Citi Hits Pause on AI Agent Access: Caution and Industry Divergence at a $2.6 Trillion Bank

Naveed Anwar, Citi's global head of AI, digital and data platforms, said at the Money20/20 conference in Las Vegas, held October 19–22, 2026, that Citi has "blocked anything that tries to access our systems in an agentic way," retaining only the read-only open banking access that already existed. According to an October 23, 2026 report by Banking Dive, Anwar's exact words were: "To date, nobody has connected to Citi in an agentic way, because we don't know what those models can do."

The $2.6 trillion-asset bank makes no secret of its wariness toward AI agents. Anwar said Citi needs a "Know Your Agent" (KYA) process, similar to KYC protocols, "to ensure we have the right guardrails and meet regulators' requirements." He made clear that Citi will not rush on agent access: "There are places we want to move faster, but this is not one of them."

Citi is not alone. According to Reuters, JPMorgan Chase, Bank of America, Morgan Stanley and Charles Schwab all said that customers' external AI agents (such as Meta's Muse) are barred from accessing bank accounts. Fifth Third also confirmed to Banking Dive that it does not currently allow AI agents to initiate transactions in customer accounts. PNC CEO Bill Demchak was more forceful at the same conference: no bank will allow AI agents to transact within accounts without a human in the loop, and banks need to add friction, not remove it, in agent-related scenarios.

These statements point to the same fact: as of October 2026, the default posture of large U.S. banks toward third-party AI agents accessing customer accounts is "closed," not "open." What sets Citi apart is that it explicitly frames "closed" as a transitional state pending the readiness of KYA and regulatory frameworks, rather than a permanent refusal. Anwar said future discussions will cover how to open access to enterprises "so they can start interacting with us"—but only once guardrails are in place.

This contrasts with American Express (Amex). According to public reports, Amex chose to proactively set access rules for external AI agents rather than block them outright. The difference between the two paths is not the goal—both acknowledge that agents are coming—but the pace and allocation of responsibility: Amex seeks to define within its own network what agents can do, in whose name, and under what authorization, keeping rule-making authority in its own hands; Citi cites "not knowing what the models can do" as grounds for holding off, moving the risk-control point forward to the admission stage.

From the perspective of agent payment compliance and security, Citi's KYA framing deserves attention. By likening "Know Your Agent" to KYC, it signals that banks are treating agent identity verification as an account-opening-level action rather than a mere technical integration. Behind this lies a series of concrete questions: in whose name the agent acts, how the authorization intent (mandate) is expressed, how per-transaction limits and daily cumulative limits are set, whether payee whitelists are auditable, and how disputes are attributed and made non-repudiable. Anwar's remark that "we don't know what they're authorized to do, who they represent, and what transactions they make under what permissions" is the plain-language version of these questions.

For the industry, the immediate consequence of large banks collectively blocking agent access is that consumer-facing agent payment scenarios (such as having an AI agent pay bills or transfer funds) still lack a channel on the mainstream bank account side. For agent payments to move real money, the bank account layer is unavoidable, and admission standards at that layer are currently interpreted by each bank individually. Citi's KYA, PNC's "human in the loop," and Amex's proactive rules are three different answers that have yet to converge into a unified standard.

One observable variable is regulation. Anwar directly links KYA to "meeting regulators' requirements," indicating that banks are waiting for regulators to define the compliance boundaries for agent access. Until those boundaries are clear, pre-settlement interception, agent identity verification and authorization-intent validation will most likely exist as bank-built guardrails rather than an industry-wide protocol. For product teams building agent payments, this means integration costs will depend on satisfying each bank's KYA requirements one by one, rather than applying a common standard.

---

Original source: Banking Dive · https://www.bankingdive.com/news/citi-takes-cautious-approach-ai-agent-access/833849/