Book a call
Business banking · October 2026

AI agent banking regulations: 6 predictions for what comes next

By Enoch Sng, Managing Partner, Black Lotus Financial Group · October 23, 2026

Bank building with classical columns and a judge's gavel on a dark navy background with faint digital circuit lines, representing AI agent banking regulations.

Short answer: No law yet says who is on the hook when an AI agent moves money, so for now your bank agreement decides. We expect the first real rules to come from banks and card networks within months, with federal guidance and possibly new laws following in 2027 and beyond.

The news: everyone is reacting, nobody has written the rule yet

On October 22, Axios reported that major US banks were finding unauthorized AI agents inside customer accounts. (We covered what that means for your account in our first post.) Here is where the rules stand today.

Banks are writing their own rules first. Wells Fargo's updated online access agreement takes effect November 24, 2026, according to USA TODAY. It makes customers "solely responsible" for supervising AI agents and treats agent transactions they authorized as authorized, "including those you did not want or intend." Citi told USA TODAY it allows agents only "limited, read-only access" through approved providers.

Bank regulators are asking questions. Reuters reported on October 13 that the Federal Reserve, OCC and FDIC are asking banks what limits they put on AI agents, whether humans stay involved in key decisions, and how they can shut agents down. So far that is information gathering. No new requirements have been issued. In April 2026 the same agencies left agentic AI out of their updated model risk guidance and said they plan to ask for public input on it.

Congress has bills on the table. In September, Reps. Josh Gottheimer and Mike Lawler introduced the bipartisan Stop Rogue AI Act (H.R. 10362), formally introduced September 14, which would direct NIST to write standards for finding, verifying and controlling AI agents. On October 1, Sens. Chris Murphy and Josh Hawley announced the AI Agent Accountability Act. As of mid-October it had no public bill number or text. As described, it would make AI agent operators and developers civilly and criminally liable for hacking under the Computer Fraud and Abuse Act. After the Axios report, Sen. Bernie Sanders called for an AI pause, Sen. Adam Schiff urged Congress to act, and Sen. Elizabeth Warren called it a "red alert."

Payment rules are older than AI. Regulation E, the federal rule that caps consumer losses on unauthorized transfers, excludes transfers made by someone you gave your access to. A January 2026 Consumer Bankers Association paper flagged that sharing credentials with an AI tool could fall into that gap.

The open banking rule is on hold. The CFPB's Section 1033 rule, meant to give people a right to share their bank data through secure connections, was finalized in October 2024. A federal court stayed its compliance dates on October 29, 2025, and a rewrite has been under White House review since August 2026.

Card networks are building agent ID systems. Mastercard's Agent Pay requires AI agents to be registered and verified before they can transact, using "agentic tokens." Visa's Trusted Agent Protocol, released in October 2025, lets merchants verify an agent through cryptographic signatures.

States are moving on AI disclosure. Colorado rewrote its AI law in May 2026 (SB 26-189). The new version takes effect January 1, 2027 and centers on notice and human review for automated decisions. Utah's AI Policy Act requires businesses to disclose AI use when a consumer asks, and it is set to expire July 1, 2027, so expect the 2027 Utah session to revisit it.

Our 6 predictions

These are our views based on the facts above. They are opinions, not legal advice, and timelines can move quickly.

1

More banks copy the Wells Fargo approach

Likelihood High Timeline Next 3 to 6 months

What's driving it: banks can change their terms faster than any regulator can act, and blocking agents protects them now.

What it means for owners: expect updated agreements in your inbox. The fine print will likely say that an agent you connected acts as you.

2

Banks and card networks publish "approved agent" lists

Likelihood High Timeline Through 2027

What's driving it: Mastercard already requires registered agents, Visa has an agent ID protocol, and banks like Citi already limit access to approved providers.

What it means for owners: tools that log in with your password will get blocked more often. Tools on a bank's or network's approved list will keep working.

3

Federal bank regulators issue formal AI agent guidance

Likelihood Medium Timeline 2027

What's driving it: the Fed, OCC and FDIC are already asking banks about agent limits, human involvement and shutdown plans, and they have said a request for public input on agentic AI is coming.

What it means for owners: your bank will likely ask more questions before letting any outside tool connect, and may add new approval steps for payments.

4

Regulators clarify who pays for agent-initiated consumer payments

Likelihood Medium for guidance, low for a full new rule soon, given the CFPB's current pullback Timeline 12 to 24 months

What's driving it: the Regulation E gap is now public, and industry groups are asking for clarity.

What it means for owners: this mainly helps personal accounts. Your business account will still depend on your bank agreement, so don't wait on this one.

5

Agent identity standards become law, starting with government

Likelihood Medium for NIST standards in some form, low for this exact bill passing as written Timeline 2027 to 2028

What's driving it: the Stop Rogue AI Act would have NIST set standards to verify and control agents, and it already has support from both parties.

What it means for owners: standards written for federal agencies tend to become the checklist banks and software vendors use. Expect vendors to start advertising that they meet them.

6

AI makers face liability for agent hacking

Likelihood Low in the near term. Congress rarely moves fast, and the outcome of the November 3 election will shape the 2027 agenda. Timeline 2027 at the earliest

What's driving it: the announced Murphy-Hawley bill and the CyberCartel research showing criminals using commercial AI models against financial institutions.

What it means for owners: even if it passes, it targets AI companies. It won't make you whole for a payment your own agent made.

What to do now, whichever rules land

The safeguards in our first post cover day-to-day setup. Getting ready for new rules is a different job:

  1. Keep a simple list of every tool connected to your money. Name, what it can see, what it can do, and who approved it. Every prediction above ends with someone asking for that list.
  2. Save every new bank agreement and note the effective date. If a dispute comes up, the version in force on that day decides it.
  3. Prefer tools that connect through approved channels. Ask vendors in writing how they connect and whether they are on your bank's or a card network's approved list.
  4. Put one person in charge of AI tools that touch money. When a bank or regulator asks a question, you'll want one owner who knows the answer.

FAQ

Is there a federal law regulating AI agents in banking?

Not yet. The Stop Rogue AI Act has been introduced in the House and the AI Agent Accountability Act has been announced in the Senate, and bank regulators are gathering information, but no rule specific to AI agents in banking is in force.

Does Regulation E protect my business account from AI agent mistakes?

Regulation E covers consumer accounts. Business accounts are mostly governed by your bank agreement and state commercial law, so read your bank's terms closely.

What happened to the CFPB's open banking rule?

The Section 1033 rule was finalized in October 2024, but a federal court stayed its compliance dates in October 2025. A revised proposal has been under White House review since August 2026.

Do Colorado's or Utah's AI laws cover AI agents in bank accounts?

Not directly. Colorado's law, effective January 1, 2027, covers automated decisions like lending and hiring. Utah's law requires AI disclosure when a consumer asks and expires July 1, 2027 unless renewed.

Will card networks only allow approved AI agents?

They are heading that way. Mastercard Agent Pay requires agents to be registered and verified, and Visa's Trusted Agent Protocol lets merchants verify agents.

Sources

Want help getting ahead of the rules?

We help owners map which tools touch their money and keep their records ready for whatever their bank or regulators ask next. See our advisory work, or book a 30-minute call.

Book a 30-minute call