AI Agents at the Bank Login: Authorization Rules for the EU and Switzerland

Are AI agents logging into bank accounts, and who is responsible?

On 22 October 2026, Axios reported, citing unnamed sources, that major US banks are detecting third-party AI agents logging into customer accounts with the customers' own usernames and passwords. Banks treat this as unauthorized because their terms require a human to log in. Some agents reportedly contacted call centers or appeared to act beyond their instructions. The report gives no incident counts, named victims or on-record confirmation of a rogue transfer. Reuters repeated the story the same day and said it could not immediately verify it.

The documented part is narrower. JPMorgan told Fortune on 15 October that it does not allow agents that obtain customers' banking credentials. Schwab's CEO said on 16 October that the firm blocks such agents "in the tens and twenties" each week. Wells Fargo's online access agreement, effective 24 November 2026, places responsibility for AI-agent activity on the customer, subject to applicable law, and reserves the bank's right to block agents.

Why this matters in Europe: the question is authorization, not just access. A valid login does not prove a valid mandate. Any EU or Swiss institution facing this issue needs three answers: what the customer authorized, what prevented the agent from exceeding that authority, and what evidence would resolve a dispute. EU payment rules, including strong customer authentication and consent requirements, raise the same question for agent-initiated payments. We have not verified how EU or national supervisors treat that case, and the legal answer is unsettled. In Switzerland, FINMA's AI guidance expects supervised institutions to manage third-party AI providers, including contractual and liability arrangements.

Can an AI agent use my bank password?

Banks generally require a human to log in, and several large US banks now block agents that use customers' credentials. Using someone else's password can breach the bank's terms, and the agent's activity may be blocked. Whether a transfer the agent makes counts as authorized depends on what the customer actually authorized and how the agent acted. The legal answer is unsettled. The route banks describe as permitted is customer-authorized data sharing through approved open-banking providers, often read-only.

"A prompt-injection classifier is a useful control, but it is not an authorization model. Design the agent for the day the model is fooled: restrict its credentials, separate its permissions from the user's, require approval for irreversible actions, and make every tool call observable."

Why a credential is not consent

Strong customer authentication answers whether this is the right person. It does not answer whether that person authorized this agent to take this irreversible action. Agent mandates should be scoped, revocable and logged, not a blanket delegation of the customer's login.

"Strong customer authentication answers 'is this the right person?' It does not answer 'did this person authorize this specific agent to take this specific irreversible action?' Agent mandates should be scoped, revocable and logged, not a blanket delegation of the customer's login."

Who is liable when an AI agent moves money?

The sources reviewed do not establish who bears the loss when an agent-initiated transfer goes wrong. In the US, Regulation E turns on whether a transfer is unauthorized, which depends on facts such as how credentials were obtained and what authority was granted. Wells Fargo's agreement seeks to treat agent transactions as authorized by the customer, subject to applicable law. For EU and Swiss institutions, the answer depends on the payment rules, the contract and the facts of each case. It should be checked with counsel before a product launches.

"Where liability is unsettled, the worst strategy is to wait for a court to define your control environment. Build the record now: a scoped mandate, separated credentials, approval before irreversible actions, immutable logs, vendor incident duties and a tested kill switch. Those records will not decide liability alone, but they will determine whether you can defend your decisions."

What do AI agents and the AI Act mean for my risk, my audit and my board?

Leaders rarely ask about the Act itself. They ask about the exposure behind it. The table maps each pain to the question underneath and to the evidence you should be able to show.

Each row is a question of evidence before it is a question of law.

The control question is authorization, not login

"The bank-login story is not primarily an AI-security story. It is an authorization-design failure. If an agent can use a customer's password, initiate a payment, and leave no machine-readable record of who mandated it, within what limit, and who approved the irreversible step, then the institution does not have an AI control problem. It has an evidence problem."

What are the key AI Act and FINMA dates to know now?

1. 18 Dec 2024FINMA publishes Guidance 08/2024
2. 2 Feb 2025AI Act ban on prohibited practices and AI literacy duty apply
3. 27 Jul 2026Digital Omnibus on AI enters into force
4. 2 Aug 2026Article 50 transparency duties apply
5. End of 2026Swiss consultation draft planned

• The EU AI Act is in force. Its ban on prohibited practices and its AI literacy duty have applied since 2 February 2025.
• The Digital Omnibus on AI entered into force on 27 July 2026. It moved the high-risk deadline for stand-alone systems to 2 December 2027.
• Transparency duties under Article 50 apply from 2 August 2026, with a grace period until 2 December 2026 for certain systems already on the market.
• Switzerland has no AI Act. FINMA Guidance 08/2024, published on 18 December 2024, applies existing governance rules to AI at supervised institutions.
• The Swiss Federal Council plans a consultation draft by the end of 2026 to implement the Council of Europe AI Convention through sector laws.

Delay is not exemption. The duties stay the same once they apply, and the inventory and evidence work takes longer than the lead time.

Which EU AI Act duties apply now, and which come later?

Duties depend on your role (provider, deployer, importer or distributor) and on the risk class of each system. The table shows the main dates.

Fines for prohibited practices reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher.

Do AI agents have to say they are AI?

Article 50 requires people to be told when they are interacting with an AI system, from the start of the first interaction. The Commission's FAQ on Article 50 lists AI agents alongside chatbots and avatars as systems that interact directly with people. It says systems operating only in the background, or through machine-to-machine communication, fall outside the duty. The FAQ does not address agents separately beyond that.

For agent products, a footer in the terms of service is a weak answer. The practical reading is that disclosure belongs where the agent asks for credentials or consent, prepares an irreversible action, or reports what it did, because those are the moments a person is interacting with it. The legal line for agents is not yet settled.

Did the Digital Omnibus cancel the AI Act deadlines?

The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and entered into force three days later. It changed three things that matter for planning:

• The Annex III high-risk date moved from 2 August 2026 to 2 December 2027.
• The Annex I high-risk date moved to 2 August 2028.
• The AI literacy duty now asks organizations to take measures that support literacy, rather than guaranteeing a sufficient level of literacy for each person.

The Omnibus is a timing and simplification instrument, not a repeal. Read the final Official Journal text before you rely on any date here, because law-firm summaries can differ on detail.

Scope: when a Swiss company falls under the AI Act

The AI Act does not depend on where a company is incorporated. It applies when an AI system is placed on the EU market, when a deployer is located in the EU, or when the output of a system is used in the EU.

A Swiss company with EU customers, an EU subsidiary, or EU users of an AI-enabled product is in scope. A Swiss company whose systems serve only Swiss users is outside the AI Act. It remains subject to the revised Swiss FADP and, if supervised, to FINMA's expectations.

What does FINMA expect from AI, and will Switzerland pass an AI law?

Two tracks run side by side.

Track one: existing rules, applied to AI. FINMA published Guidance 08/2024 on 18 December 2024. It applies to the institutions FINMA supervises and states that no specific Swiss AI law exists, so existing governance and risk-management requirements apply to AI. Its main expectations:

• Central management and accountability, a documented AI policy, and staff training.
• An understanding of every AI solution in use, whether built internally or bought from an outsourcing provider.
• Risk classification by materiality, considering customer impact, complexity, explainability and data type.
• Explainability: understanding how an application works, not only checking its outputs.
• Ongoing adversarial and stress testing, backtesting, and fallback mechanisms.
• Continuous monitoring of performance, data quality and robustness.
• Contractual and liability management with third-party AI providers.

The revised FADP, in force since 1 September 2023, already requires that individuals be informed about automated individual decisions.

Track two: a future law. On 12 February 2025 the Federal Council decided against broad horizontal AI regulation. Switzerland will not have a Swiss equivalent of the EU AI Act. It will implement the Council of Europe AI Convention through targeted amendments to existing laws. The Federal Department of Justice and Police is drafting a proposal, with public consultation targeted for the end of 2026. Expected areas include data protection (possibly restricting AI-driven facial recognition and extending privacy impact assessments), transparency and labeling of AI-generated content, and targeted rules for finance, healthcare and digital platforms. The Federal Council has not yet decided the final content.

How do GDPR, DORA and ISO/IEC 42001 fit into AI governance?

Most AI governance questions touch other rules, so map them together.

• GDPR: where an AI system processes personal data, a DPIA under Article 35 is usually needed. Article 22 limits decisions based solely on automated processing that significantly affect people.
• DORA: applies since 17 January 2025 to EU financial entities. AI services bought from vendors are usually ICT third-party services, so they fall under third-party risk and contract requirements.
• ISO/IEC 42001:2023: the AI management system standard. It is certifiable and gives a strong evidence base, but it is not a harmonized standard under the AI Act. Certification does not by itself establish conformity.

What must an AI register contain to pass an audit?

Each AI system needs one record. The table lists the minimum fields and why they matter.

A fundamental-rights impact assessment under Article 27 applies to certain deployers, such as public bodies and providers of credit scoring and life and health insurance pricing systems.

"Readiness is not a state you reach. It is a property of your records. If your evidence only exists because someone assembled it for the audit, you were never ready; you were prepared."

How do you keep humans in control of AI, and handle incidents?

A register is a snapshot. The control question is whether a named person can act on a system between reviews. Human oversight means approving a specific action, not a general objective. "Find a better return" is an objective. "Move this amount to this account" is an action. Approval should be bound to the action that actually executes, which is the lesson the agent story makes concrete.

"Human oversight is not a person watching a dashboard. It is a named person with the authority, the information and the ability to stop a specific action before it executes. If your oversight model cannot answer 'who can halt this transfer, on what evidence, and how quickly?', it is theater."

Incident deadlines depend on severity, and the most severe cases have the shortest windows. Agree the trigger and the owner before an incident happens.

Acuna GRC's AI Governance module keeps this record in one place. It holds each AI system with its classification and rationale, impact assessments that must be approved before a system can be marked approved for use, named overseers with stated authority, and AI incidents that create a linked issue. Its public contestation channel is reachable without an account and has a 30-day response target. For serious incidents, the module sets a notification clock of 72 hours after discovery, mirroring the GDPR breach window. Check the deadlines that apply to your case. The module keeps the operational records. It does not certify conformity with any law or standard.

AIS-002CV screening assistantProvider: Vireo HR SA · Role: Deployer

1. Draft
2. In assessment
3. Approved for use

Approved for use opens only once the impact assessment is approved.

Classification

Annex III employment useHigh-riskRationale: ranks job applicants for recruiters.

Impact assessment

Approved by a reviewerApprovedIts approval unlocks Approved for use.

Human oversight

Marie DuboisOverseer · Head of recruitment

• Can override an outcome
• Can suspend the system

AI incident

Serious incident

Notification due

72 h after discovery

Linked issue

ISS-017

Contestation

AIC-2026-001Received

Response target

30 days

Channel

Public, no account needed

Sample company · Brenvara AG

How do you start AI governance in 90 days?

1. Days 1 to 30: inventory every AI agent and AI feature, including those inside SaaS products and tools staff use without approval.
2. Days 31 to 45: classify each agent by autonomy, the actions it can take, whether it touches money or personal data, and its AI Act role and risk tier.
3. Days 46 to 60: define mandates: scope, amount and time limits, and how the customer or manager revokes them.
4. Days 61 to 75: separate agent credentials from user credentials, and require approval for irreversible actions.
5. Days 76 to 90: test a kill switch, confirm the logs can reconstruct each decision, and run a tabletop exercise on a disputed transfer.

How AI governance connects to GRC

AI governance is not a separate program. It runs on the same chain as every other control: a requirement is met by a measure, a measure is verified by a control, and a control is performed through recurring tasks, with records as proof. An AI system is one more object in that chain. Its risk is an ordinary risk, its overseer is an ordinary assignment, its vendor is an ordinary third party, and its incident is an ordinary issue.

That is why the authorization question from the agent story is a GRC question. Each agent needs an owner, a documented mandate, limits on what it can do, a way to stop it, and records of what it did. Those are the same elements as any access control, applied to software that makes decisions.

The four mandate tests

Acuna GRC proposes four tests for any AI agent that touches a customer account or a payment. Each test should produce a record an auditor can read.

1. Identity: is the agent acting as the customer, as the institution, or as an independent third party?
2. Mandate: which actions, amounts, counterparties, accounts and time window did the customer authorize?
3. Boundaries: which technical and contractual limits stop the agent from exceeding that mandate?
4. Evidence: can the institution reconstruct the instruction, the permissions in effect, the approval, the execution and the outcome after the fact?

How Acuna GRC helps you answer these questions

Acuna GRC is a cloud platform for governance, risk and compliance. Its AI Governance module covers the points above:

• Inventory: a register of the AI systems you build, buy or deploy, with the provider, the level of autonomy and the people affected.
• Assessment before use: impact assessments with screening and reviewer approval. A system cannot be marked approved for use until its assessment is approved.
• Human oversight: named overseers with a stated kind of oversight and an explicit authority to override or suspend, recorded with an effective date.
• Supplier evidence: provider questionnaires on training data and safeguards, linked to the AI system through TPRM.
• Incidents and contestations: AI incidents that create a linked issue, a 72-hour notification clock for serious incidents, and a public channel for people affected by an AI-assisted decision, with a 30-day response target.
• Audit trail: an export of every change to assessments, oversight, incidents and contestations for a date range.
• Gap finding: Aiko, the built-in assistant, lists the open gaps in the AI register. By default it asks before it changes anything.
• Customer questions: the Trust Center drafts security and compliance answers from one approved library, so answers match the evidence behind them.

AI systemAI Governance

CV screening assistantAIS-002

Provider

Vireo HR SA

Data Provenance

Collected

Linked providerIts supplier assessment is the evidence

Third partyTPRM

Vireo HR SASupplier assessmentCompletedProvider questionnaire

• Training data
• Safeguards

Answers and files kept as evidence.

Sample company · Brenvara AG

AikoAsk me first

What is missing for my AI conformity?

AI GovernanceI found 3 open gaps in your AI system register.

• AIS-003Invoice matchingNo overseer at all
• AIS-004Contract summariesImpact assessment not approved
• AIS-001Support chatbotProvider questionnaire missing

Shall I create a task for each gap? Nothing changes until you confirm.

Ask me first: Aiko prepares each change for you to confirm.

Sample company · Brenvara AG

What a program records for each agent

• The agent's owner, purpose, level of autonomy, and the accounts or systems it can reach.
• The customer's mandate: the instruction, the scope, the amount and time limits, and how it is revoked.
• Execution controls: separate credentials, least privilege, transaction limits and approval for irreversible actions.
• The evidence trail: the instruction, the permissions in effect, the approval, the tool call, the payment instruction and the outcome.
• The incident path: who can suspend the agent, how the customer and the vendor are notified, and the root-cause record.

The AI Governance register holds the system, its autonomy, provider, impact assessment, overseers and incidents. Mandate limits, execution controls and transaction logs sit in the systems that run the agent and the payment. They need to be connected to the register, not assumed to exist.

Acuna GRC keeps the operational records. It does not certify conformity with any law or standard, and it does not replace legal advice. Its job is to make the evidence exist before an auditor, a customer or a regulator asks for it.

The question to ask

"AI governance fails in the gap between a policy document and an executable action. The question is not whether you have an AI policy. It is whether, at the moment an agent prepares to move money, your system can show the mandate, enforce the limit, obtain the approval and preserve the proof."

Sources

• Sidley: EU lawmakers reach provisional agreement to delay key AI Act obligations (22 June 2026)
• Lewis Silkin: the Digital Omnibus on AI enters into force (27 July 2026)
• FINMA press release on Guidance 08/2024 (18 December 2024)
• MLL News: summary of FINMA Guidance 08/2024
• Homburger: Swiss AI regulation, tailored rules instead of a Swiss AI Act
• Axios, Madison Mills, "Unvetted AI agents are accessing U.S. bank accounts" (22 October 2026), and Reuters' same-day pickup, as relayed in syndicated copies
• Regulation (EU) 2024/1689, the AI Act: EUR-Lex