Is someone in your finance team already letting an agent into the company bank account?
Corporate treasury faces the same contract as retail customers, and every action taken with a staff login counts as authorised.
Sign up for my Substack daily AI newsletter https://johanosteyn.substack.com
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
Somewhere in a South African company, a finance officer is tired of downloading bank statements, reconciling them by hand and keying in supplier payments. A new AI assistant offers to do it all if she will only give it her banking login. It is a reasonable request from a useful tool. It may also be the most consequential access decision the company makes this year, and nobody on the board will know it was made.
CONTEXT AND BACKGROUND
In the United States, the largest banks have started noticing these agents. In one week in mid-October, JPMorgan Chase, Citigroup, Bank of America and Charles Schwab moved to restrict outside AI agents from accessing accounts or moving money, and Schwab said it blocks unauthorised agents "in the tens and twenties each week". The difficulty is simple. The agents log in with the customer's own credentials, so the bank cannot reliably tell a person from software acting for her, and most banks' terms require customers to log in themselves.
The agents are arriving through ordinary products. Meta's Muse assistant, launched in the United States in September, works inside WhatsApp, can make payments, and is set to gain support for password managers that would let it use saved logins. In a country where business runs on WhatsApp, it would be unwise to assume these tools will stay in America.
INSIGHT AND ANALYSIS
South African bank terms have already answered the question US banks are now debating. A consumer note from the Ombudsman for Banking Services quotes standard internet banking terms stating that if someone else uses your access details, "we will regard you as having authorised this person to use the access channel", and that the customer escapes this only by showing the bank was negligent. Written for fraudsters, that clause applies equally to software. An agent given a staff member's password is, for the bank's purposes, that staff member.
Business banking terms vary, and I would not assume they are kinder. If an agent pays the wrong supplier, misreads an instruction or is manipulated by a malicious invoice, the company may find it hard to argue the payment was unauthorised when its own employee handed over the keys, although the outcome will turn on its mandate with the bank and the facts.
I have previously written about this risk inside organisations, arguing that every AI connection an employee approves is an access decision closer to handing a third party a set of keys. The bank login is the most valuable key of all.
The fair objection is that sharing a banking password has always been forbidden, so nothing has changed. The difference is scale and intent. Fraudsters had to trick people into handing over credentials. Agents will be invited in by employees trying to do their jobs well. Larger companies may answer that their treasury desks already connect to the bank through host-to-host links or approved interfaces, and that crime or cyber insurance would respond to a loss. Both may be true at head office. Neither covers the subsidiary, the smaller firm or the finance officer who finds a quicker route. Regulators expect it. The Financial Conduct Authority in the United Kingdom has warned that consumers may accept agents' permission requests as casually as they accept web cookies.
IMPLICATIONS
The proper fix is delegation that does not involve a password. The FIDO Alliance, a standards body, has formed working groups because current authentication assumes a human is acting, and services have no reliable way to confirm who authorised an agent, under what conditions and within what limits. South Africa has no regulated open finance framework yet; the National Treasury's 2026 Budget Review says the Intergovernmental Fintech Working Group will continue developing one during 2026, built on customers sharing data with their explicit consent. Until scoped access exists here, the password will be the default.
Boards should act on three things. First, ask the chief financial officer whether any AI tool has been given banking credentials, and prohibit it in writing until the bank offers a sanctioned channel. Second, ask the company's bank what its terms say about agents, and what read-only or delegated access it plans to offer. Third, set approval limits that require a named person to release every payment, whatever prepared it.
CLOSING TAKEAWAY
The question is not whether agents will reach company bank accounts. It is whether the board finds out before or after the first payment goes wrong. South African bank terms have largely decided who carries that loss. The only remaining choice is whether the company makes the access decision deliberately or leaves it to whoever was most eager to save an afternoon.
Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence's impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan's work at https://www.aiforbusiness.net
Comments