Most banks currently block external AI agents from authorizing transactions in their systems, Reuters reported, citing McKinsey's Global Banking Annual Review, PYMNTS writes. McKinsey surveyed 46,000 retail banking customers worldwide: among AI users, 72% said they would let a banking agent perform one financial task, though they would cap autonomous approvals at $500. McKinsey expects widespread customer use of agents within three years, and warned that token spending on banks' own agents could easily reach 20% of their total labor costs. Some banks have set up AI FinOps teams to oversee that spending.
A WilmerHale client alert on the U.K. Financial Conduct Authority framework separates authenticating an agent from establishing its authority. Under the U.K. Payment Services Regulations, authorization depends on payer consent through an agreed procedure, so a verified agent may still act outside what the customer intended. WilmerHale cautions banks to consider what evidence they need to accept agent-initiated transactions.
In a separate report, PYMNTS cites The Wall Street Journal as reporting that JPMorgan Chase blocks agents from shopping with customers' credit cards when given the card number, while Bank of America, Capital One and Citigroup cards are already used by agents. Stripe's Link gets around the block with a one-time virtual card. Merchants say that card costs more to accept because it is classed as commercial, and makes returns harder, the Journal reported. Mastercard CEO Michael Miebach called virtual card numbers "a bridge" to fully tokenized transactions.
