Citi and Bank of America are restricting outside AI agents’ access to customer accounts, putting a practical limit on the promise of software that can manage someone’s finances for them.
MoonPay is building for that promise. In Blockster’s recent TOKEN2049 interview, its Global Head of AI and Ecosystems, Halsey Huth, described agents making payments with permissions users control. The contrast raises a more useful question than whether to trust AI with money: what authority should an agent have, and when should a person approve the action?
The Financial Times reported the restrictions on October 16. Citi bars third-party agents from logging into accounts or transacting on its digital platforms. Bank of America has restricted access while working through responsibility for agent-authorized payments.
For customers, the question is straightforward: if an assistant can find a better place for your money, who gets to approve moving it—and who answers when the transfer goes wrong?
Reading an Account Is Different From Moving Money
Citi still allows customers to authorize limited, read-only access through certain open-banking providers, FStech reported. That distinction separates permission to inspect financial information from permission to act on it.
A budgeting service might need transaction history to categorize spending. An assistant moving surplus cash to another institution would need authority over an actual transfer. One permission does not automatically establish the other.
Bank of America CEO Brian Moynihan described the bank’s position in an October 14 CNBC interview, quoted by FStech:
“We strongly believe there should be a human in the loop to authorise money moving out of your account.”
— Brian Moynihan, CEO of Bank of America, speaking to CNBC
Post from @FTView the original post on X↗
Why Banks Care About Where Idle Cash Goes
Security is one part of the debate. The economics of deposits are another.
In September, Apollo chief economist Torsten Slok warned that agents optimizing household cash could erode the cheap deposits banks use to fund lending, Barron’s reported. That is a scenario about potential behavior, not evidence that agents have already caused a bank run.
Consider an illustrative $20,000 balance. At a hypothetical 0.1% annual rate, it earns $20 over a year. At 4%, it earns $800—a $780 difference, before taxes or fees and ignoring compounding. These are examples, not current account offers.
For the saver, automatically finding and acting on that difference could be useful. For the bank losing the deposit, it could mean replacing a cheap source of funding or paying more to retain the customer. The competitive pressure exists even when the transfer is deliberate and works exactly as intended.
The calculation also shows why a financial assistant needs more than a rate comparison. A customer may have left that balance in place for upcoming bills. A successful transfer can still be the wrong decision if the agent misunderstands what the money is for.
MoonPay’s Counterpoint: Give Agents Permission to Act
In Blockster’s TOKEN2049 interview with MoonPay, Sina Sadrzadeh asked Halsey Huth whether he would trust an agent with his money today.
“Yes. Very much yes.”
— Halsey Huth, MoonPay’s Global Head of AI and Ecosystems, speaking to Blockster
Huth described using agents connected to PayBox for financial activity and a wider ambition: assistants that can book trips, buy services and complete payments. His examples included small USDC payments for information and card payments for purchases.
MoonPay’s proposed answer is to limit the authority an agent receives. PayBox’s product description sets out spending caps, permissions that can be revoked, and both automated and manually approved workflows. It says agents do not receive private keys, while its card examples use credentials limited to a merchant and amount. These are the company’s described controls, not an independent guarantee against mistakes.
Huth also drew a line between a recurring report costing a few cents and a substantial investment. For the latter, he told Blockster:
“you’ll definitely want to have that manual approval in there.”
— Halsey Huth, on substantial investment purchases
That qualification brings his position closer to Moynihan’s. The point of disagreement is how much activity should be allowed under permissions granted in advance. PayBox’s supported payment connections also differ from an outside agent logging into a bank account with a customer’s password. The interview does not establish that Citi or Bank of America permits PayBox to access deposit accounts.
Watch Blockster’s interview with Huth:
Post from @BlocksterComView the original post on X↗
Citi Is Building Its Own Agents
Citi’s position on outside access sits alongside a substantial internal AI program.
In its April announcement of Arc, the bank described a platform for building and deploying agents within its risk framework. Planned tasks included research, preparation and execution.
“Every agent will be monitored, auditable and governed.”
— Citi, announcing its Arc AI-agent platform, April 30, 2026
The bank also said more than 80% of the 180,000 employees with access to its AI tools used them regularly. That figure describes use of the broader toolset, not the number using autonomous agents.
The distinction is control: Citi can set the scope of an internal system, monitor its activity and decide where it belongs in a workflow. An outside assistant arriving with a customer’s credentials presents a different access decision.
JPMorgan’s Jamie Dimon has voiced similar concerns about outside agents. Fortune’s October 15 coverage described his warning about client risk and JPMorgan’s restrictions on third parties collecting banking credentials.
Identity Is Only the First Check
The problem extends beyond proving that an agent represents a real person.
An IMF note on agentic payments separates the process into intent, authorization and settlement. It highlights the difficulty of connecting probabilistic AI decisions to payment systems that require clear authorization, traceability and finality.
That framework makes the practical questions easier to see: What did the customer ask for? Which account and amount did they authorize? What record establishes why a payment happened? Who can stop the next action if the first one is wrong?
Blockster’s coverage of World’s new banking verification suite examines ways to establish human presence and connect agents to verified people. XDC’s integration with Concordium tackles verified ownership for agents operating on its payments marketplace.
Those tools address identity. A bank must still decide whether a specific action is permitted. Neither integration establishes approval to access a Citi or Bank of America account.
Which Approach Holds Up?
Our assessment: the banks have the stronger case against unrestricted account access; MoonPay makes the stronger case for allowing narrowly defined tasks with enforceable limits. A small research budget and authority to transfer someone’s savings deserve different levels of control.
Blanket restrictions can stop useful activity along with dangerous activity. But a spending cap alone cannot establish that a purchase was sensible, that a recipient was correct or that someone will reimburse the customer after an error. Protecting credentials helps; it does not prove the agent understood the instruction.
The commercial incentives deserve scrutiny too. Banks benefit from retaining low-cost deposits. MoonPay benefits if more financial activity runs through its products. Neither incentive settles whether a particular action is safe or in the customer’s interest.
The most defensible direction is limited, revocable permission for routine tasks, with explicit approval for consequential or unusual actions. Responsibility for errors needs to be clear before money moves. MoonPay’s interview offers a practical account of how that could work; the banks’ objections identify what providers still have to demonstrate. Neither side has established that its approach resolves every failure case.
Reporting by Sasha Steenkamp
