Agentic AI in Banking: Who Holds the Risk?
.avif)
A bank could stop an unauthorized transfer and still lose deposits to an agent following its instructions. Money20/20 brought both sides of that possibility into view: the controls needed to let agents act, and the banking assumptions that could change once they do.
- Deposit flight: easier delegation could make balances less predictable.
- Customer relationships: assistants could influence where people save and borrow.
- Access controls: instructions need enforceable limits.
- New business: banks could provide the accounts, payments, and support that agents need.
When the Agent Finds a Better Rate
Plaid CEO Zach Perret gave an example of how customers could use an AI agent to manage their accounts. A customer could ask it to keep $5,000 in checking, move any extra money into savings, and move money back whenever checking falls below that amount. The agent would handle those transfers automatically, instead of the customer doing them manually.
Perret was describing transfers between checking and savings. But what if a customer also allowed the agent to compare savings rates across banks and move money to a better offer? Switching providers could become a routine part of managing money, rather than something the customer has to research and arrange. For banks, that is the first risk: deposits walking out not because trust broke, but because the work of moving them disappeared.
That changes the question from "How do we build an assistant?" to "Why would the assistant keep the customer's money here?" Rates would be one answer; the bank's wider usefulness to the customer is the other.
What Makes the Relationship Worth Keeping?
Perret argued that banks could enable routine activity through external assistants while retaining conversations where they add more value:
“I would want the mortgage conversation actually to happen in my four walls as opposed to outside.”
- Zach Perret, CEO, Plaid
The wallet discussion offered a reason those conversations might stay. J.P. Morgan’s Global Head of Commerce Solutions, Kate Walton described continuing demand for human support when customers face complicated business needs or greater risk.
Banks, therefore, have two related jobs: make straightforward tasks easy to delegate and remain useful when the customer needs judgment or help. A smooth handover between those experiences depends on knowing what the agent was authorized to do.
A Prompt Is Not a Permission System
On the geopolitics panel, Carole House, CEO of Penumbra Strategies told the story of an AI agent that deleted an entire code database, even though it had been told not to. Her conclusion:
“A prompt is not an access management control.”
- Carole House, Penumbra Strategies
The distinction sharpens the point made by Gareth Davies, Chief Product Officer at Auth0, part of Okta:
“Identity isn’t just an access problem, it’s an authorization problem.”
- Gareth Davies, Auth0
.avif)
Asking an agent to stay within a spending limit is different from enforcing that limit in the system executing the payment. Davies described controls that monitor agents during a task and stop unexpected behavior before completion.
Visa’s Trusted Agent Protocol helps merchants recognize approved agents and verify signed requests. Banks still need permissions customers can understand, withdraw, and review afterward.
Who Handles the Refund?
Even a payment made within those permissions can lead to a dispute. Uphold Chief Product Officer Paul Unterberg, brought the discussion back to chargebacks, returns, and existing protections:
“All of those layers still have to exist in an agentic world.”
- Paul Unterberg, Uphold
Behind that customer support sits the accounting. “The Payments Supermarket” reached a related concern through stablecoins: finance teams need transactions they can reconcile, integrate into existing systems, and explain to auditors.
These requirements could become part of the banking opportunity. Dependable records and dispute support would give businesses more confidence to let agents transact.
The Services Around the Agent
Jegen framed the emerging market around “how they pay, how they are insured, and how they bill." His liability concerns also connect with what we heard at ITC Vegas, where speakers questioned whether past losses could adequately guide decisions about emerging AI exposures.
For banks, controlled accounts and payment services could offer new business alongside customer-facing assistants. Yet those opportunities need to be considered against the possibility that agents also make deposits easier to move.
Where to Go From Here
Every session pointed at the same shift: the risk in agentic AI is moving from the technology to the balance sheet. Deposits become easier to move, relationships easier to lose, and liability harder to assign, while the institutions that solve those problems find new business on the other side of them.
A useful starting point is one customer journey examined from both directions: what would make delegation attractive, and what could it change for the bank? Our Megashifts Rebuilding Financial Services report places agentic AI alongside changes in embedded finance and payment infrastructure, and Trendtracker's banking intelligence helps teams follow those signals as they develop. That gives strategy, treasury, and risk teams a grounded way to decide which risks to accept, which to engineer away, and which to turn into the services customers will need to trust.
