Canadian Banks Are Blocking AI Agents: What Changed and What Builders Should Do

Which banks did what

The responses landed within days of each other in late October 2026, and they are not identical. Reading them side by side matters, because block, limit, and monitor are different engineering realities for anyone shipping an agent.

• RBC told employees in an internal memo on Tuesday, October 27, and confirmed in a statement the next day that it will "block third-party personal AI agents from direct access to authenticated RBC digital properties," including online banking, per Global News and The Canadian Press. Bloomberg reported the move on October 27.
• TD said it will "block all third-party personal AI agents from direct access to banking information" until safeguards exist, per Global News.
• BMO said it "does not permit AI agents to access our digital properties or execute transactions," and warned clients not to share sensitive information, including through AI agents.
• CIBC said it does not support personal AI agents directly opening or accessing accounts.
• Scotiabank said it will limit third-party AI agents on its banking platforms while it monitors the issue. That is a restriction, not a stated ban.
• National Bank said it is closely monitoring consumer AI agents and had not announced a block, per The Canadian Press.

Global News reported that all five of the largest banks first referred questions to the Canadian Bankers Association, which said it could not comment on members' operational matters. A spokesperson for Evan Solomon, the federal minister for AI and digital innovation, said Canadians should be extremely cautious about sharing banking passwords with anyone.

Why it happened now

Two threads converged. The first was consumer agents that can act on financial accounts. Global News described Meta's Muse as able to use banking and payment information to make purchases, and noted Meta's claim that a separate Sentinel agent must approve outbound actions. The second was the US. Axios reported on October 22, citing people familiar with the matter, that large US banks were detecting third-party agents in customer accounts, some taking actions that appeared independent of user instructions. Reuters said it could not immediately verify that report, and Morgan Stanley told reporters it had not found rogue agents on its platforms. Wells Fargo said it had taken steps to block unauthorized agents.

RBC's chief executive, Dave McKay, had flagged the issue a week earlier. The Logic reported that on October 20, in a Bloomberg Television interview, he raised unauthorized data access, fraudulent consent, and liability, and said the bank had not yet decided. By October 27 it had. In a LinkedIn post that evening, quoted by The Canadian Press, he wrote that "nothing is more important than the security of client information" and that "trust will matter as much as capability."

What makes the Canadian case different

The JPMorgan block drew a line at credential replay while leaving a sanctioned read-only path open through data connectors. In the Canadian coverage, no bank described an alternative channel for agents at all. The statements say what is blocked. None says what is permitted instead.

That gap has a structural cause. Canada has legislated a consumer-driven banking framework meant to replace password sharing with accredited, API-based data access, but industry trackers describe it as not yet operational in late 2026, with its planned prohibition on screen scraping not in force. So a Canadian personal agent that wants to act on a bank account has, today, roughly two options: log in as the customer, which the banks are now blocking, or do nothing.

Liability makes the picture sharper for users. Global News reported that transactions made with credentials a customer shared cannot be deemed unauthorized. In plain terms, the customer who hands an agent a password may carry the loss if the agent misbehaves. McKay's concern about fraudulent consent points the same way: a bank cannot tell a real delegation from a coerced or spoofed one when both look like the customer typing.

What agent builders should do in Canada

Treat the authenticated bank session as off limits and design around it. Concretely:

The broader lesson

Banks are not rejecting AI. RBC, by McKay's own account, invests heavily in it. They are rejecting an access pattern where an outside agent is indistinguishable from the customer. Every institution that holds money or sensitive records will eventually face the same question, and the answer is converging: identify the agent, scope what it can do, and keep a human on the irreversible step.

For the knowledge side of agent work, the same principle applies. An agent that needs reference material, such as fee schedules, product terms, or a household's past financial decisions, should read it from an index scoped to that material, not by reaching into a live account.