Table of Contents
What would you do if you found out that AI agents on your fintech app have been making transactions on your customers’ behalf?
AI assistants are appearing inside customer bank accounts and have been able to contact call centers or attempt actions on their own. So far, the biggest concern is unclear intent and attempted actions, not confirmed theft. It raises the question every fintech leader should ask: when an agent acts inside an account, who decided what it should do?
Financial institutions such as Morgan Stanley have begun blocking third-party agents, and JPMorgan, Bank of America, and Citi are also restricting access. In the grand scheme of things, blocking is only part of the answer, and AI agents in fintech are not going anywhere. IDC forecasts that the financial services industry will have 383.3 million active AI agents across the United States by 2030. So, the more useful question for fintech leaders is how much access each agent should have. This guide walks through a five-level ladder to help answer that question. It ranges from no access at all to full independence and explains why most teams should pause at Level 2 or 3.
Why This Matters Now
Telling a person from an AI agent is becoming increasingly difficult. A valid login only shows that an account was accessed. However, the system cannot tell whether it is a person, an autonomous AI agent, or an approved tool.
Many customers share their banking usernames and passwords with an AI assistant. Although customers might see this as acceptable, many banks do not. Although leaders may view this as a breach, it highlights a gap between what customers allow and the security guardrails set by banks.
Understanding the Ladder
Among the many potential solutions for AI agents that have gone rogue, the Personal Agent Protocol is one. This system, created by Sierra and Meta, defines a range of permissions from blocked to full access. Although it is still in the design phase, using it to think about the parameters of AI agents in fintech cybersecurity may be valuable.
Below is the full range in plain language as a ladder in five levels.
| Level | In plain terms | What the AI can do | Questions to ask |
| 0. Locked out | No access | Nothing | Can we tell when something tries to get in anyway? |
| 1. Public information only | General questions | Answer questions about fees, hours, products, but sees nothing about any customer | Could private details leak into what it knows? |
| 2. Look but don’t touch | View only | See a customer’s account details but can’t change anything or move money | Does it need to see everything, or just part of it? |
| 3. Ask first | Prepares for action, a person approves | Draft a payment or transfer, but a human must confirm | Is the approval meaningful, or just a click-through? |
| 4. Act on its own | Full independence | Carry out actions without sign-off | What’s the worst that could happen, and who pays for it? |
Why Most Teams should Pause at Level 2 or 3
Today, most banks have approved, or are moving towards, only letting AI agents view financial information without making transactions. It is important to give AI as little access as possible. The main goal is to give the AI useful information without exposing it to sensitive user data. Hiding or tokenizing the sensitive details before they reach the agent can help achieve this.
The Open Banking Expo highlights that some customers may want AI agents to take certain actions on their behalf. This is where level 3 becomes essential. For example, an assistant notices a utility bill is due, prepares the payment, and asks the customer to tap “approve”. Asking the customer for approval adds a level of safety that would not be there otherwise. Programming AI agents to ask for authorization prior to taking action reduces the risk of them acting without asking for permission.
The shift from levels 2 and 3 does not have to be difficult. If level 2 is built well, level 3 is mostly one added step. The groundwork to adding a clear approval consists of the following:
- Record what each customer has agreed to.
- Keep a clear log of what the AI did.
- Limit the AI to the data it needs.
There are a few considerations. For example, there is no shared standard for verifying AI access, and there is no consistent answer on who is responsible if access is misused. Teams that build and integrate AI agents thoughtfully now will be ready to move up as these questions have clearer answers.
Conclusion
The most important consideration for integrating AI agents in fintech at any level is the safety of clients and their sensitive information. Prior to integrating AI agents in fintech, leaders should consider the following questions:
- What is the lowest level that still delivers the value that you want?
- What is the least amount of customer data the AI needs to see?
- How do you verify that a real person asked for each action?
- Can you shut access immediately if needed?
- Do you know when an AI tool is no longer in use?
If you have already integrated AI or are about to, now is the time to assess where each integration sits on the ladder. Reach out to AppsChopper for a consultation on your current fintech AI integrations and determine the level of the ladder you want your AI agents to operate on.
