Generally yes, but under the rules that already apply to banks, not a special permission. No major banking regulator has banned AI agents outright, and few have written rules just for them. An agent acting for customers meets the same duties on fair treatment, authentication, data, model risk and accountability as any other system, and the bank answers for it.
Is there a rule that says agents are allowed?
Mostly not, and that is the point. Banking regulation is largely technology-neutral. A payment must be authorised by the customer, whoever or whatever prepares it. A customer must be treated fairly, whether by a branch employee or software. Personal data must be processed lawfully, whatever does the processing.
Some jurisdictions have AI-specific law on top. The EU AI Act, in force since 1 August 2024, applies obligations according to risk; creditworthiness assessment and credit scoring of individuals are listed as high-risk in Annex III, and Article 50 requires that people be told when they are interacting with an AI system. The UK takes a principles-based, regulator-led approach rather than a single AI law. The United States has no single federal AI law, though agencies apply existing rules, and Canada has no federal AI act in force.
Which existing rules bite hardest on agents?
Authorisation and authentication. In the EU, PSD2's strong customer authentication requires the customer to prove who they are for many payments. An agent cannot complete that for them. It can act within a mandate the customer authenticated, or prepare a payment for the customer to approve.
Automated decisions. Article 22 of GDPR, and the UK equivalent, restricts decisions based solely on automated processing that have legal or similarly significant effects, such as refusing credit. The detail is covered in whether GDPR allows AI agents to make automated decisions.
Fair outcomes. Conduct rules, such as the FCA's Consumer Duty in the UK, look at outcomes for retail customers. An agent that serves most customers well and vulnerable customers badly fails that test.
Model risk. Supervisors expect models to be governed: SR 11-7 in the United States, PRA SS1/23 in the UK, OSFI Guideline E-23 in Canada. An agent that makes or shapes decisions falls within that discipline.
Accountability. The UK's Senior Managers and Certification Regime names individuals accountable for areas of the business. Deploying an agent does not move that accountability anywhere.
Operational resilience. In the EU, DORA, applying from 17 January 2025, covers ICT risk management, incident reporting, resilience testing and third-party risk, all of which apply to an agent and the providers behind it.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What may the agent do for customers, and where must it stop?
| Action | Generally acceptable | Where it stops |
|---|---|---|
| Answering questions and reading the customer's own data | Yes, once the customer is authenticated | Using data beyond the purpose |
| Preparing payments for the customer to authorise | Yes | Authorising them itself |
| Executing within a mandate the customer set | Yes, within bounds | Anything outside the mandate |
| Protective actions, such as freezing a card | Yes, under the bank's rules | Lifting fraud-triggered blocks |
| Credit and other significant decisions | Supporting a person or a governed process | Deciding alone where rules restrict it |
| Telling customers they are talking to an AI | Required in many settings | Nothing |
The same pattern holds in financial crime work; see whether regulators accept AI agents in AML work. Insurance regulators approach it in their own way, covered in NAIC and state insurance regulators on AI agents.
An example: a fraud check by message
Take a bank that wants its agent to contact customers about suspicious card transactions and act on their replies. Under existing rules, the bank works through the questions. Is the customer authenticated before the agent discusses the account? Does the customer know they are talking to an AI? If the customer confirms a transaction is fraud, the agent may block the card, a protective action. If the customer says it is genuine, may the agent lift a block? Only where the bank's policy allows it and the block was not applied by the fraud team.
None of this needed a new permission. It needed the bank to map each action to the rules that already apply. The process is set out in confirming suspicious card transactions with customers with an AI agent.
What controls will a supervisor expect to see?
- A named owner for each agent and each capability.
- Evidence the agent was tested on cases like the ones it handles, before and after it went live.
- Bounds enforced at the moment of action, not just written in a policy.
- A record of each decision that lets the bank reconstruct what happened and why.
- A way back: people who can take over when the agent fails.
The general limits for banks are in AI agents in banking: what they may and may not do.
Questions people ask
Do banks need regulatory approval before deploying an agent?
Usually not specifically for the agent, but material changes to how services are delivered, or new outsourcing arrangements, can trigger notification duties. Check with your supervisor's expectations and counsel.
Can an agent act for a customer at another bank?
Through open banking, with the customer's consent and the customer authenticating at their own bank, yes in many markets. Logging in with the customer's password is not an acceptable route.
Who is liable when an agent makes a mistake?
The bank that deployed it, toward its customers, under the same rules that apply to any error. Contracts with providers may allocate costs between them, but not the bank's duties to customers.