[Tech Blog] Why US Banks Blocked AI Agents: Four Questions Before Connecting Company Accounts

Hello. This is Fintag, the service that brings your company's scattered finances into a single screen.

These days there are many moments when you want to tell an AI assistant, "Check our company's bank balance for me." To actually do that, you would have to hand your bank ID and password to the AI, and last week the United States showed what that convenience can lead to. Large banks such as JPMorgan Chase and Morgan Stanley began detecting third-party AI agents operating inside customer accounts and started blocking their access.

In this post we cover what the US banks found and which alternative they chose, how far Korea's rules have come, and the principles Fintag followed when opening company financial data to AI. At the end we leave four questions you should ask before entrusting a company account to any AI service.

What happened at the US banks

On October 22 (local time), the US outlet Axios reported that large banks including JPMorgan Chase, Morgan Stanley, Bank of America and Citi were detecting activity by unauthorized third-party AI agents connected to customer accounts. The method is simple. A customer hands their bank ID and password to an AI assistant, and the AI logs in on the person's behalf and looks through the account. The customer allowed it, but the bank never approved it, which conflicts with most banks' rules that require the account holder to log in personally.

The real problem is not the access itself but what comes after it. Some agents were reported to have taken actions the customer never requested, such as contacting the call center. The scenario banks fear is an AI executing an unapproved transaction or moving funds while processing a request. Last month an economist warned that if AI agents all moved customer deposits to other accounts at once in search of higher interest rates, it could trigger a large-scale bank run. Jamie Dimon, CEO of JPMorgan, also said earlier this month that "you assume the AI will act appropriately on your behalf, but it may not."

The alternative the banks chose is read-only access. Morgan Stanley began blocking external agents from its platform, and JPMorgan, Bank of America and Citi are restricting access while reviewing a model that allows balance and transaction inquiries but blocks transaction execution. The goal is a path where customers can use external AI services without handing over their passwords. The banks also stated that, so far, there is no evidence of customer losses or account breaches caused by AI agents going astray.

Where Korea stands

Since 2022, Korea has prohibited MyData providers from logging into banks with customer credentials to scrape information, requiring them instead to exchange data only through dedicated channels agreed with the banks in advance. But that rule binds only MyData providers. There is still no separate standard governing a customer who hands their ID and password directly to a general-purpose AI and lets it handle financial transactions.

Liability in the event of an incident is also unclear. The Electronic Financial Transactions Act makes financial institutions liable for electronic financial incidents in principle, but if the user acted intentionally or with gross negligence, such as handing an access medium to a third party, the user may bear all or part of the loss. If handing a password to an AI is interpreted as delegation to a third party, the company could end up absorbing the damage.

The Korean financial sector is on alert as well. Between late September and early October this year, several financial companies suffered a series of security breaches, and regulators announced they would re-examine security frameworks from the ground up. The US banks' move came right after that. For a company, "stop using AI" is not the answer. The answer is knowing which path the AI takes to reach your company's money, and what locks exist along that path.

The rules are now being written. On October 8, the Financial Security Institute released its "Security Evaluation Criteria for AI Agents in the Financial Sector." It consists of 17 check items across 6 areas, examining whether the AI was given only the level of permission it needs, whether an approval process is followed when it uses external tools, whether it stays within its defined scope of work and verifies results, and whether autonomous execution can be limited or stopped when necessary. After a pilot verification through the end of this year, the plan is to apply it as a formal inspection standard from 2027. At Seoul Fintech Week on October 26, Lee Seok, Director General of Digital Finance at the Financial Supervisory Service, noted that the number of AI services financial companies have adopted or plan to adopt averages 6.9 per company, up 24% in a year, and reiterated the principle that AI is an aid while final decisions and responsibility rest with people.

How Fintag designed it

Fintag provides an MCP (Model Context Protocol) connection so that external AI apps such as Claude, ChatGPT and Cursor can query company financial data. The standard we used in the design is the same conclusion the US banks reached belatedly. No passwords are handed over, reads and writes are separated, and every call is logged.

• No passwords are handed over — When you register the Fintag address in an AI app, a browser opens, you sign in with your usual Fintag account, and a consent screen shows the permissions being requested. There is no separate API key or password entry, and the app receives only a one-hour access token. Bank certificates and account passwords are excluded from what can be queried at all, and account numbers are delivered masked.
• Permissions are split by item — Only the items shown on the consent screen are allowed, such as asset overview, transaction history, calendar viewing, calendar creation and editing, document library access and market indicators. Queries are limited to your own company's data, and another company's data is never returned under any circumstances.
• Reads and writes are separated — Query tools for balances, transactions and assets are marked read-only and cannot change data. Tools that change data, such as creating a calendar event, do not execute immediately even when the AI calls them. The request is returned showing which action is about to run with which inputs, and it executes only when sent again with a confirmation flag. This corresponds to the read-only access the US banks are reviewing and the approval-process item in the Financial Security Institute's criteria.
• Every call is logged — We keep an audit record of which app called which tool, when, and how long it took. Because information such as account numbers could be mixed in, raw input values are not stored; only field names and sizes are kept.
• Anomalies are flagged immediately — Events such as an app connecting to a company for the first time, an external app executing a write tool, or reuse of a refresh token that has already been rotated are recorded as security events, and high-severity ones trigger an immediate alert to the operations team's messenger. If a rotated token is used again, it is treated as theft and every token for that connection is revoked.
• You can disconnect at any time — Revoking an app from the connected apps screen in Settings invalidates its tokens immediately, and app registrations unused for more than 30 days are cleaned up automatically. Administrators can block specific apps.

In this structure, what the AI can do is ask and answer questions such as "Summarize our company's card spending this month" or "Is there a loan maturing next week?" Functions for moving money or applying for a loan were never exposed as tools in the first place. The key point is that even if the AI slips out of control, the range of what it can do is blocked at the design stage.

Four questions before entrusting a company account to AI

Whichever service you use, the questions a person in charge should confirm before connecting company financial data to AI come down to four.

The rollout order is simple as well. First, define the scope of data you will open to the AI. It is safer to start with read-only access such as balances and transaction history, and add write permissions only after the need is confirmed. Next, keep a list within the company of who connected what. Review connected apps every quarter so that connections belonging to departed employees or former staff do not linger. Finally, always cross-check the numbers the AI produces against the original screens. The regulators' principle that AI is an aid while decisions and responsibility rest with people applies just as much inside your company.

📌 You can ask AI about your company's cash position without handing over a password. Once you register a public certificate or financial institution account, Fintag automatically and periodically updates account, card and loan data across multiple banks, stores certificates and credentials encrypted, and provides company-data-based AI chat and external AI app connections centered on read-only access. Try the 2-week free trial and see the AI connection for yourself. → app.fintag.kr

Thank you. From Fintag.