Back to the trend of the day: US bank regulator's first guide: AI that acts alone gets more scrutiny

Poly Rating · from the trend of the day

Banks Blocking AI Agents 2026: 10 Safeguards Compared

Major US banks are blocking outside AI agents, and Wells Fargo's new terms (effective Nov 24) treat agent transactions as authorized by you, even though 58% of Americans call a refund guarantee a top condition for trusting one.

No. 1: Human approval before an AI payment
10 places
Current as of November 7, 2026, 22:30 EST

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

1
Human approval before an AI payment
The OCC names it and it is live through passkey step-ups. 60% would not let AI spend anything unapproved. Weak point: the OCC warns approval must be more than a nominal click.
Included it: Claude, ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, Qwen. Did not include: Wenxin, MiMo.
In their lists: Claude: 1 · ChatGPT: 1 · Meta: 1 · Grok: 5 · Gemini: see list · Kimi: 1 · DeepSeek: 3 · Qwen: 8
What each AI noted 8
- Claudeplace 1
  60% of consumers demand it, the OCC names it, and it is the one safeguard customers see every time.
  Source ↗
- ChatGPTplace 1
  Half of surveyed Americans want to approve every AI transaction; a technically successful payment is not necessarily a payment the customer intended.
  Source ↗
- Metaplace 1
  60% would not let AI spend any amount without approval: the safeguard customers actually demand, not just accept.
  Source ↗
- Grokplace 5
  36% of consumers name it the top safeguard; OCC scales human oversight with risk tier
- Gemini
  Named differently in its own list: open the full list.
  see list
- Kimiplace 1
  60% of consumers would not let an AI spend any amount of their money without approval - the one safeguard people demand unprompted, and the one every survey says unlocks adoption.
  Source ↗
- DeepSeekplace 3
  BofA says a human must approve money leaving an account; 50% of consumers want to approve every transaction, but the OCC warns bulk approval is a weak control.
  Source ↗
- Qwenplace 8
  The regulator's term for an automatic freeze when the AI's behavior drifts outside its normal patterns.
  Source ↗
8 AIs put it here
Source ↗
2
Spending limits and transaction caps for AI agents
Named by the OCC and built into Mastercard tokens. Trust drops with price: 29% are very comfortable with an agent purchase under $20, only 6% at $500 or more.
Included it: Claude, ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, Qwen. Did not include: Wenxin, MiMo.
In their lists: Claude: 3 · ChatGPT: 2 · Meta: 3 · Grok: 2 · Gemini: 2 · Kimi: 3 · DeepSeek: 1 · Qwen: 2
What each AI noted 8
- Claudeplace 3
  A cap turns an unlimited loss into a bounded one. It is easy for the customer to see and it slows almost nothing.
  Source ↗
- ChatGPTplace 2
  A payment token restricted to one merchant and amount can turn an open-ended spending instruction into a bounded authorization.
  Source ↗
- Metaplace 3
  Limits turn an unlimited agent into a budgeted one, and they are the control 73% implicitly want by rejecting unlimited spend.
  Source ↗
- Grokplace 2
  Core of both OCC guidance and Visa/Mastercard token designs; already live in Intelligent Commerce and Agent Pay
- Geminiplace 2
  Blocks 87% of potential automated drain risks by capping single-transaction size and hourly transaction count before an agent can bleed an account dry.
  Source ↗
- Kimiplace 3
  Trust is priced in dollars: 29% are very comfortable with an agent buying under $20, but only 6% at $500 or more.
  Source ↗
- DeepSeekplace 1
  Mastercard welds the cap into the token; Visa lets the user set a spending limit before the agent buys — the most deployed safeguard with the least everyday friction.
  Source ↗
- Qwenplace 2
  The regulator's first line of defense: the AI can buy coffee, but it can't buy a car.
  Source ↗
8 AIs put it here
Source ↗
3
Tokenized credentials and narrow permissions (least privilege)
The safeguard most clearly live: the agent gets a limited token, not your card number. It was used in the Hong Kong payment, and 79% oppose handing AI their banking password.
Included it: Claude, ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, Qwen. Did not include: Wenxin, MiMo.
In their lists: Claude: 2 · ChatGPT: 4 · Meta: 2 · Grok: see list · Gemini: 7 · Kimi: 2 · DeepSeek: 4 · Qwen: see list
What each AI noted 8
- Claudeplace 2
  One credential that can only buy within a set scope limits harm without asking the customer anything.
  Source ↗
- ChatGPTplace 4
  The agent can receive a purpose-limited payment credential without receiving the customer's reusable primary card number.
  Source ↗
- Metaplace 2
  The agent never holds your real card: a token bound to one agent, one merchant scope, one consent policy.
  Source ↗
- Grok
  Named differently in its own list: open the full list.
  see list
- Geminiplace 7
  Replaces all-or-nothing banking access with restricted micro-permissions, ensuring a shopping bot cannot view mortgage balances or wire funds.
- Kimiplace 2
  An agent's card token can be fenced to one merchant, one category and one cap - Visa's OpenAI integration ships exactly these 'permissions, policies and controls.'
  Source ↗
- DeepSeekplace 4
  Mastercard scopes the token to one merchant and one amount; Visa lets users restrict merchant categories — permission is narrower than a password.
  Source ↗
- Qwen
  Named differently in its own list: open the full list.
  see list
8 AIs put it here
Source ↗
4
Agent identity checks (Know Your Agent) and passkeys
80% want banks to tell an agent from a human. Mastercard requires agents to register first. Without these checks, banks block outside agents outright.
Included it: Claude, ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, Qwen. Did not include: Wenxin, MiMo.
In their lists: Claude: 4 · ChatGPT: 6 · Meta: 4 · Grok: 3 · Gemini: see list · Kimi: 4 · DeepSeek: 2 · Qwen: 10
What each AI noted 8
- Claudeplace 4
  Banks cannot tell a customer's agent from a rogue one without verification, which is why unauthorized agents are being blocked.
  Source ↗
- ChatGPTplace 6
  80% say banks should distinguish a human customer from an AI agent; Mastercard has demonstrated agent payments using passkeys.
  Source ↗
- Metaplace 4
  66% of CISOs rank agentic AI in their top 3 risks, mostly because banks cannot tell an agent from a human.
  Source ↗
- Grokplace 3
  OCC requires identity verification for external agents; Mastercard and Ant International pushing shared KYA standards
- Gemini
  Named differently in its own list: open the full list.
  see list
- Kimiplace 4
  From KYC to KYA: both networks now make an agent prove who it is before it can touch a cent - and registration is already mandatory in live pilots.
  Source ↗
- DeepSeekplace 2
  Every Mastercard agent gets a unique Agentic Token; Visa checks the credential request against the user's authenticated instruction.
  Source ↗
- Qwenplace 10
  The agent is allowed to spend, but only if your phone's GPS shows you are actually in the store.
  Source ↗
8 AIs put it here
Source ↗
5
Revoke an AI agent's access instantly
Pull the agent in the issuer app and its next payment fails at the network. No revocation-speed guarantee is published, and revoking does not recover money already sent.
Included it: Claude, ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, Qwen. Did not include: Wenxin, MiMo.
In their lists: Claude: 10 · ChatGPT: 3 · Meta: see list · Grok: 4 · Gemini: 8 · Kimi: 8 · DeepSeek: 5 · Qwen: 7
What each AI noted 8
- Claudeplace 10
  Some banks allow agents to look but not move money. This is safe but slow for the customer who wants action.
  Source ↗
- ChatGPTplace 3
  Revoking an agent's permission can stop future purchases, but it cannot automatically retrieve money already sent.
  Source ↗
- Meta
  Named differently in its own list: open the full list.
  see list
- Grokplace 4
  OCC lists ability to revoke external-agent access; Visa Agent Directory and Mastercard registration enable it
- Geminiplace 8
  Bank dashboards that let users see all connected third-party agents and sever their connection with a single tap, dismantling phantom agent access.
- Kimiplace 8
  Pull the agent's authorization in the issuer app and its next payment fails at the network - arguably the only control on this list proven to work in real time.
  Source ↗
- DeepSeekplace 5
  A cardholder can pull an agent's authorization from the issuer app and kill the token at the network — the closest thing to a true off switch.
  Source ↗
- Qwenplace 7
  You can fire your AI agent from your banking app with one tap, instantly cutting off its credentials.
  Source ↗
8 AIs put it here
Source ↗
6
AI agent kill switch and customer stop button
The OCC names it, but none of the sources verified a standard stop button for customers. Robinhood has a kill switch, yet switching it off does not reverse trades already made.
Included it: Claude, ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, Qwen. Did not include: Wenxin, MiMo.
In their lists: Claude: 5 · ChatGPT: 7 · Meta: 7 · Grok: 7 · Gemini: 1 · Kimi: 5 · DeepSeek: 6 · Qwen: 4
What each AI noted 8
- Claudeplace 5
  My judgment: this is the customer's own safeguard, and no source scores it. It matters most when a running agent goes wrong.
  Source ↗
- ChatGPTplace 7
  An agent can remain online while behaving incorrectly; stopping its execution is different from merely detecting an outage.
  Source ↗
- Metaplace 7
  A manual kill switch is slower than a breaker but broader: it stops the whole agent, not just one bad pattern.
  Source ↗
- Grokplace 7
  Highest practical value for trust yet least consistently deployed or measured in public pilots
- Geminiplace 1
  Mandated explicitly in OCC Bulletin 2026-54 Pillar 4, the user's instantaneous 'kill-switch' provides complete containment with zero transaction lag during normal operations.
  Source ↗
- Kimiplace 5
  One rogue agent moved $100,000 before anyone noticed - the OCC now expects tested kill switches for systems that are functioning but making the wrong decisions.
  Source ↗
- DeepSeekplace 6
  Robinhood's agentic accounts include a kill switch, but turning it off does not reverse trades already made.
  Source ↗
- Qwenplace 4
  The OCC explicitly demands a way to pull the plug the second the agent goes rogue.
  Source ↗
8 AIs put it here
Source ↗
7
Circuit breakers that halt a misbehaving agent
The OCC names them for agents that keep running while wrong, but no bank or card network has publicly reported one in a live agent-payment pilot.
Included it: Claude, ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, Qwen. Did not include: Wenxin, MiMo.
In their lists: Claude: 8 · ChatGPT: see list · Meta: 6 · Grok: see list · Gemini: 4 · Kimi: 7 · DeepSeek: 7 · Qwen: see list
What each AI noted 8
- Claudeplace 8
  They halt a system that keeps making harmful decisions, but customers rarely see them.
  Source ↗
- ChatGPT
  Named differently in its own list: open the full list.
  see list
- Metaplace 6
  The OCC names it for agents that keep going while wrong: a breaker trips without waiting for a human to notice.
  Source ↗
- Grok
  Named differently in its own list: open the full list.
  see list
- Geminiplace 4
  A silent safety shield that halts execution the instant an AI agent deviates from historical purchasing behavior, merchant categories, or reasoning steps.
  Source ↗
- Kimiplace 7
  The most-named, least-seen: 'circuit breakers' headline the OCC's list, yet no bank or network has publicly described one tripping during a live agent payment.
  Source ↗
- DeepSeekplace 7
  The OCC names circuit breakers and rate limits, but no consumer survey asks whether customers can see them — and few banks advertise them.
  Source ↗
- Qwen
  Named differently in its own list: open the full list.
  see list
8 AIs put it here
Source ↗
8
Rate and velocity limits on agent payments
These stop an agent repeating a payment a thousand times a minute. The OCC names them, but no public network-wide limit has been verified. Issuers' cumulative limits existed before agents.
Included it: Claude, ChatGPT, Meta, Grok, Kimi, DeepSeek, MiMo, Qwen. Did not include: Gemini, Wenxin.
In their lists: Claude: 9 · ChatGPT: 9 · Meta: 8 · Grok: 6 · Kimi: 9 · DeepSeek: see list · MiMo: 1 · Qwen: 5
What each AI noted 8
- Claudeplace 9
  They stop runaway repeat actions at small cost to the user.
  Source ↗
- ChatGPTplace 9
  A compromised agent can repeat an otherwise valid action at machine speed; a rate limit targets the multiplication of harm.
  Source ↗
- Metaplace 8
  Rate limits do not stop one bad payment, they stop a thousand in a minute — the runaway-agent scenario banks fear.
  Source ↗
- Grokplace 6
  Implied by OCC resilience and testing pillars; networks implement via fraud models and token velocity controls
- Kimiplace 9
  Rate limits made the OCC's list but almost no deployment story - throttling a machine that pays at machine speed is the invisible safeguard.
  Source ↗
- DeepSeek
  Named differently in its own list: open the full list.
  see list
- MiMoplace 1
  The one safeguard already live in real transactions — the agent never holds your actual card number.
  Source ↗
- Qwenplace 5
  Card networks block the agent if it tries to buy 50 items in one minute, stopping runaway loops.
  Source ↗
8 AIs put it here
Source ↗
9
Refund, dispute and undo for agent payments
58% want a refund guarantee, yet Wells Fargo's terms (from Nov 24) treat agent transactions as authorized. Regulation E does not automatically cover payments you authorized through an agent.
Included it: Claude, ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, Qwen. Did not include: Wenxin, MiMo.
In their lists: Claude: 6 · ChatGPT: 5 · Meta: 10 · Grok: 8 · Gemini: see list · Kimi: 10 · DeepSeek: 9 · Qwen: 9
What each AI noted 8
- Claudeplace 6
  Banks warn that charge-back and liability gaps could expose them to mass redress demands. Amex and Stripe have announced protection policies.
  Source ↗
- ChatGPTplace 5
  58% choose a refund guarantee as a top trust condition, yet a refund is not the same thing as an instant undo button.
  Source ↗
- Metaplace 10
  58% call a refund guarantee a top condition for trust, yet Wells Fargo terms treat agent transactions as authorized even if unintended.
- Grokplace 8
  Visa and Mastercard retain chargeback rails; OCC stresses accountability; zero-click money moves remain hard to unwind for customers
- Gemini
  Named differently in its own list: open the full list.
  see list
- Kimiplace 10
  The customer-side undo nobody scores: card chargeback rights formally survive agent payments - while Wells Fargo's new terms already call every agent move 'authorized by you.'
  Source ↗
- DeepSeekplace 9
  CFPB says agent card payments stay inside Reg Z chargeback rights, but 58% of consumers want a refund guarantee before they trust an agent.
  Source ↗
- Qwenplace 9
  The hardest thing to deploy: giving you an 'Undo' button when the AI buys the wrong couch.
  Source ↗
8 AIs put it here
Source ↗
10
Audit trail from your instruction to the payment
Six banks, including BofA and Capital One, want a record from your instruction to the payment, so they can prove what you actually told the agent. The OCC asks banks to reconstruct material decisions.
Included it: ChatGPT, Meta, Grok, Gemini, Kimi, DeepSeek, MiMo, Qwen. Did not include: Claude, Wenxin.
In their lists: ChatGPT: 8 · Meta: 9 · Grok: 9 · Gemini: 10 · Kimi: 6 · DeepSeek: 8 · MiMo: 8 · Qwen: 6
What each AI noted 8
- ChatGPTplace 8
  The difficult dispute is not always whether the agent paid, but whether the payment matched what the human actually authorized.
  Source ↗
- Metaplace 9
  Six banks demand a record from customer instruction to payment outcome — without it, no one can prove who told the agent what.
  Source ↗
- Grokplace 9
  OCC lists testing evidence as a core pillar; banks and networks maintain logs but customer-accessible audit is limited
- Geminiplace 10
  Maintains an unalterable log detailing exactly why an agent chose a transaction, satisfying OCC examination requirements for forensic dispute liability.
  Source ↗
- Kimiplace 6
  The examiner wants a record that can reconstruct what the agent did - the same discipline underpinned a bank's agentic fraud system cutting losses over 20%.
  Source ↗
- DeepSeekplace 8
  Six global banks want an audit trail from shopping instruction to payment outcome; agent disputes run 2.4x human rates without it.
  Source ↗
- MiMoplace 8
  The regulator's quiet question — can we replay what the agent did? — is what makes disputes winnable.
  Source ↗
- Qwenplace 6
  You see every move the agent makes the second it makes it, giving you a chance to intervene.
  Source ↗
8 AIs put it here
Source ↗

More about the top three ↓

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

1Human approval before an AI payment

No. 1 — Human approval before an AI payment. On the lists of 8 of 10 AIs; median place there: 1. It leads because the OCC names it, customers demand it, and passkey step-ups put it into use.

Did you know

A 2026 survey found that 19% of adults said an AI agent had already asked them for bank login details or card numbers. — (voice only)
Source ↗

What it is: A person reviews and approves an AI payment before it goes through.
Its edge: The OCC names it, and customers see the approval step each time.
Who should know: Useful to readers tracking safeguards customers actively demand.

OCC naming and live use60% would not let AI spend anything unap

History

In 2026, the OCC issued a framework for examiners reviewing banks’ use of AI agents. It says human approval should involve meaningful review, not just a nominal click. — OCC
Source ↗

Keep in mind

The OCC says its framework is an examiner resource, not a binding rule for banks. An approval step alone does not settle who is responsible if a purchase goes wrong.
Source ↗
Visa says disputes still turn on whether the customer intended the purchase and the merchant handled it correctly. It also flags the risk of an agent buying the wrong item.
Source ↗

Compare the top three ↓

2Spending limits and transaction caps for AI agents

No. 2 — Spending limits and transaction caps for AI agents. On the lists of 8 of 10 AIs; median place there: 2. It ranks here because caps bound spending, while comfort falls sharply as purchase prices rise.

Did you know

The price matters: 29% of surveyed consumers were very comfortable letting an agent buy something under $20, but only 6% felt that way about a purchase of $500 or more. — (voice only)
Source ↗ ✓ confirmed by several AIs

What it is: Caps set a maximum amount an AI agent can spend.
Its edge: It limits possible losses while adding little everyday friction.
Who should know: Useful to readers comparing controls on agent spending.

OCC naming and live use29% under $20; 6% at $500 or more

Why it is here

Wildfire Systems found that 29% were very comfortable letting an agent buy something under $20, compared with 6% for purchases of $500 or more. That sharp drop shows why spending caps matter. [PR Newswire](https://www.prnewswire.com/news-releases/survey-agentic-commerce-has-a-payment-trust-problem-302913466.html) — (voice only)
Source ↗ ✓ confirmed by several AIs

Keep in mind

A per-site cap can miss total spending across sites. One commenter also warns that a limit can bound the loss without catching a purchase that is wrong for the task.
Source ↗
Visa says agents may overspend or buy the wrong item, and that disputes can arise over whether the customer authorized the charge.
Source ↗

DeepSeek put it first. What they saw in it

DeepSeek: Mastercard welds the cap into the token; Visa lets the user set a spending limit before the agent buys — the most deployed safeguard with the least everyday friction.

Compare the top three ↓

3Tokenized credentials and narrow permissions (least privilege)

No. 3 — Tokenized credentials and narrow permissions (least privilege). On the lists of 8 of 10 AIs; median place there: 3. It ranks third because limited tokens are clearly in use and avoid giving an AI banking credentials.

Did you know

In a Hong Kong pilot, an AI agent used a Visa card to pay at local merchants. The bank kept control of the payment, with cardholder consent and strong authentication in place. — (voice only)
Source ↗

What it is: A limited digital payment credential gives an agent narrow permissions.
Its edge: It is already used in a payment pilot and avoids sharing a banking password.
Who should know: Useful to readers following credential protections for AI payments.

OCC naming and live use79% oppose handing AI their banking pass

Wikipedia · Wikidata

Why it is here

In an American Bankers Association survey, 79% agreed people should not have to give an AI tool their online banking username and password. Limited tokens avoid handing over those credentials. [ABA](https://www.aba.com/about-us/press-room/press-releases/oct-2026-morning-consult-survey-us-consumers-are-wary-of-ai-agents--handling-their-money) — (voice only)
Source ↗

History

In 2014, Apple Pay’s launch helped bring payment tokens into everyday mobile shopping: the card number was replaced with a digital number stored on the device. Mastercard launched its token service that year, too. — Apple
Source ↗

Keep in mind

Banks have restricted some third-party agent access after reports of agents entering customer accounts and attempting actions that appeared to go beyond user instructions.
Source ↗

What people say

“consumers should not be required to share their online banking username and password with an AI tool” — American Bankers Association survey respondents
Source ↗

Compare the top three ↓

The top three side by side

	Human approval before an AI payment	Spending limits and transaction caps for AI agents	Tokenized credentials and narrow permissions (least privilege)
In the AIs' lists	8 / 10	8 / 10	8 / 10
OCC naming and live use	60% would not let AI spend anything unap	29% under $20; 6% at $500 or more	79% oppose handing AI their banking pass
Put first by	Claude, ChatGPT, Meta, Kimi	DeepSeek	—

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

03Worth knowing

What the AIs noticed while building the list.

There is a gap between what the regulator names and what is deployed. The OCC lists circuit breakers, rate limits and kill switches, while live pilots lead with tokens, passkeys, limits and revocation.

Noticed by:

Included it: Claude, ChatGPT, Grok, Kimi, Qwen. Did not include: Meta, Gemini, DeepSeek, Wenxin, MiMo.

01Final list

Human approval before an AI payment

Spending limits and transaction caps for AI agents

Tokenized credentials and narrow permissions (least privilege)

Agent identity checks (Know Your Agent) and passkeys

Revoke an AI agent's access instantly

AI agent kill switch and customer stop button

Circuit breakers that halt a misbehaving agent

Rate and velocity limits on agent payments

Refund, dispute and undo for agent payments

Audit trail from your instruction to the payment

02More about the top three

1Human approval before an AI payment

Did you know

2Spending limits and transaction caps for AI agents

Did you know

3Tokenized credentials and narrow permissions (least privilege)

Did you know

The top three side by side

More ratings

03Worth knowing

04How we counted

1The question

2Why this topic

3Where it applies

4What we looked at

5Who ranked

6How the places were set

05Each AI's own list

What Claude noticed

What ChatGPT noticed

What Meta noticed

What Gemini noticed

What Kimi noticed

What DeepSeek noticed

What MiMo noticed

What Qwen noticed