Ariana.Digital · Frontier Industry IntelligenceCompare your stack · 2026-11-09

Compare your stack: agent access to customer accounts

An eight-control self-check for bank and credit-union security leaders, built on the Nov 9, 2026 edition. Five big UK lenders have moved to restrict AI agents in customer accounts (The Telegraph, Nov 8), and the OCC's Nov 4 examiner framework rates AI by consequence, transfer of agency and human oversight. Score yourself, then see what an examiner-ready answer looks like.

For: CISO, head of digital channels, head of fraud

Where peers drew the line

Reported peer moves on outside AI agents
Who	Reported move	Date and source
HSBC, Barclays, Lloyds, NatWest, Nationwide	Moved to block AI agents from customer accounts; some ban AI-initiated transactions without the customer's direct involvement	Nov 8, 2026 · The Telegraph via Yahoo Finance (CITED)
JPMorganChase, Citi, Bank of America, Wells Fargo, Morgan Stanley	Block external AI agents from customer accounts	Oct 27, 2026 · American Banker, as tallied by FourWeekMBA (CITED)
Charles Schwab	Blocks 10 to 20 clients a week from using AI agents (CEO)	Nov 8, 2026 · The Telegraph (CITED)

Score your controls

Tick what is true today. The score stays in your browser.

1. Detect. We can tell a customer's declared AI agent from a human session and from undeclared automation.
Evidence an examiner can ask for: Session telemetry showing agent sessions classified for the last 30 days. · AEGIS Pillar 2 · AI System Inventory 2. Inventory. Every external agent with access to customer data is in our inventory, with its scope.
Evidence an examiner can ask for: An inventory extract: agent, owner, scope, consent record. · AEGIS Pillar 2 · AI System Inventory 3. Tier. We tier agent actions by consequence: read, recommend, initiate.
Evidence an examiner can ask for: A tiering memo signed by the model-risk or operational-risk owner. · AEGIS Pillar 3 · Risk & Impact Assessment 4. Approve. No agent can initiate a payment without an in-app approval the customer controls.
Evidence an examiner can ask for: Test evidence that an agent-initiated payment stops at the approval step. · AEGIS Pillar 4 · Controls & Human Oversight 5. Revoke. We can revoke one agent's access in minutes, without locking out the customer.
Evidence an examiner can ask for: A timed revocation test with the log. · AEGIS Pillar 4 · Controls & Human Oversight 6. Contract. Vendor contracts give us rights to monitor, test, restrict or terminate their agents.
Evidence an examiner can ask for: The clause, by vendor. · AEGIS Pillar 1 · Governance Architecture 7. Disclose. Customer terms say who is liable when an agent acts on an account.
Evidence an examiner can ask for: The published terms and the date they changed. · AEGIS Pillar 5 · Transparency & Rights Management 8. Drill. We ran a halt drill for an agent incident in the last 90 days.
Evidence an examiner can ask for: The drill report, with time-to-halt. · AEGIS Pillar 6 · Monitoring & Incident Response

0 of 8

Fewer than 5: start with inventory and the payment approval step. 5 to 7: test revocation and contract rights. 8: assemble the evidence file.

Why the examiner will ask

OCC Bulletin 2026-54 (Nov 4, 2026) tells examiners to classify use cases "by potential consequences, transfer of agency, and degree of human oversight," rather than technical sophistication. It is an examiner resource and "does not establish supervisory expectations for banks" (VERIFIED, occ.gov). Summaries report it flags transaction-initiating agents, one-click approvals, and banks' rights to "monitor, test, restrict, or terminate" third-party systems (CITED, Consumer Finance Monitor, Nov 6, 2026). Comments on the interagency third-party risk guidance close Nov 16, 2026 (VERIFIED, Federal Reserve).

Our take (opinion): block first if you must, but publish a narrow path: read-only through consented APIs, initiation only with in-app customer approval, and a revocation switch you own.

See the AEGIS operating model

Sources: The Telegraph via Yahoo Finance (Nov 8, 2026); FourWeekMBA (Nov 9, 2026); OCC Bulletin 2026-54; Consumer Finance Monitor (Nov 6, 2026); Federal Reserve proposal FR-2026-0031-01. Full ledger: Nov 9 edition. Not legal advice.