipient, amount, duration of permission and whether the customer must confirm the transaction.
Those controls are not unique to AI. They are established principles of financial security.
Their importance increases when software can make decisions about how to complete a task rather than simply following a predetermined set of instructions.
Other financial markets are developing controlled-access models
Canada is not alone in developing rules for financial applications that operate on behalf of customers.
A Bank of England and Financial Conduct Authority report published on October 26 offers a picture of how UK financial firms are using AI agents.
Among the 105 firms that completed the survey’s full questionnaire, 80% reported having deployed AI agents, while another 14% planned to introduce them within the following year. Eighty percent of those respondents reported agents in production used for decision support, where the agents recommend and people decide and execute. Only 2% reported agents operating with broad autonomy.
Even when planned deployments were included, no more than 9% of respondents expected agents to handle particular higher-consequence activities, including initiating payments, executing trades or changing operational limits.
These figures describe AI systems used by financial firms. They do not measure whether UK banks permit outside personal agents to access customer accounts.
The United Kingdom also has an established open-banking ecosystem in which regulated providers can access approved account information and initiate certain payments.
One example is Variable Recurring Payments.
These arrangements allow eligible payments to take place within limits agreed to by the customer. The conditions may include the amount, frequency and duration of the permission.
The provider can initiate payments that meet those conditions without requiring the customer to approve every transaction separately.
This is not unrestricted access for autonomous AI agents. It is an existing example of how financial permissions can be defined and enforced.
Australia’s Consumer Data Right follows a related approach for sharing information. Accredited services can receive specified financial data when consumers authorize the connection. It is primarily a data-sharing framework rather than a general permission for agents to perform transactions.
Singapore has been examining the issue more directly in relation to AI agents.
In July 2026, the Monetary Authority of Singapore published Safeguards for Agentic Finance at Runtime, developed through an industry initiative.
The framework looks at how agents should be authorized, when human oversight is needed and what records should be kept when important actions take place.
The paper sets out how agent actions are authorized, how human oversight is activated and what is recorded at the point of every decision.
The framework does not mean every Singapore bank has adopted the same controls. It sets out an approach for managing agent activity in financial systems.
These countries have different regulatory arrangements, and there is no single international approach to personal AI agents. Their existing financial-access systems nevertheless provide useful examples of how outside services can operate within defined permissions.
Further reading: Bank of England, Artificial Intelligence in UK Financial Services 2026, October 26. Australian Consumer Data Right. MAS, Safeguards for Agentic Finance at Runtime.
Visa’s October payment pilot demonstrates another approach
On October 20, Visa, BILL and Billtrust announced a live pilot in which authenticated AI agents can complete approved business-invoice payments through supplier portals.
According to the companies, the arrangement uses recognized agent identities, tokenized payment credentials and controls linked to payment instructions already approved by the buyer.
This avoids giving the agent the buyer’s ordinary supplier-portal login credentials.
There is an important limit to what the agent can do. It is not independently choosing which invoices to pay. It carries out eligible payments after the buyer has approved them.
Visa says transactions are being processed with participating buyers and suppliers. These are the companies’ reported results from a limited pilot, not independent evidence that the approach is ready for unrestricted use.
The pilot offers a useful comparison with direct banking access. The agent is recognized by the participating systems, and its activity is linked to a particular approved payment rather than general access to an account.
Source: Visa, Trusted AI-agent payment pilot with BILL and Billtrust, October 20, 2026.
Liability remains an important issue in delegated financial activity
Even with formal permission, financial transactions can go wrong.
An agent might misunderstand a customer’s instruction, use incorrect payment information or act on information that has been manipulated.
When that happens, responsibility depends on what the customer authorized, what the service actually did, the agreements between the parties and the laws that apply.
A Federal Reserve governor, in a speech published by the Bank for International Settlements, named authentication, liability and fraud as important challenges in AI-agent payments.
Canada’s proposed consumer-driven banking regulations also address liability and obligations for participating organizations. Payments Canada’s October 26 recommendations call for clear responsibilities and dispute-resolution processes before payment initiation expands.
There is no single publicly established liability rule that covers every AI-agent transaction, every financial institution and every jurisdiction.
The issue becomes more complicated when a customer gives an application ongoing permission to act rather than approving each transaction individually.
The earlier U.S. banking investigation discussed the difficulties that can arise when customers share credentials with agents. Canada’s developing framework adds another question: how should responsibility be handled when a third-party service acts through a formally approved financial connection?
What the October developments establish
The recent announcements provide a clearer picture of how financial institutions are responding to third-party AI agents.
Major banks in both the United States and Canada have reported or confirmed restrictions on agents accessing authenticated services. RBC has publicly explained its decision, and other Canadian banks have described their own policies.
Their stated concerns include security, privacy, fraud prevention and the need for appropriate authorization and oversight. Bloomberg also reported an internal RBC memo that called such agents an unacceptable customer risk, although the memo itself has not been published.
Alongside these banking decisions, Canada’s consumer-driven banking framework is progressing. The government is working through the rules for secure third-party access, while the Competition Bureau and Payments Canada have provided recommendations about its future development.
Internationally, existing open-banking arrangements, the Bank of England’s survey, Singapore’s agent-safeguards work and Visa’s payment pilot show how financial institutions are adopting AI and exploring different forms of controlled access.
These are not identical developments. Some concern banking policies, others involve legislation, proposed regulations, voluntary frameworks or commercial pilots.
The public record does not provide a complete account of individual banks’ internal security findings or a reliable measure of financial losses linked specifically to personal AI agents.
What is clear is that financial institutions are paying closer attention to how autonomous software accesses customer accounts and how its actions can be controlled.
What happens next?
For Canadian customers, the immediate advice is to follow their bank’s current rules on third-party access and credential sharing.
Financial-technology providers will need to pay close attention to the developing consumer-driven banking framework. Accreditation, secure API access, consent requirements and any future write-access rules will help determine which services they can offer.
Banks and regulators, meanwhile, have further work ahead as Canada moves from legislation and proposed rules toward operating financial-data connections and potentially broader transaction capabilities.
The October restrictions establish boundaries around direct agent access. Separately, regulatory work and payment-industry initiatives are addressing how approved services may access financial information or perform specified actions.
Neither development determines how every bank will handle autonomous agents in the future.
Financial systems need to know who an agent represents, what it has permission to do and whether the action it is attempting falls within that permission.
That requirement applies whether a service uses conventional automation or an AI agent.
References and further reading
- Royal Bank of Canada, Understanding third-party AI agents and your RBC banking. October 27, 2026. RBC’s official explanation of restrictions on personal AI agents.
- Bloomberg, via The Star, Royal Bank of Canada to block AI agents, calling out ‘unacceptable’ client risk. October 28, 2026. Syndicated Bloomberg report on RBC’s decision and an internal memo.
- Global News, AI agents banned by several of Canada’s biggest banks as fears grow. October 28, 2026. Statements from major Canadian banks.
- Department of Justice Canada, Consumer-Driven Banking Act (2026). Assented to March 26, 2026. The current statute replacing the earlier 2024 Act.
- Department of Finance Canada, Proposed Consumer-Driven Banking Regulations. June 26, 2026. Proposed rules concerning accreditation, security, liability and third-party access.
- Competition Bureau Canada, Consultation on the Draft Consumer-Driven Banking Regulations. October 23, 2026. Recommendations about write access, competition and proportionate regulation.
- Payments Canada, Recommendations for Canada’s Consumer-Driven Banking Framework. October 26, 2026. Security, payment initiation, liability and dispute-resolution considerations.
- Bank of England and Financial Conduct Authority, Artificial Intelligence in UK Financial Services 2026. October 26, 2026. Survey with 196 responding firms, 105 of which completed the full questionnaire, covering AI-agent deployment and autonomy.
- Australian Treasury, Consumer Data Right. Official government information about the Consumer Data Right framework for accredited data sharing and consumer consent.
- Monetary Authority of Singapore, Safeguards for Agentic Finance at Runtime. July 2026. Industry-developed framework for agent authorization, human oversight and decision records.
- Visa, AI-agent payment pilot with BILL and Billtrust. October 20, 2026. Reported pilot for executing approved business-invoice payments using authenticated agents.
- Federal Reserve Governor Christopher J. Waller, Payments in the age of AI agents. Speech published by the Bank for International Settlements, October 5, 2026. Names authentication, liability and fraud as challenges in AI-agent payments.
- TechiesJournal, AI Agents and Bank Accounts: What Banks Have Observed. October 25, 2026. Earlier investigation of U.S. banking restrictions and reported activity.
Source-review cutoff: October 31, 2026.