Agent liability · checked 2026-11-06

Your AI agent's actions are yours. Can you prove what it did?

From November 24, 2026, Wells Fargo's Online Access Agreement deems an AI agent's instructions and transactions initiated and authorized directly by you, says the bank does not monitor agent activity, and asks you to keep evidence of every revocation. Other large banks have chosen to block agents instead. Either way, the proof is now the principal's job.

Readiness check: eight questions

Tick what is true for you today. Your answers stay in this browser; nothing is sent.

1. Do you have a current list of every AI agent that can act on your accounts?
You cannot supervise, or revoke, an agent you have not listed.
2. Is each agent's permission written down: what it may do, its limits, and what needs a human yes?
Supervision starts from a written scope you can show later.
3. Is every agent action recorded with its time, in a record nobody can quietly edit afterward?
If the record can be edited, it proves nothing to a bank or a court.
4. Could a bank or an auditor check that record without having to trust you?
Evidence the other side can verify independently is the kind that settles disputes.
5. When you revoke an agent's access, do you keep dated proof of the revocation?
Wells Fargo's Section 15(f) asks you to retain that evidence and produce it on request.
6. Are failed or unusual agent actions flagged to a person promptly?
The bank says it does not monitor agent activity: someone on your side has to.
7. Do high-risk actions wait for a human approval, and is that approval itself recorded?
An approval you cannot prove is an approval you did not give.
8. Can you hand a reviewer a signed weekly statement of what your agents did?
A periodic, signed account is what an auditor, an insurer or a bank can rely on.

Tick the questions above to see your score.

Start recording agent actions · Verify a record yourself · See our controls, live

Share: X · LinkedIn

What the banks say

Wells Fargo: Agent actions are the customer's

Online Access Agreement, version effective November 24, 2026, Section 15 (Third-Party Artificial Intelligence Agents or Agentic AI).

Instructions or transactions an AI agent starts "are deemed to have been initiated and authorized directly by you" (15(d)); the bank says "we do not monitor, screen, or review AI Agent activities" (15(e)); and "You must retain evidence of such revocation and must provide such evidence to us, at our request" (15(f)).

Source, the bank's own published text: Wells Fargo upcoming Online Access Agreement

JPMorgan Chase: Customer responsible for losses; external agents blocked for retail

Reported: its Digital Services Agreement, updated in October 2026, makes a customer who lets a third party such as "External AI" into an account responsible for resulting losses, to the extent the law allows; the bank told CNBC it currently blocks external AI agents from acting for retail customers.

Source, as reported: Credit Union Daily · SecureWorld

Citi: Third-party agents not permitted to log in or transact

Reported: Citi does not permit third-party AI agents or assistants to log into a customer's account or transact directly; read-only access through approved open-banking providers is allowed.

Source, as reported: Credit and Collection News

What it asks of a business

Two postures, one consequence. Where a bank deems an agent's actions yours, you carry the proof burden. Where a bank blocks agents, proof is what it would need before letting them in. The business that can show which agent acted, under what written permission, when, and when its access ended, holds the evidence. The business that cannot, holds the loss.

Not legal advice. These are summaries of published and reported terms as of 2026-11-06; terms change, and exceptions for applicable law apply. Read your own agreement.