RBC Blocks AI Agents From Online Banking: How to Disconnect Yours Safely

Royal Bank of Canada is blocking third-party personal AI agents from logging in to its online banking and other signed-in digital services, the bank said on October 27, 2026. Anyone who had connected an assistant such as Meta's Muse to an RBC account will find that the connection stops working.

The move has made "RBC online" a top-rising search in Canada this week, and it raises a practical question for people in Canada, the US, the UK and Australia: if you gave an AI tool your banking login, what should you do now? This guide explains what changed, who is affected and the steps to take.

Key facts at a glance

• RBC is the first Canadian bank to block outside AI agents from its digital banking, after what it called a full security review of the technology.
• Existing agent connections to RBC accounts will stop working. The bank's website, mobile app and customer service remain available as usual.
• JPMorgan Chase, Charles Schwab, Citigroup and Bank of America have also said they are blocking or limiting outside AI agents' access to customer accounts.
• BMO chief executive Darryl White told an audience on October 21 not to give AI agents your banking username and password, credit card, social insurance number or PIN.
• Sharing your login may breach your bank's user agreement, which could leave you responsible for losses the bank would otherwise cover.

Why this is being searched now

AI agents are assistants that do more than answer questions. With your permission, they can sign in to accounts, read balances and transaction histories, and in some cases take actions for you. Tools such as Meta's Muse and OpenAI's ChatGPT can connect to bank and credit card accounts to track spending and offer tips, although purchases typically still need a person to approve them.

Canada's banks had been signalling concern for about a week. On October 20, RBC chief executive Dave McKay said in a television interview that the bank was considering blocking Muse from customer information. The next day BMO's White said people had grown so comfortable with online shopping that they would "enter all my personal information anywhere, into any agent."

On Tuesday evening, October 27, RBC told employees in an internal memo that it would begin blocking these platforms immediately. The memo, signed by head of technology and operations Naim Kazmi and head of personal banking Erica Nielsen, said third-party agents can create "unacceptable customer risk," including acting beyond what customers expect and creating liability exposure. RBC published a customer explainer the same day.

Who is affected

RBC clients who linked an AI agent are affected first. The bank did not list which products count as "third-party personal" AI agents, so if any assistant signs in to RBC Online Banking or the RBC Mobile app on your behalf, assume that link will fail. RBC spokesperson Jeff Lanthier said the change may disappoint "the small portion of our clients who use these tools."

Customers of large US banks face similar limits. JPMorgan Chase chief executive Jamie Dimon said the bank would limit agents' access to client accounts "because you don't want rogue agents and there could be thousands of them." Schwab chief executive Rick Wurster said the firm was blocking unauthorised agents that try to move clients' money, including Muse. Citi said it does not let third-party AI agents or assistants log in to a customer's account or transact directly, though customers can still allow limited, read-only access through approved open banking providers.

Anyone, anywhere, who typed a bank password into an AI tool should take note. The risk is not tied to one bank. Once an agent stores your credentials, they sit outside your bank's systems, and your bank may treat that as a broken security promise on your part.

Step-by-step: how to disconnect an AI agent and secure your bank account

1. List every AI tool that can reach your money. Check the connected accounts or integrations section of each assistant you use, along with any budgeting apps. Note which ones hold your bank username and password rather than a bank-approved connection.
2. Remove saved banking logins from the agent. Delete the stored credentials and disconnect the bank, card or brokerage account inside the AI tool. Do this even if your bank has already blocked it, so the login is not kept on another company's servers.
3. Change your online banking password. Pick a new, unique password you have never given to any app. If you reused the old one elsewhere, change it there too.
4. Turn on two-step verification and alerts in your bank's own app or website. Transaction and login alerts let you spot activity you did not start.
5. Review recent transactions and payees. Look back at least as far as the date you first connected the agent, and check for new payees, transfers or card details you do not recognise.
6. Use your bank's own tools instead. RBC says clients can keep using its official website, mobile app and built-in digital features. Where your bank offers read-only data sharing through approved open banking providers, as Citi does, that carries less risk than handing over a full login.
7. Read your online banking agreement. Check the section on keeping passwords confidential, so you know what the bank expects before you link any new service.

How to tell if you have been affected

The most likely sign is simple: the agent can no longer read your RBC balances or complete tasks that touch your account. That is the block working, not a breach.

Warning signs that need action are different. Watch for transfers, bill payments or e-transfers you did not approve, new payees, password-reset emails you did not request, or login alerts from unfamiliar devices. Agents can also act in ways people do not expect: a Toronto man said publicly that Muse set up a Marketplace sale without his knowledge and gave a stranger his home address.

What to do if something has gone wrong

Contact your bank straight away using the phone number on its official website or the back of your card. Speed matters. RBC's Digital Banking Security Guarantee reimburses eligible unauthorised transactions, including those made after you tell the bank you believe a password may have become known to someone, as long as you have met your responsibilities under the agreement.

That condition is the catch. The Financial Consumer Agency of Canada, the federal regulator that oversees how banks treat consumers, has warned that giving your user ID and password to a third party may breach your bank's user agreement. That warning dates to 2018, when budgeting apps were the concern, but it applies equally to AI agents, which may be able to act for you rather than just read data.

If you think you have been defrauded, report it to the police and, in Canada, to the Canadian Anti-Fraud Centre. Canadians reported more than $704 million in fraud losses in 2025, according to the centre, and identity fraud aimed at passwords, social insurance numbers and banking details was the most reported type. The centre estimates only 5% to 10% of fraud is ever reported.

What banks and regulators say

Bankers are framing this as a question of control. "We strongly believe there should be a human in the loop to authorise money moving out of your account," Bank of America chief executive Brian Moynihan said, adding that the bank is working out who is liable for payments an AI authorises.

Canada's banking regulator is taking a lighter touch. Peter Routledge, superintendent of the Office of the Superintendent of Financial Institutions, said on October 27 that he would leave decisions on AI agents to individual banks as long as they follow the regulator's guidelines. He described OSFI's approach to third-party and AI risk as "principles-based" and said customers who want to use AI agents could choose to switch providers.

There is a counterpoint to the bank view. RBC itself acknowledged that AI agents could help people find better deals and remove everyday friction, and some customers will see the block as a loss of convenience. Ottawa is also building a safer route: the Consumer-Driven Banking Act received royal assent in March 2026, and proposed rules would let Canadians share financial data with accredited providers under Bank of Canada oversight. Those rules are not yet in force, and letting outside apps move money is being studied for a later phase.

What to watch next

Other Canadian lenders may follow RBC, given BMO's public warning. In the US, executives have raised agent-driven transactions with Federal Reserve regulators, and officials believe the law may need to spell out how customers authorise autonomous tools and who pays when a transaction goes wrong. For now, the safest assumption is that your bank's rules, not the AI company's, decide whether you are covered.

Takeaways

• Never give an AI chatbot or agent your banking password, PIN, card number or social insurance number, whichever bank you use.
• If you already did, disconnect the agent, change your password and turn on alerts today, then review your transactions.
• Prefer read-only, bank-approved data sharing over handing an app your full login.
• Check your bank's user agreement before linking any new service, because sharing a password can cost you fraud protection.
• Report suspicious activity to your bank immediately; fast reporting is a condition of most reimbursement guarantees.