Yes, for a defined purpose and no further. An AI agent can read an authenticated customer's transactions to answer their question, or read the accounts named in a fraud alert to summarise it. It should not have standing access to every customer's history, infer health, religion or politics from spending, or share the history with anyone unauthorised.
Why is reading a history more sensitive than it looks?
A list of card payments and transfers is one of the most revealing records a person has. It shows where they live and travel, who they support, what they buy at the pharmacy, which clinic they visit, which place of worship or political party they give to. Under GDPR and laws modelled on it, some of that is special-category data with extra protection, and an agent that infers it from spending is processing it.
So the question is not whether an agent can technically read the data. It is which agent, for which customer, for what purpose, and what it may do with what it sees. Purpose limitation and data minimisation, among the principles in Article 5 of GDPR, translate directly into how the agent's access is scoped.
What conditions decide it?
Three conditions settle most cases:
- A purpose. The customer asked about a payment, a fraud alert names the account, or a complaint concerns specific transactions. "Might be useful" is not a purpose.
- A scope that fits the purpose. A question about last week's card payment does not need five years of history. An alert about one account does not need the customer's other accounts unless the investigation does.
- An authorised audience. The agent shows the history to the authenticated account holder, or an authorised party, and to staff with a role in the case.
The broader design question, whether a bank's agent should hold read access across all customers, is argued in should a bank's AI agent have read access to all customer accounts.
What may the agent do, and where must it stop?
| Use | The agent | Where it stops |
|---|---|---|
| Answering the customer's own question | Reads the relevant period, depth 1 | Reading beyond what the question needs |
| Helping the customer find a payment | Searches by amount, payee or date | Commenting on spending choices |
| Summarising a fraud alert | Reads the alerted accounts and period | Expanding to unrelated customers |
| Supporting an unauthorised transaction claim | Lists the disputed transactions with context | Deciding the claim |
| Spotting patterns for transaction monitoring | Works inside the monitoring system's alerts | Building its own profiles of customers |
| Inferring health, religion, politics or sexuality | Never | Not a purpose any agent should hold |
| Sharing history with a third party | Only with recorded authority | Callers claiming to be family |
| Using history for marketing | Only where the bank has a lawful basis and the customer's choices allow | Anything else |
For fraud and monitoring work, see what transaction monitoring is and connecting an AI agent to your transaction monitoring system.
An example: a question with a sensitive answer
Take a customer who asks the bank's agent, "Why is my balance lower than I expected this month?" The agent reads the month's transactions and sees the usual bills, groceries, and several payments to a fertility clinic.
The agent answers the question: it lists the largest outgoings, grouped by type, including "medical payments" as a line with the total, using the merchant names as they appear. It does not comment on the clinic, ask about it, or carry that detail into any other part of the customer's record. When the customer asks about one specific payment, the agent shows it.
The record shows which period the agent read and why. The agent's memory of the conversation is not used to tailor offers.
What controls make it safe?
- Access scoped per request. The agent receives the accounts and period the purpose needs, not a standing view of everything.
- Purpose recorded with each read. Every access is filed with the reason, so a data protection review can see why.
- No inference capability. The agent's brief forbids classifying customers by sensitive traits, and certification tests that it does not.
- No retention beyond the case. Transaction details are not kept in the agent's memory after the conversation.
- Third-party authority from the record. Sharing requires authority already recorded, such as a power of attorney.
When a customer disputes a transaction, the next step is covered in handling unauthorised transaction claims with an AI agent. Stopping a payment in flight is a different capability: see whether an AI agent can block a suspicious transaction. The general limits are in AI agents in banking: what they may and may not do.
Questions people ask
Can the agent export a customer's transactions?
It can produce a statement for the authenticated customer in the bank's standard format. Bulk exports for other purposes need a person and a documented reason.
Can a joint account holder see all transactions?
Usually yes, because both hold the account. The agent should still check the account mandate in case the bank records different access.
Does the customer have to be told an agent read their transactions?
The bank's privacy notice should explain that automated systems process account data. Under transparency rules such as Article 50 of the EU AI Act, customers talking to an agent must know it is an AI.