Banks are blocking the AI agents they can see. The ones inside operations are the harder problem.

1What happened in October

The sequence was short. On 13 October, on JPMorgan's earnings call, Jamie Dimon said the bank would not let outside agents log in to customer accounts. On 16 October Citi restricted third-party agents, with Bank of America reported alongside it. On 22 October Axios and Reuters reported that several major US banks had found unauthorized agents operating inside customer accounts, some of them appearing to act beyond what the customer had asked for, and were blocking them and changing their terms of service. Morgan Stanley and Wells Fargo were named in the same coverage.

None of the reports established widespread losses. What they established was simpler: the banks could see agents arriving at the customer door, could not tell what each one had been authorized to do, and chose to close the door while the industry works that out.

The industry's answer is identity. Know-Your-Agent frameworks from the card networks aim to make an agent as verifiable as a cardholder, so that a bank can authorize or decline it with the same confidence it applies to a person. That is the right answer to the question the banks asked in October. It is the answer to a different question from the one examiners will ask in 2027.

2Two different problems

The October story was about agents at the customer door: software a customer installed, arriving at the bank's login page and asking to act on the customer's behalf. Identity is the whole problem there. Once the bank knows who the agent is and what it was authorized to do, the rest is the same authorization decision the bank already makes thousands of times a day.

The agents inside the bank's own operations are a different case. They were not installed by a customer. They were introduced by the bank, by its vendors, or by a platform upgrade, into onboarding, payment exceptions, document checks, KYC refresh and servicing queues. McKinsey puts end-to-end operations at an estimated 60 to 70 percent of a bank's cost base, which is why that is where the agents went first.

Nobody doubts who these agents are. The question is what they did. Which cases did the matching agent decide on its own, and which did it hand back to a person after three retries? Did the document agent's new model version on the ninth of the month change the share of applications that needed a second review? Did the case that an examiner has just asked about pass through an agent at all, and if so, what did the agent see and conclude?

Identity tells you which agent was in the room. It does not tell you what the agent did to the case, what that cost, or whether the work got better.

3What the guidance leaves open

On 17 April 2026 the Federal Reserve, OCC and FDIC replaced the fifteen-year-old model-risk guidance, SR 11-7, with SR 26-2 and OCC Bulletin 2026-13. The new guidance states, in both its highlights and its background, that generative and agentic AI are novel and rapidly evolving and are not within its scope. The agencies said they plan a separate request for information on how banks use AI, including agentic AI. As of this writing it has not been issued.

Two things follow. First, a bank running agents inside operations today is governing them under its own policy, not under a supervisory standard. That is freedom and exposure at the same time. Second, the request for information will ask banks what they can already evidence, and the answer that will not survive is a vendor dashboard showing green.

The precedent is the loan-servicing experience we described in an earlier article: when an examiner asks how a specific case actually progressed, most institutions can produce only a partial timeline assembled after the fact from logs, emails and case notes. Agents make that worse, because the agent's reasoning and retries sit in yet another system that the case file does not reference.

4Four questions per agent run

Strip away the vocabulary and a bank needs to answer the same four questions about an agent that it would ask about a new team or a new system. We state them the way the operations head would, not the way the model platform would.

Did the cases close faster?

Not the agent's latency. The cycle time of the cases the agent touched, compared with the cases it did not, on the same definitions the bank already uses for SLA reporting.

Where did people step back in?

Every hand-back from an agent to a person, counted by case and by reason. Three retries and then a reviewer is a measurable event, and it is the one that tells you where the agent's judgment ends.

What did each outcome cost?

Model cost per case, not per token. A cheaper model that produces more hand-backs can cost more per closed case than the one it replaced.

Did last week's change help?

When an agent moves to a new model version, the bank should be able to say whether straight-through rate, hand-backs and error rate moved outside their normal variation, or did not.

These are not new questions. They are the questions a bank asks about any change to a process. What is new is that the answers are spread across a model platform, an agent framework and a case system, each of which is right about its own layer and silent about the others.

5Why the dashboards cannot answer them

The model platform reports tokens and latency. The agent framework reports runs and errors. The business system reports cases closed. All three can be green on the same day that onboarding got slower, because none of them connects an agent's retry to the customer who waited for it.

The way through is not another dashboard. It is the approach banks already use to understand people and systems: reconstruct each case from the records the bank keeps, and place the agent's steps in that reconstruction alongside the human and system steps. A case then reads as one timeline: received, checked by the intake agent, matched, handed back to a reviewer after three retries, approved, closed. The agent is a participant in the process, measured the same way as everyone else in it.

Once the agent is in the case timeline, the four questions become ordinary queries. Cycle time of agent-touched cases against the rest. Hand-backs by agent, by reason, by week. Cost per closed case rather than per call. And a before-and-after on any model change, read against the normal variation of the measure, so that a real shift is not confused with noise and noise is not chased as a problem.

6Where to start

A bank does not need an agent governance program to begin. It needs one workflow where agents already run, and the records that workflow already produces.

1. Pick the workflowOne process where an agent already handles real cases: document checks in onboarding, payment exception triage, KYC refresh. The best candidate is the one where nobody can say today how often the agent hands back.
2. Connect read-onlyThe case system, the agent framework's run log and the model platform's usage records, read-only, with nothing written back. The agent's steps join the case timeline through the case reference they already carry.
3. Establish the baselineCycle time, hand-back rate, cost per closed case and error rate for agent-touched cases, with their normal variation, before anything is changed.
4. Read the first changeThe next model version, prompt change or routing rule is then measured against that baseline, case by case, and the answer to "did it help" is a number rather than an opinion.

The October decisions were about agents the banks could see. The ones they cannot yet see are already inside, closing cases and handing them back, and the records to see them with are already being written.