Wells Fargo customers now carry a new job. They must prove, on demand, that they fired their AI agent.
A revised Online Access Agreement takes effect Nov. 24, 20261. It adds a new Section 15 for AI agents. An AI agent is software that can log into a bank account and move money for a customer.
The clause is specific. "You must retain evidence of such revocation and must provide such evidence to us, at our request," the agreement states1. Until a customer can show that proof, Wells Fargo holds the customer responsible for everything that agent does.
What the Fine Print Now Says
Section 15 runs eight parts, lettered (a) through (h)1. Together they cover what an AI agent can do, who answers for it, and how a customer cuts it off.
The bank gives itself wide room first. It may "rely on any such instructions, actions, or transactions as valid and binding and as evidence of your authorization," the agreement says1. Wells Fargo carries limited duty to check whether an agent had permission.
Revocation sits in its own subsection, 15(f). It orders fast action: act, keep a record, and hand that record over on request1. Miss a step, and liability remains "to the extent permitted by law or regulation," Wells Fargo's own agreement says.
Five of the eight parts place a duty squarely on the customer1. Two require trusting the agent's own provider and consenting to share account data. The other three require policing the agent's conduct, revoking it properly, and keeping it away from minors.
One part only defines the term. The remaining two protect the bank's own position. They reserve its right to block an agent and free it from any duty to double-check one.
Wells Fargo Puts 5 of 8 New AI Agent Rules on the Customer
Wells Fargo's Section 15 on AI agents, eight lettered subsections, grouped by who each one binds, effective Nov. 24, 2026
Each cube is one lettered subsection of Section 15. The magenta cubes place a duty on the customer, the blue cubes protect the bank's own position, and the gray cube only defines the term "AI Agent."
Source: Wells Fargo [1]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Binds the customer | 5 |
| Protects the bank | 2 |
| Defines the term | 1 |
| Whole | 8 |
The Bank Admits a Blind Spot
Why ask customers to keep their own paperwork? Wells Fargo gave a reason when American Banker asked.
"Customers may choose to authorize or revoke an AI agent outside of Wells Fargo. The updated agreement asks customers to keep a record of when an AI agent's authority was revoked, because Wells Fargo may not otherwise have visibility into when that occurred," a Wells Fargo spokesman said2.
That is a real gap. A customer can tell an AI agent to stop inside a chat window that sits outside Wells Fargo's own systems. The bank only learns what happened if the customer reports back.
A Screenshot Only Shows You Asked
Douglas Borthwick is a former Morgan Stanley and Standard Chartered executive. He now runs The Insumer Model, a startup that builds authentication tools for AI agents and their developers2. Borthwick agrees with Wells Fargo's logic, and he names its limit too.
"It's fair for Wells Fargo to want a record of when an agent was cut off, since the bank can't see it," Borthwick said. "It isn't realistic to expect customers to produce one. Telling a chatbot to stop leaves nothing in the customer's hands that anyone else can check"2.
The chat log carries the same hole, Borthwick said. A screenshot of that conversation "shows you asked. It doesn't show the agent stopped, and screenshots are easy to fake"2.
When the Agent Goes Rogue Anyway
Elaine Duffus raises a different problem. She is a senior specialized consultant at Wolters Kluwer, which sells compliance software to banks2.
Picture a customer who revokes access and saves every proof Wells Fargo could want. The agent might still misbehave regardless.
"What if I do everything Wells Fargo says to do, and I've got a pile of evidence that I told that agent to stop doing that thing, yet the agent went rogue because maybe there was an ambiguous direction to it or it just went bad, there's still that question — what happens then?" Duffus said. "Who's at fault then? Is it me? Is it the bank? Is it the AI provider?"2
Wolters Kluwer is building a response to that gap, Duffus said: a governance layer that would let a bank step in, "so that if things really start to go off the rails, the bank will see it and then can reach out to the customer or just hit the kill switch"2.
JPMorgan Drew the Same Line
A different bank, JPMorgan Chase, reached a similar point by a different road.
Jamie Dimon, JPMorgan's chairman and chief executive, addressed the risk on the bank's Oct. 13, 2026, earnings call3. "We are not gonna allow just any ... outside agent to come inside the company because it is just too risky for clients and for JPMorgan," Dimon told analysts. "You do not want rogue agents, and there could be thousands of them."
Dimon's bank blocks outside AI agents from logging into customer accounts at all. Jeremy Barnum, JPMorgan's chief financial officer, put the same point in plainer terms. "It's important that customers understand that if they give up their credentials to the agent, and the agent does something that they don't want, that's going to be on them, and that's sort of not an ideal state of things," Barnum said5.
Wells Fargo lets an agent in, then asks for the paperwork afterward. JPMorgan keeps the agent out. Both banks land on the same place: the customer carries the risk.
Regulators have left the two banks to write these rules alone so far. The Office of the Comptroller of the Currency issued revised model risk guidance on April 17, 20264. Two more agencies, the Federal Reserve and the FDIC, joined it. Together they cover how banks manage AI models generally.
"Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance," the Office of the Comptroller of the Currency and its two co-authors wrote4.
Wells Fargo's Deadline Lands 7 Months After Regulators Stepped Back
Three dated events in 2026: bank regulators' own AI exclusion, JPMorgan's block on outside agents, and Wells Fargo's deadline
Each pin marks one dated event. The gray pin is the regulators' own guidance, the blue pin is JPMorgan's stance, and the magenta pin is Wells Fargo's deadline, the one this piece reports.
The gap between the first two dates and the third runs about seven months, during which agencies left AI agent-specific guidance unpublished.
Sources: Wells Fargo [1]; The Motley Fool [3]; Office of the Comptroller of the Currency [4]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| April 17, 2026 | OCC excludes agentic AI. The OCC, the Federal Reserve and the FDIC leave agentic AI out of revised model risk guidance. |
| Oct. 13, 2026 | JPMorgan blocks agents. JPMorgan Chase's Jamie Dimon says outside AI agents stay too risky to let inside the bank. |
| Nov. 24, 2026 | Wells Fargo's deadline. Wells Fargo's proof-of-revocation rule for AI agents takes effect. |
The same bulletin says the agencies plan to gather more information on agentic AI "in the near future"4. Seven months later, that request remains unpublished.
Polymarket@PolymarketBREAKING: JPMorgan, Bank of America, Wells Fargo, & other major banks have reportedly detected unauthorized AI agents operating inside customer accounts.
What to do
Search your own bank's customer agreement for the word agent. Banks are adding this language mid-year, outside their usual update calendar. A clause like Wells Fargo's Section 15 can arrive with little notice.
If you let an AI agent touch your bank account, write down the exact moment you revoke it. Call your bank's fraud or support line right after, and ask the representative to log that call with a reference number. A phone log plus your own timestamp beats a chat screenshot alone.
Ask your bank one direct question: what evidence would settle a dispute over an AI agent's trade? Wells Fargo has left that question open to the public, and your own bank likely has too.
By the numbers
- Nov. 24, 2026: the date Wells Fargo's new Section 15, covering AI agents, takes effect1.
- 8: the lettered subsections inside Section 15, covering everything from third-party consent to eligibility rules1.
- 5: of those subsections that place a duty on the customer directly1.
- Oct. 13, 2026: the date Jamie Dimon told JPMorgan's earnings call that outside agents stay "too risky" for the bank to admit3.
- April 17, 2026: regulators excluded agentic AI from the revised bank guidance that the OCC, the Federal Reserve and the FDIC issued4.
- 2: of the four biggest U.S. banks, Wells Fargo and JPMorgan Chase, that rewrote their AI agent terms this year13.
What to watch
Watch for the OCC, the Fed and the FDIC to publish the agentic AI request they promised this spring4. A real rule would settle who absorbs an AI agent's bad trade. Right now, each bank decides that alone, in its own fine print.
A second signal sits in court. The first dispute to test Section 15(f) will show what counts as proof. Arbitration or a small-claims filing would get there first, well before any regulator writes a rule.
Sources
- Wells Fargo, "Online Access Agreement," Wells Fargo, Nov. 24, 2026, https://www.wellsfargo.com/online-banking/online-access-agreement/upcoming/
- Penny Crosman, "Wells Fargo wants customers to prove they've revoked AI agents," American Banker, Nov. 2, 2026, https://www.americanbanker.com/news/wells-fargo-wants-customers-to-prove-theyve-revoked-ai-agents
- Motley Fool Transcribing, "JPMorgan Chase (JPM) Q3 2026 Earnings Call Transcript," The Motley Fool, Oct. 13, 2026, https://www.fool.com/earnings/call-transcripts/2026/10/13/jpmorgan-chase-jpm-q3-2026-earnings-call-transcript/
- Office of the Comptroller of the Currency, "Model Risk Management: Revised Guidance (OCC Bulletin 2026-13)," Office of the Comptroller of the Currency, April 17, 2026, https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
- Maria Volkova, "JPMorgan warns of risks to consumers who rely on AI agents," American Banker, Oct. 13, 2026, https://www.americanbanker.com/news/jpmorgan-warns-of-risks-to-consumers-who-rely-on-ai-agents
