Citi is restricting AI agents from accessing customer accounts, according to the Financial Times.
The clearest window into Citi’s thinking came from CEO Jane Fraser at Sibos 2026 in Miami on September 30, 2026. Sibos is the annual banking and payments conference.
Fraser argued that autonomous AI agents need rigorous identity verification and authentication before they can execute transactions. That applies whether the agent is acting for a customer or for the bank itself.
Fraser said she was confident Citi could avoid the risks that come with uncontrolled agents. Her centerpiece was ARC, an internal platform Citi uses to monitor and govern AI agents.
“You cannot create an agent without going through ARC.”
ARC was introduced in 2026 and is mandatory for overseeing all of Citi’s internal AI agents.
Citi has been gradually rolling out governed AI systems internally since at least mid-2025, with an emphasis on compliance and oversight.
JPMorgan Chase CEO Jamie Dimon went further during the bank’s third-quarter earnings call on October 13–15, 2026. Dimon declared a total ban on external AI agents accessing JPMorgan customer accounts. His stated concern was the danger of “rogue agents.”
There is a difference in emphasis between the two banks. Dimon publicly prohibited third-party agents outright. Fraser’s public remarks have centered on strict internal governance rather than announcing an equivalent blanket ban on outside agents.
For companies building agentic AI tools for personal finance, this is a meaningful headwind. Many of the most compelling use cases involve an agent that can see and act on a user’s bank accounts. If the largest banks wall off customer accounts, those products lose access to a big chunk of the market.
For the banks themselves, governance isn’t free. Platforms like ARC require staff, systems, and ongoing monitoring.
Fraser’s emphasis on identity verification hints that the issue isn’t agents per se, but unverified ones. Unlike JPMorgan, Citi has avoided a public ban on external agents, instead focusing on internal controls.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.