Wells Fargo rewrote its rulebook for AI agents. A new section of its online access agreement, Section 15, takes effect Nov. 24. It covers any software that logs into your account and acts for you1.
The section lets an agent pay a bill, move money or check a balance. It also counts every one of those trades as yours, even ones you would undo if you could1. Turning the agent off takes more than a word. You must prove you revoked its access, and keep that proof ready for the bank to see.
A New Section, Taking Effect Nov. 24
An AI Agent, in the bank's own words, is any artificial intelligence or agentic software you let into your account1. Think of a budgeting assistant with your login, paying your electric bill on a schedule you set once and forgot.
Wells Fargo's agreement calls every trade that assistant makes a transaction "authorized by you," the customer, "including those you did not want or intend"1. Revoking means more than closing the app. Section 15(f) covers that moment, and it sets a bar most contracts skip.
"You must retain evidence of such revocation," Wells Fargo's agreement states, "and must provide such evidence to us, at our request." Skip that step, and you stay responsible for the agent's activity, "to the extent permitted by law or regulation"1.
The Protection This Trade Skips
Wells Fargo already runs a table for bad transfers. Section 5 caps what a customer owes when a transfer on the account turns out unauthorized1.
Report it within two business days of losing your password, and the cap sits at $50. Wait up to 60 days on any other unauthorized transfer, and the cap drops to zero1. Past 60 days, the cap disappears too, and the bank's favor flips to full liability.
Every One of Wells Fargo's 5 Liability Rows Needs an Unauthorized Transfer
The 5 rows of Wells Fargo's unauthorized-transfer liability table, Section 5(b) of its online access agreement
Each cube is one row of the table. Every row asks whether a transfer counted as unauthorized, and Section 15 answers that question for an AI agent's trade before the table ever opens.
Source: Wells Fargo [1]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Rows requiring "unauthorized" | 5 |
| Whole | 5 |
Every one of those five rows needs an unauthorized transfer to start the clock. Section 15 already calls an agent's trade authorized, the moment access changed hands1. The table stays shut before an AI agent's dispute ever reaches it.
Who Answers for the Agent
Christopher Waller raised the question first. The Federal Reserve governor, speaking at the Sibos payments conference on Sept. 29, called it simple: "Who is on the hook if an agent makes the wrong purchase?"3
"The question shifts from proving that a buyer is an authorized payer to proving that an agent has the authority to pay on the buyer's behalf," Waller said3. Wells Fargo answered that question in its own favor. Proving the agent's authority became the customer's job, kept on paper.
Wells Fargo's Clause Takes Effect 56 Days After the Fed's Question
Three dated events between Sept. 29 and Nov. 24, 2026, on the record this piece opened
Each pin marks one dated event; the rail spaces them by the real number of days between them.
Sources: Wells Fargo [1]; American Banker [2]; Federal Reserve Board [3]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| Sept. 29, 2026 | Fed asks who answers. Gov. Christopher Waller's Sibos speech |
| Nov. 2, 2026 | Clause comes to light. American Banker reports the rule |
| Nov. 24, 2026 | Section 15 takes effect. Customers bound to the new clause |
A Wells Fargo spokesman defended the approach once reporters asked. "The updated agreement asks customers to keep a record of when an AI agent's authority was revoked, because Wells Fargo may not otherwise have visibility into when that occurred," the spokesman told American Banker2.
Jackie Reses reads the same gap differently. She runs Lead Bank, a fintech charter bank. Reses argues the question needs engineering built into the system, past any single clause4. "Who is responsible? The human who misprogrammed? The model that enabled the agent to go outside the control? Is it the bank that let the transaction go through when it clearly was flagged to be incorrect?" she asked.
Two people close to the industry doubt a customer can clear Wells Fargo's bar at all. Douglas Borthwick once worked as an executive at Morgan Stanley and Standard Chartered. He now runs the wallet-authentication startup The Insumer Model. Borthwick called the proof problem real.
"It isn't realistic to expect customers to produce one. Telling a chatbot to stop leaves nothing in the customer's hands that anyone else can check," Borthwick said2. A screenshot of that chat, he added, "shows you asked. It doesn't show the agent stopped, and screenshots are easy to fake".
Elaine Duffus pushes the question past revocation entirely. The senior specialized consultant at Wolters Kluwer imagines a customer who did everything right. "What if I do everything Wells Fargo says to do, and I've got a pile of evidence that I told that agent to stop doing that thing, yet the agent went rogue because maybe there was an ambiguous direction to it or it just went bad, there's still that question — what happens then?" she asked. "Who's at fault then? Is it me? Is it the bank? Is it the AI provider?"2
What the Next Rule Might Say
Lead Bank already drafted an answer of its own. Its framework proposes a new category for the law to recognize, the "Authorized Financial Agent"5. "It covers identity, authorization, liability and supervision," the framework states, "and lays out a phased roadmap from supervisory guidance to new legislation".
Wells Fargo built its name moving money people trusted it to carry. Its software raises the same question in new terms, decades later, with a program making the trip in place of a person.
What to Do
Check this week whether an AI agent touches your Wells Fargo account. If one does, write down the date and the method every time you turn it off12. A screenshot, an email confirmation, a support ticket number: anything carrying a timestamp works.
Ask the bank directly, in writing, whether it accepts that record as evidence. Get the answer before a dispute forces the question.
By the Numbers
- Nov. 24, 2026: the date Wells Fargo's Section 15 takes effect, covering any AI Agent with account access1.
- Five rows make up Wells Fargo's unauthorized-transfer liability table, and an AI agent's trade reaches zero of them1.
- $50 caps a customer's loss for an unauthorized transfer reported within two business days of a stolen password1.
- Up to $500 caps the loss when that same report lands within 60 days instead1.
- Sept. 29, 2026: the date Christopher Waller asked who answers for a wrong agent purchase3.
- 56 days separate Waller's question from Wells Fargo's answer taking legal effect13.
What to Watch
Watch for a prudential regulator to set a real rule before more banks copy this clause. Lead Bank already published a framework, built before any agency acted on its own5. A second major bank writing its own proof-of-revocation clause would show whether Wells Fargo's approach becomes the industry's default.
Sources
- Wells Fargo, "Online Access Agreement (effective Nov. 24, 2026)," Nov. 24, 2026, https://www.wellsfargo.com/online-banking/online-access-agreement/upcoming/
- Penny Crosman, "Wells Fargo wants customers to prove they've revoked AI agents," American Banker, Nov. 2, 2026, https://www.americanbanker.com/news/wells-fargo-wants-customers-to-prove-theyve-revoked-ai-agents
- Christopher J. Waller, "Payments in the age of AI agents," Federal Reserve Board, Sept. 29, 2026, https://www.federalreserve.gov/newsevents/speech/waller20260928a.htm
- Penny Crosman, "Bankers grapple with liability when AI agents mess up," American Banker, Oct. 13, 2026, https://www.americanbanker.com/news/bankers-grapple-with-liability-when-ai-agents-mess-up
- Lead Bank, "Leading into the AI Revolution," Oct. 20, 2026, https://www.lead.bank/blog/leading-into-the-ai-revolution
