Canadian Banks Restrict AI Agents From Accessing Digital Banking Systems

Canada’s largest banks are drawing a firm boundary around automated access to customer accounts: third-party personal AI agents can’t directly enter their authenticated digital banking systems. The decisions reflect a concern that software acting for a customer may handle sensitive information or initiate activity in ways the customer didn’t expect, while banks remain responsible for protecting their systems.

Major lenders adopt access limits

Royal Bank of Canada, the country’s largest lender, told employees Tuesday that it would block third-party personal AI agents from its authenticated digital properties. The memo, sent by group head of technology and operations Naim Kazmi and group head of personal banking Erica Nielsen, said the decision followed a “full security review of the technology and its functionality” and aligned with the bank’s guidelines for responsible AI use. RBC spokesperson Jeff Lanthier confirmed the memo’s contents.

Kazmi and Nielsen said the bank had decided, “based on what we know today,” to prevent direct access. They warned that agents accessing banking systems could create “unacceptable customer risk,” including acting beyond customer expectations or exposing the bank to liability. Lanthier said the policy could disappoint the “small portion of our clients who use these tools,” but described client and system safety as the reason for the restriction.

On Wednesday, Bank of Montreal, Toronto-Dominion Bank and Bank of Nova Scotia also said they were restricting third-party agents from their digital banking systems. Canadian Imperial Bank of Commerce said it does “not support personal AI agents directly opening or accessing accounts.” National Bank of Canada said it was “closely monitoring” the issue while weighing possible client benefits against risks.

Access and authorization are the central concerns

The banks’ statements point to a practical problem with delegated digital access. A personal agent may be designed to act on a user’s behalf, but the bank still has to determine whether that access is properly authorized, what actions the software can take and how to respond if its behavior differs from the customer’s intent. Account credentials and banking information can also expose sensitive data if passed to an outside tool.

Bank of Montreal spokesperson Jeff Roman said the lender does not permit AI agents to access its digital properties or execute transactions. Toronto-Dominion representative Ada Lovelace Rampersaud said the bank had blocked all third-party personal agents from direct access to banking information where authentication is required, while it works to ensure appropriate safeguards, authorization mechanisms and oversight are in place. A Scotiabank representative said the bank was limiting agents and would continue to monitor changing concerns.

Several lenders have also urged customers not to share banking credentials with AI agents. That guidance underscores the distinction between an AI service helping a customer organize information and the service logging into an account with the customer’s credentials. Direct access can give an automated tool a route to account data or transactions; restricting that route gives banks greater control over authentication and activity within their own systems.

Canadian restrictions echo moves by US firms

The Canadian decisions follow similar limits at several US financial firms, which have blocked or restricted unauthorized outside agents from accessing accounts or moving money. Earlier this month, Charles Schwab Corp. Chief Executive Officer Rick Wurster said the company was actively blocking unauthorized agents attempting to move clients’ money.

RBC’s position had been under consideration publicly. In a Bloomberg Television interview last week, Chief Executive Officer Dave McKay said the lender was considering blocking Meta Platforms Inc.’s Muse from accessing customer information. RBC’s employee memo now describes a broader policy covering third-party personal AI agents, based on the bank’s current assessment of the technology and its functionality.

The banks have not dismissed the potential value of AI tools for customers. Their statements instead frame access as a question of safeguards: the technology may offer useful services, but banks want clearer control over authorization, oversight and the handling of sensitive information before agents can enter authenticated accounts. National Bank of Canada’s ongoing assessment captures that unresolved balance between client opportunities and potential risk.

For customers, the immediate effect is that an outside agent may not be able to sign in or act directly within a bank’s digital services, even when a customer wants it to do so. For the banks, the next issue is whether authorization and oversight mechanisms can address the risks they cite. Until those controls meet their standards, direct access remains restricted across several of Canada’s largest lenders.