If you run an API, AI or product team in a bank, or build on bank APIs, here is the useful part first. The question of the month is not whether AI agents work. It is whose agent is allowed to act on a customer's money, and who answers when it goes wrong. You can settle that question for your own workflows this quarter, before a regulator or a counterparty settles it for you. The rest of this article shows how.
A Tuesday in October
On Tuesday 13 October 2026, on JPMorgan's third-quarter earnings call, an analyst asked about AI agents. Jamie Dimon's answer travelled further than the quarter's numbers. "We're not going to allow just any outside agent to come inside the company," he said, and then the line that made the headlines: "You don't want rogue agents."
The largest bank in the United States had drawn a boundary. Outside AI agents will not be allowed to access customer accounts and act on customers' behalf. The Paypers, following up, added the detail that matters for anyone building on bank data: agents can still read some customer data, such as account balances, where a connector already holds the customer's credentials. They cannot send money or pay bills.
The same day, Reuters reported that three top US regulators, including the Federal Reserve, are quizzing banks about their use of advanced AI. The questions cover whether banks deploy Chinese-developed technology, use AI agents in cyber defence, and whether they can control and shut down increasingly autonomous systems. In Europe, the ECB had already given lenders an end-October deadline to produce plans against AI-enabled cyber threats.
Two things happened in one day. A bank said no to agents it does not control. Regulators asked every bank whether it can control the agents it has.
What this means for each of you
Bank API and AI leaders. The boundary Dimon drew is one you will be asked to draw too, in writing, soon. Where does your API let a machine read, and where does it let a machine act? Most banks today can answer the first and not the second. Reading is live everywhere: balances, transactions, documents, portfolio data feed assistants and personalisation. Acting, meaning a payment sent or a product changed by an agent, is rare, and after this month it will be scrutinised wherever it exists.
Fintech founders and platforms. If your product plans to act for the customer through a bank, assume the bank will insist on knowing whose authority your agent carries, what it may do, what the limits are and how the bank can revoke it. Read access through a connector is the model that survived this week. Execution did not. Build for the first and design the second so that a bank can say yes to it later.
Everyone who signs off AI in a regulated firm. "Can you control it and switch it off?" is now a supervisory question, not a design preference. If the answer in your organisation is a shrug, that is the first thing to fix.
The design that answers both
The bank's boundary and the regulator's question have the same answer. It is the way we build every AI workflow, and it fits a bank's own agents as well as the outside ones it may admit later.
- The agent reads, matches, ranks and drafts. It never executes on its own. A payment, a limit change, a product switch, a message to a customer: each waits for a person.
- A named person decides. Not a team, not a role, a name. Where that person signs, what happens when they do not, and what the agent may do in the meantime, are written down before anything is built.
- Every step is logged. The request, the data read, the API calls made, the draft produced, the approval given and the action taken. Readable by the business, by risk and by a supervisor.
- One switch stops it. A single, tested control that halts the agent across every workflow it touches, owned by someone who can use it at three in the morning.
Put those four lines in front of the questions regulators are reportedly asking and you have your answer. Put them in front of a counterparty bank and you have the basis for being let in.
What to do this quarter
- List every place an AI system can act, not just read. Most banks find fewer than they feared and one or two they had forgotten. Each one gets a named owner and a written limit this quarter.
- Write the control model down on one page. Three tiers work: what AI does alone, what it drafts for a named person to approve, what it never does. Our article on AI in regulated work sets out the model and three worked examples.
- Test the switch. Not the policy, the switch. Stop one agent in one workflow, time it, record who did it, and fix what was slow.
None of this is a technology choice. All of it is a design choice, made before the next agent is built, which is why it is worth doing now while everyone is paying attention.
Where we stand
This is how we build. Praxis, our research workspace for private banks and their clients, cites every figure to its source and audits every output, and it is decision support only, never execution. The same rule runs through every workflow we put AI into: the agent proposes, a named person is accountable, and the record shows who did what.
The debate this month was about outside agents. The useful work is inside: deciding, for each workflow you already run, what the machine may do and who answers for it. Start with the one that would embarrass you most if a supervisor asked tomorrow.