Oct 28, 2026
Royal Bank of Canada is blocking third-party AI agents from directly accessing its online banking services, citing security and privacy concerns as AI tools become capable of acting on behalf of customers.
The move comes as the Office of the Superintendent of Financial Institutions (OSFI) warns that agentic AI — systems that can take actions, not just generate answers — introduces cybersecurity and operational risks.
Advertisement
“People need to know what an agent is authorized to do on their behalf, what is influencing the choices it makes, and who is accountable when something goes wrong,” noted RBC CEO Dave McKay in a public LinkedIn post.
Thanks for subscribing!
The best of Money.ca delivered weekly.
By signing up, you accept Money.ca Terms of Use, Subscription Agreement, and Privacy Policy.
Why RBC is blocking AI agents — and what could go wrong
In a statement published October 27, RBC said it would block third-party personal AI agents from accessing its authenticated digital services, including online banking.
These agents can carry out tasks across websites, but doing so may require access to sensitive account information or login credentials. If an agent misunderstands an instruction or acts on inaccurate information, it could do more than provide a wrong answer.
“Agents can perform all the actions you can, including transferring funds out of your account,” Vincent Grégoire, Canada Research Chair in Finance and Technology at HEC Montréal, told Money.ca.
He warned that inappropriate transactions in registered accounts could also have significant tax implications.
Grégoire noted that while banks could potentially allow third-party agents with appropriate safeguards, whether or not that is prudent depends on the state of each bank’s systems.
Canada’s proposed Consumer-Driven Banking framework is intended to let consumers securely share financial data with approved providers, starting with read access and eventually extending to write access. That could create opportunities for AI agents, but also raises questions about how banks will manage access and system capacity as their use grows.
RBC customers can continue banking through the bank’s official website and mobile app and use its own digital tools. The restriction applies to third-party agents accessing authenticated RBC services, not AI tools generally.
Advertisement
Must Read
- A single line on your car insurance policy could be inflating your premium by up to 30% — here's what to change
- Here are 5 'must-haves' that Canadians constantly overpay for. How many of these are sabotaging your budget every single month?
- Here are the 5 biggest differences between rich and poor Canadians — which side do you fall on?
Join 20,000+ readers and get Money.ca’s best stories and exclusive interviews first — clear insights curated and delivered weekly. Subscribe now.
What OSFI is warning banks about
OSFI outlined the risks of agentic AI in a July 2026 technology risk bulletin. It highlighted concerns including excessive permissions, data leakage, unintended actions and weak oversight of third-party technology.
The regulator recommends safeguards such as limiting an AI system’s access, tracking its activity and requiring human approval for high-impact actions. OSFI reiterated concerns about advanced AI in its October 8 risk update, which highlighted potential cybersecurity, technology, third-party and reputational risks. OSFI was contacted for comment but said it would not be able to provide a response before publication deadline.
Assume you’re responsible for what your AI agent does
If you have connected a third-party AI agent to your RBC account, check what access it had and whether it stored your login details. RBC says those direct connections will stop working, but that does not necessarily mean a third-party provider has deleted information it already collected.
Customers at any bank should be cautious about giving AI agents access to financial accounts. If you have shared your banking password with a third-party tool, consider changing it and contact your bank if you suspect your account may be exposed. Review recent transactions and report suspicious activity promptly.
Grégoire cautioned that banks’ systems were not designed for AI agents to operate autonomously, and that consumers should expect some unpredictable behaviour from tools that are still developing.
That unpredictability matters when an agent has access to financial accounts. Depending on its permissions, a mistake could mean an unintended transfer or the exposure of sensitive personal information.
Responsibility for losses involving AI agents also remains unclear. Until the rules and safeguards are better established, Grégoire advises consumers to “act as if they are fully responsible for their agents’ actions.”
You May Also Like
- This 7-step plan from Dave Ramsey is designed to help you ditch debt, save more and build wealth — here’s how it works
- Prioritize these 4 critical investments and watch your net worth skyrocket
- Here are 8 solid money moves that could free up real cash every month — here's where to start
- Millionaires under 43 are reshaping investing — just 25% of their portfolios are in stocks. Here’s where their money is going
The most expensive financial mistakes are often the ones you don't see coming. Join 19,000+ Canadians who get the money moves, risks and opportunities shaping their finances — delivered free each week. Subscribe now.
Steven Brennan is a freelance finance writer based in Vancouver, BC. He holds a BA and an MA from Maynooth University, Ireland. His work regularly appears at Canadian Mortgage Trends, Lowest Rates, Loans Canada and other Canadian and U.S. brands.
