Wells Fargo's New Agreement Assigns Responsibility for AI Agent Operations to Users

On November 24, 2026, Wells Fargo's new version of its Online Access Agreement will officially take effect. The newly added Article 15 has attracted widespread attention: if a user authorizes a third-party AI agent to use online banking credentials to access an account, any instructions and transactions initiated by the agent may be deemed to be actions directly taken by the user, and the related risks shall be borne by the user; Wells Fargo does not undertake to monitor the agent's actions and reserves the right to restrict or block access by specific tools at any time.

When an AI agent logs in using a user's credentials, from the perspective of the bank's authentication system, it is almost indistinguishable from the user operating at the keyboard—the same session token, the same permission level, the same account visibility. Banks currently lack cryptographic technical means to distinguish between a user's own direct operations, operations by a third-party AI agent authorized by the user, and operations by malicious programs that have stolen credentials.

This gives rise to a key legal approach: since the subject cannot be distinguished technically, the AI agent's actions are "deemed" by contract to be the user's own actions. This is precisely the core of Wells Fargo's Article 15—using contractual provisions to solidify the legal relationship that "the agent is the user."

However, the key reason such a clause can be written into a contract lies in the interpretive space left by Regulation E, the implementing rule of the U.S. Electronic Fund Transfer Act.

Regulation E establishes consumer protection mechanisms for "unauthorized transfers." Provided timely notice is given, the user's liability for fraudulent transactions is usually capped at a relatively low amount. If reported within 2 business days, the liability cap is $50; within 60 days, it is $500. More importantly, the rule clearly defines an "unauthorized transfer": a transfer initiated by a person other than the consumer without actual authorization from the consumer. At the same time, the definition expressly excludes "transfers initiated by a person to whom the consumer furnished the access device," treating this as an exception.

In other words, when a user provides their online banking username and password to an AI agent, or authorizes an application to log in on their behalf, under the literal interpretation of the rule, the user has already "furnished the access device." The AI agent is not an unauthorized intruder but an authorized user holding the user's credentials. If the agent subsequently initiates transactions the user did not intend, the bank's legal argument is: the user handed over their keys to someone else, and the user should bear responsibility for that.

The Consumer Bankers Association stated clearly in a January 2026 white paper that this is "the core doctrinal question in this area": if a consumer authorizes an AI agent to access their bank account and initiate transactions, has the consumer "furnished" the access device, thereby triggering the exception clause of Regulation E?

To date, no court or regulator has issued a clear ruling or interpretation on this question. Article 15 of Wells Fargo's new agreement formally establishes the bank's position in advance through contract.

II. Industry Divergence: The Blocking Route and the Open Route

During the same period, other major U.S. banks have adopted markedly different strategies. JPMorgan Chase, Bank of America, Citibank, and Charles Schwab have all chosen to restrict or block third-party AI agent logins, emphasizing that human involvement is required for fund transfers. Wells Fargo, by contrast, has chosen not to impose a hard block, allowing agent access but shifting liability to the user side through contract.

The two routes reflect different business judgments. The logic of banks choosing to block is: before identity verification and scope authorization standards mature, allowing AI agents to operate fund accounts is equivalent to introducing uncontrollable risk. Wells Fargo's logic is: agent access is the traffic gateway for future financial services; first occupy the scenario, then use contracts to isolate potential risk losses.

Wells Fargo chose to make the new terms effective on November 24, 2026, precisely before Black Friday (November 27). This is also a reflection of its aforementioned business logic. The days after Thanksgiving are the period with the highest transaction volume in U.S. retail payment activity. AI shopping agents—tools designed to find deals, complete purchases, and manage returns without human review—are being actively promoted to consumers, and this is the key timing window Wells Fargo wants to capture.

III. Technical Solution: Scoped Delegated Authorization

The technical solution to this problem is actually not mysterious, and the approach is clear: do not let the AI agent obtain the user's master password; instead, issue it a "temporary key with limited purposes." This key can only do one specific thing—for example, "pay this month's electricity bill"—but cannot "transfer all deposits to another account." Each key has a clear expiration time, the user can revoke it at any time, and the revocation itself can be recorded and proven.

This approach has a set of ready-made tools in the tech community. OAuth is an authorization protocol that allows users to authorize third-party applications to access part of their data without handing over passwords. On this basis, there are more granular extensions: Rich Authorization Requests allow users to specify "which bill can be paid and what the maximum amount is," and back-channel authentication allows users to independently confirm on another device that "yes, this transaction is approved by me." These tools already exist at the specification level and have practical applications in some non-financial fields.

But the problem is that there is a huge engineering gap between "the specification exists" and "the bank builds it into a reliable production system." The core transaction systems of major U.S. banks were mostly built in the 1980s and 1990s, and retrofitting them would take years and huge investment. More importantly, no regulatory rule currently forces banks to do this—the CFPB's open banking rule has been stayed due to litigation, and that rule originally only covered data openness, not transaction authorization. With no regulatory pressure and no large-scale loss cases, banks have no incentive to start this retrofit.

In October 2026, Meta and Sierra jointly released the "Personal Agent Protocol" (code-named Poppy), attempting to build an authorization standard specifically for AI agents on top of OAuth. Wells Fargo was one of the early banks involved in designing it. But this protocol is still a draft, version 0.2, explicitly stating that "any part may change in a non-backward-compatible way," and payment functionality is excluded from its core scope. In other words, it still has a considerable way to go before it becomes production-grade infrastructure that banks can rely on.

So the real situation is this: the technical solution already has a blueprint, but engineering changes on the bank side have not yet begun, regulatory momentum is temporarily absent, and industry standards are still at the draft stage. During this gap period, AI agents can only continue down the path of "borrowing the user's password"—and Article 15 of Wells Fargo's agreement is precisely a contractual arrangement that was implemented ahead of others during this gap period.

IV. Comparison with the Chinese Market

For Chinese readers, the reference significance of this matter is clearer—the starting point of domestic rules is not "shifting responsibility to users," but "first anchoring responsibility with licensed institutions."

On August 24, 2026, the Payment & Clearing Association of China issued the "Self-Discipline Convention on Agent Payment Applications," the first specialized industry rule in China targeting agent payments. Article 5 of the convention establishes the principle that "whoever provides payment services is responsible": any matter involving core links such as account management, transaction processing, and fund clearing and settlement must be carried out by licensed entities such as banking financial institutions, non-bank payment institutions, and clearing institutions, and they must bear primary responsibility for the security of user funds and information. On identity governance, the convention requires "exploring the establishment of a KYA (Know Your Agent)" mechanism in addition to traditional KYC, conducting identity identification and verification of agents connected to the payment chain, clarifying the correspondence between agents and users, and implementing tiered management according to risk levels. At the authorization level, it requires clear authorization boundaries, signed responsibility agreements, and control of fund risks through transaction limits; before independently initiating payments, agents must report to the association and undergo business, technical, and ethical assessments; key transaction nodes must retain verifiable and traceable evidence chains for dispute handling and responsibility determination.

At the level of governance philosophy, ICBC President Liu once proposed a more penetrating framework: when banks face AI, the first question is not "how to use it," but "who is it, who benefits, and who bears responsibility." Borrowing the language of blockchain's "proof" mechanism, he proposed "proof of benefit"—whoever obtains benefits from the deployment of agents independently bears the corresponding responsibility. Although this idea belongs to industry governance discussion and has not yet been translated into regulatory provisions, it echoes the underlying logic of the convention's "primary responsibility of licensed institutions."

Compared with Article 15 of Wells Fargo, the difference is obvious at a glance: the U.S. clause contractualizes "benefits to the bank, risks to the user"; the domestic convention attempts to take "risk follows the service, responsibility follows the benefit" as its starting point. The former is a transitional arrangement during a responsibility vacuum, while the latter is a governance attempt to build the responsibility framework before the vacuum period arrives.

This article is from the WeChat public account "Internet Law Review," author: Joshua Mitchell, compiled by the editor-in-chief of "Internet Law Review," published by 36Kr with authorization.