RBC and BMO have implemented blocks to prevent third-party personal AI agents from accessing their digital banking platforms. These measures, announced on Wednesday, are designed to safeguard client information and prevent unauthorized transactions executed by automated tools.
RBC and BMO shut the door on third-party AI agents
The Royal Bank of Canada (RBC) and the Bank of Montreal (BMO) have officially restricted third-party AI agents from interacting with their authenticated digital properties. According to a report by The Canadian Press, RBC spokesperson Jeff Lanthier confirmed that the bank has blocked these tools from direct access to online banking to ensure client safety. BMO spokesperson John Fenton echoed this stance, stating that the bank does not permit AI agents to execute transactions or access digital properties to protect its customers.
While these AI agents are designed to act on behalf of users to retrieve data or perform financial tasks, the banks view this delegation of authority as a critical vulnerability. RBC noted that while this decision might be disappointing to some, it only affects a "small portion" of their total client base. By cutting off these third-party pathways, RBC and BMO are effectively drawing a hard line between user-led authentication and machine-led automation.
Dave McKay’s priority: Security over AI speed
The strategic reasoning behind the ban was highlighted by RBC CEO Dave McKay in a recent LinkedIn post. McKay argued that while the time-saving benefits of artificial intelligence are evident, the security of client informaion must remain the primary concern. He suggested that for AI to successfully integrate into the broader economy, the industry must establish trust alongside technical capability.
This perspective reflects a cautious approach to the "agentic" era of AI, where software no longer just provides answers but takes actions. For an institution like RBC, the risk of an AI agent being manipulated or compromised outweighs the marginal efficiency gains reported by a small group of tech-savvy users. This move signals that Canada's largest lenders are not yet convinced that third-party security protocols are sufficient to handle authenticated financial access.
The tension between automated finance and authenticated security
The decision by RBC and BMO is part of a larger global struggle within the financial sector to balance innovation with risk management. As reported by The Canadian Press, financial institutions are currently weighing the potential for AI-driven efficiency against the heightened risks of data breaches and account takeovers. AI agents, by their nature, require high-level permissions to be useful, which creates a massive attack surface for bad actors.
This conflict mirrors previous battles over "screen scraping" and open banking in Canada. For years, Canadian banks have been more conservative than their peers in the UK or EU regarding how third-party apps access account data. By blocking AI agents, RBC and BMO are doubling down on a closed-ecosystem model, ensuring that the only AI interacting with a customer's money is one developed and controlled internally by the bank.
Silence from TD, CIBC, and Scotiabank
Despite the clear positions taken by RBC and BMO, a significant portion of the Canadian banking landscape remains silent on the issue . TD Bank did not immediately respond to requests for comment, and other major players—including CIBC, National Bank, and Scotiabank—have yet to state whether they will follow suit with similar blocks.
This lack of a unified front leaves several questions unanswered. It remains unclear whether these banks are developing their own proprietary AI agents to replace the third-party tools they are banning, or if they are simply waiting to see the fallout from the RBC and BMO decisions.. Furthermore,the banks have not specified which exact "security concerns" triggered the ban—whether they are reacting to specific attempted breaches or acting preemptively against theoretical vulnerabilities.
Comments 0