How Banks Can Govern Customer-Owned AI Agents They Don’t Own
Alfred Kahn is the founder and CEO at OvationCXM, a customer experience management company.
gettyMost discussions about AI agents in banking focus on internal use cases. But clients are launching their own AI agents to automate finance and banking workflows. These agents are quickly becoming a new banking channel, so banks must prepare to govern them.
In our survey of 520 U.S. finance leaders, 75% said they are using or piloting AI agents in their workflows. Only 1 in 10 has no plans to use them.
In September, six banks, including Commonwealth Bank of Australia, Bank of America and Capital One, published voluntary principles for agentic commerce. They called for visibility into agent activity and customer control over delegated authority and execution. Standards are also being discussed, including the Personal Agent Protocol (Poppy), an open standard for how personal AI agents interact with businesses.
But principles and standards alone won’t operationalize agent governance. That requires infrastructure.
Customer agents come from many platforms. In our research, we found that finance leaders most often named AI tools like ChatGPT (39%) and Microsoft Copilot (36%), spreadsheets (32%), accounting suites (25%) and collaboration tools (22%). Few named bank portals (13%) or bank APIs (12%), likely because most banks lack a front door for machine interactions.
Bank controls were built for two types of users: a person logging into a portal, with entitlements, limits and a second approver, or a system connection, like a host-to-host file or API call running a preapproved process.
An AI agent is neither. It is not a named user, but it makes its own decisions. It looks like a system connection, but acts with human authority. Banks’ identity and authorization models aren’t designed to grant authority, limit it or capture what the agent did with it.
More APIs won’t fill the gap. APIs authenticate credentials, but they don’t validate whether the client gave its agent authority for that specific request. Closing the gap requires a checkpoint between the request and core banking systems that verifies the agent and the client it acts for, then applies the permissions end to end.
In our survey, 74% of respondents said agents will be important to their operations within a year. Those using, piloting or planning to use agents expect to use them within 12 months for at least one read-only banking task (77%), instruction task (71%) or money-movement task (68%).
Among finance leaders using agents, 54% said they would find an internal or third-party workaround if their bank couldn’t support agentic banking. That’s a real risk. Banks prioritize deposit retention and primacy in client relationships, and every workaround threatens both. The bank may own the account on paper and clear the payment, but the workflows migrate to platforms it doesn’t control.
Although the data shows rapid adoption of AI agents, finance leaders still want human oversight. Across eight banking tasks surveyed, leaders are almost as willing to allow money movement (50%) as read-only tasks (54%).
Willingness drops when humans are not in the loop: Only 10% would allow autonomous money movement and 17% would permit balance inquiries. Specific controls increase their confidence: Role-based permissions and transaction limits were chosen by 39%, and 38% want the ability to revoke agent access instantly.
The strategic question must now become how banks will deliver these controls.
Banks don’t control customer-owned agents, but they are responsible when those agents interact with bank systems.
1. Separate discovery from authorization. The Model Context Protocol (MCP) is a common standard for exposing tools to AI models, and banks should support it. But MCP is a menu. It tells an agent which functions exist and how to call them; it doesn’t decide whether the agent is allowed to call them for this client in this amount. That decision belongs outside the AI model, in a control plane that checks every request against the client’s entitlements, limits and approvals, as well as the bank’s own policies. A prompt can tell an agent not to transfer more than $10,000, but only a hard limit in the bank’s systems ensures it doesn’t.
2. Publish bounded tasks, not open APIs. Exposing raw REST endpoints gives AI agents too much reach into internal systems. Instead, expose discrete business actions, such as verifying payment status, fetching exception details or creating a service request. Scope each task by caller identity, target account, input parameters, transaction caps and approval policies. Read and write access must remain separate. A balance inquiry and a wire transfer should never share credentials.
3. Know the agent before you trust it. Vet every agent request with three tests. First, identify the agent, the provider and which client it belongs to. Then decide whether it’s a known agent on the account or a new one. Finally, confirm the client has delegated authority for this task, account and amount. Register each agent with its own credentials, tied to a client and limited to a subset of that client’s permissions. It should never log in as the client, and the bank should be able to revoke access in seconds for one agent, one client or an entire platform.
4. Stage rollout by risk. Start with read-only workflows you can check against bank records, such as transaction status. Confirm that policy blocks work as designed. Keep money movement behind treasury limits, dual approvals and mandatory human sign-offs until controls are validated.
Agents won’t erode bank relationships overnight; they’ll do it workflow by workflow as work moves outside the bank. Clients will use AI agents with or without their bank’s permission. The question is whether banks can keep control through their front door or clients build a back door around them—or they take their business elsewhere. Among finance leaders using agents, 15% of those we surveyed admitted they would move more of their banking if their institution couldn’t support AI ǐagents.
Agent governance is not just an AI strategy. It’s a retention and growth strategy.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
