How to Govern AI Agents That Act on Customer Accounts

Current as of October 30, 2026. This guide draws on the CFPB's Regulation E (12 CFR part 1005) and its official interpretation, FINRA Rules 3110 and 3260, FINRA's 2026 oversight report, a January 2026 FINRA blog post and Regulatory Notice 24-09, SR 26-2 and FIL-15-2026, NIST AI 600-1, and AI agent publications from NIST's Center for AI Standards and Innovation (CAISI), as published on that date. It covers US texts only and is not legal advice.

Banks and broker-dealers are testing AI agents that can move money, pay bills, place orders or change account settings. FINRA's 2026 oversight report, written for its member firms, says "AI agents are systems or programs that are capable of autonomously performing and completing tasks on behalf of a user." None of the rules reviewed for this guide mentions AI agents. This guide covers agents that can initiate or change something in a customer's account, whether the institution deploys them or the customer connects a third party's agent. General inventory, tiering and testing are covered in our guide to governing generative AI at a US bank after SR 26-2; this guide builds on its agents tier.

Unless a step quotes a rule, it is a recommendation, labeled (interpretation). Every application of Regulation E or FINRA Rules 3110 and 3260 to AI agents is interpretation, because none of those texts mentions AI.

On scope: Regulation E is a binding CFPB regulation that protects consumers, defined as natural persons. It covers consumer asset accounts "held directly or indirectly by a financial institution and established primarily for personal, family, or household purposes." It "applies to any electronic fund transfer that authorizes a financial institution to debit or credit a consumer's account", and section 1005.3(c) excludes transfers whose primary purpose is buying or selling a security or commodity regulated by the SEC or CFTC or traded through an SEC-regulated broker-dealer, and Fedwire-type transfers used primarily between institutions or businesses. An agent's securities trades generally fall outside Regulation E (interpretation). FINRA rules bind FINRA member broker-dealers. SR 26-2 and FIL-15-2026 are bank supervisory guidance, expected to be most relevant to banking organizations above an asset threshold set in the guidance; the FDIC states that "non-compliance with this guidance alone will not result in supervisory criticism", while SR 26-2 adds that "supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk." NIST AI 600-1 (July 2024) builds on a framework NIST describes as "intended for voluntary use".

Step 1: Inventory every AI agent that can change a customer account

FINRA's January 27, 2026 blog post, which shares staff observations from conversations with member firms, lists types of agents firms are exploring. One is "Trade Execution Agents". The post is commentary, not a rule.

For each agent, record whose instructions it acts on, which accounts and actions it can reach, and whether the institution deployed it or a customer connected a third party's agent (interpretation).

Step 2: Decide whether the agent follows instructions or exercises discretion

Among the risks FINRA's report lists for agents: "Agents may act beyond the user's actual or intended scope and authority." For broker-dealers, FINRA Rule 3260(b) says "No member or registered representative shall exercise any discretionary power in a customer's account unless such customer has given prior written authorization to a stated individual or individuals and the account has been accepted by the member". Rule 3260(c) requires the member or designated person to "approve promptly in writing each discretionary order entered". Rule 3260(d)(1) excepts discretion only as to the price or time of executing an order the customer gave for "a definite amount of a specified security", and that discretion lasts "only until the end of the business day on which the customer granted such discretion" unless the customer signs a dated written instruction to the contrary.

An agent that executes a specific order the customer gave is following instructions. An agent that chooses the security, the amount or whether to trade is, on our reading, the firm exercising discretionary power, so the authorization, acceptance and written approval requirements should be treated as applying (interpretation). The rule speaks of authorization to a stated individual; name a registered person responsible for each discretionary agent (interpretation). Investment adviser discretion is outside this guide. Banks should also write down what instruction the agent may act on, and bar it from inferring payees or amounts (interpretation).

Step 3: Scope the agent's permissions and set transaction limits

CAISI's request for information on AI agent security, published January 8, 2026, is a request for public input, not guidance. In its background it says "In some cases, mitigations draw on cybersecurity best practices, including implementing systems according to the principle of least privilege and designing systems with a zero trust architecture." FINRA's report suggests firms consider "how to establish guardrails or control mechanisms to limit or restrict agent behaviors, actions or decisions."

Give each agent its own credentials, never a staff member's; separate read access from the ability to act; allow only listed action types; and set per-transaction and daily limits, new-payee restrictions and blocks on changes to contact details or credentials (interpretation). The institution sets the figures.

Step 4: Require a customer confirmation the agent cannot give itself

FINRA's report lists as one consideration "where to have 'human in the loop' agent oversight protocols or practices". Among the controls CAISI's request asks about are human oversight controls "such as approvals for consequential actions".

Before a consequential action, show the customer the exact action (amount, payee, account or security) and take the confirmation through a channel the agent cannot answer (interpretation). Route actions above your thresholds to staff (interpretation). Discretionary orders at a broker-dealer still need the written approval Rule 3260(c) requires.

Step 5: Work out who bears an agent's mistake under Regulation E

Regulation E defines an unauthorized electronic fund transfer as one "initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit", and excludes transfers initiated by a person the consumer furnished the access device to, those initiated with "fraudulent intent by the consumer or any person acting in concert with the consumer", and those initiated "By the financial institution or its employee." The official interpretation adds: "If a consumer furnishes an access device and grants authority to make transfers to a person (such as a family member or co-worker) who exceeds the authority given, the consumer is fully liable for the transfers unless the consumer has notified the financial institution that transfers by that person are no longer authorized." It also says "A consumer has no liability for erroneous or fraudulent transfers initiated by an employee of a financial institution." Regulation E's error-resolution section separately counts "An incorrect electronic fund transfer to or from the consumer's account" as an error. If a transfer is unauthorized, section 1005.6 limits the consumer's liability in tiers (the official interpretation counts "three possible tiers of consumer liability for unauthorized EFTs") that turn largely on how quickly the consumer gives notice. Section 1005.11 requires the institution to "investigate promptly" after a timely notice of error and decide within 10 business days, or generally within 45 days if it provisionally credits the account, with longer periods in some cases.

Two cases follow, both interpretation. When a customer gives a third-party agent service their credentials, the service, as an organization, may be a "person" furnished an access device, so a transfer that exceeds the customer's instructions may not be unauthorized, though a timely notice of error still requires the institution to investigate, and the texts reviewed do not say whether such a transfer is "incorrect". When the institution's own agent initiates a transfer the customer did not request, treat it as the institution's transfer and resolve it as an error. Either way, give customers a fast way to revoke an agent's access, and record the notice, because notice is what ends the furnished-access exclusion (interpretation).

Step 6: Test agents for hijacking before launch and after every change

A January 17, 2025 technical blog post by CAISI staff, a research write-up rather than guidance, describes "agent hijacking, a type of indirect prompt injection in which an attacker inserts malicious instructions into data that may be ingested by an AI agent, causing it to take unintended, harmful actions."

Treat payee names, memo fields, messages and documents an agent reads as untrusted input; test with planted instructions in those fields; and re-test whenever the model, prompts or tools change (interpretation).

Step 7: Log every action, supervise it, and keep a working kill switch

FINRA's report lists the risk that "Complicated, multi-step agent reasoning tasks can make outcomes difficult to trace or explain, complicating auditability." Its considerations include "how to track agent actions and decisions". Rule 3110(a) requires each member to maintain a supervisory system "reasonably designed to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules." Regulatory Notice 24-09, addressed to member firms and creating no new requirements, says FINRA's rules apply when firms use generative AI "just as they apply when member firms use any other technology or tool." NIST AI 600-1 suggests that "Protocols are put in place to ensure GAI systems are able to be deactivated when necessary."

Log the customer's instruction, the agent's plan, each tool call, the confirmation and the outcome, tied to the customer and the agent version (interpretation). Build a kill switch that revokes the agent's credentials rather than just closing a chat, name who may use it, and test it (interpretation). Check whether agent logs are records your recordkeeping rules already require (interpretation).

Checklist

Items restate the recommendations above (interpretation), except where a rule is named.

• Every agent that can change an account is inventoried, with whose instructions it follows
• Agents are classed as following instructions or exercising discretion; discretionary agents at a broker-dealer meet Rule 3260
• Agents have their own scoped credentials, action allowlists and transaction limits
• Consequential actions need a customer confirmation the agent cannot supply
• Regulation E handling is defined for both kinds of agent, with fast, recorded revocation
• Hijacking tests run before launch and after model, prompt or tool changes
• Every action is logged and supervised, and the kill switch revokes credentials and is tested

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.