Major Canadian banks block third-party AI agents from accessing online accounts

TORONTO · Some of Canada's biggest banks say they will block third-party artificial intelligence agents from directly accessing their clients' online bank accounts. Royal Bank, TD Bank, CIBC and Bank of Montreal each say the decision is aimed at protecting sensitive information. The banks are specifically targeting AI agents that operate inside a customer's logged-in session, where authentication is required. The move follows reports of unauthorized AI activity in U.S. bank accounts and comes as consumer AI agents from large tech companies seek access to financial data.

"We understand that this may be disappointing for the small portion of our clients who use these tools, and we make this decision with the safety and security of our clients and systems at the forefront," RBC spokesperson Jeff Lanthier said in an email. He said Canada's largest bank by assets carefully weighed the risk of third-party personal AI agents in its decision to block these applications from its online banking platforms. RBC's decision followed a full security review of the technology and its functionality. TD spokesperson Ada Lovelace Rampersaud said her bank will block all third-party personal AI agents from direct access to banking information where authentication is required. "Our focus is on helping build a future where trusted AI agents can create meaningful value for clients while protecting their privacy, security and control over their financial information," she wrote. She added that clients should never share their TD login credentials, passwords, PINs or one-time passcodes with an AI agent.

CIBC spokesperson Deborah Rowe said her bank does not support personal AI agents directly opening or accessing accounts. "We are following developments in personal AI agents closely as these technologies evolve," she wrote. "Protecting clients, their accounts and their personal information is our priority, while we support innovation through secure, appropriately designed channels." BMO spokesperson John Fenton said the bank does not permit AI agents to access its digital properties or execute transactions in order to protect clients.

READ MORE: Canadian businesses grapple with AI shopping agents as Muse app leads market

READ MORE: RBC leads Big Five banks in customer satisfaction for third straight year

RBC chief executive Dave McKay framed the issue as one of trust in a LinkedIn post. "If AI is going to move beyond the frontier and into the broader economy, trust will matter as much as capability," he wrote. McKay acknowledged that AI could save time but warned that as systems become more autonomous, the stakes rise when something goes wrong. He cited risks from fraud and consumer harm to broader financial system instability.

Bank of Nova Scotia said it will limit third-party AI agents from its banking platforms while it monitors concerns. National Bank said it is closely monitoring development of consumer AI agents. The banks' actions target AI agents like Meta's popular Muse assistant, which can connect to bank accounts with a client's authorization to monitor balances and transaction histories. Last week, Axios reported that major U.S. banks had detected unauthorized third-party AI agents operating inside customer accounts, sometimes taking actions that appeared independent of user instructions. The Canadian Bankers Association, which does not comment on the operations of individual members, was initially deferred to by several banks when asked about similar activity.

"Clients should never share their TD log-in credentials, passwords, PINs or one-time passcodes with an AI agent or anyone else."

With files from The Canadian Press, CBC News and BNN Bloomberg