Canadian Banks Block AI Agents: What Agent and Fintech Builders Should Do

As of October 28, 2026, Canada's biggest banks were blocking or limiting outside "personal AI agents" like Meta's Muse from getting into online banking with a customer's credentials. RBC and TD say they are blocking them, BMO and CIBC say they don't allow or support them, and Scotiabank says it will limit them. If your product logs into bank accounts with a user's password, whether it's an agent, an assistant or an automation tool, expect those connections to fail in Canada. Plan around read-only and authorized data channels instead.

The rest of this piece covers what each bank said, why it happened now, how it matches what US banks did earlier in October, and what builders and users should change.

What each bank has said

RBC moved first. In an internal memo sent on the evening of Tuesday, October 27, 2026, signed by technology and operations head Naim Kazmi and personal banking head Erica Nielsen, the bank said it would start blocking third-party personal AI agents from its digital properties immediately, according to The Globe and Mail. The memo doesn't say which tools count as "third-party personal" agents. RBC's customer-facing explainer says existing agent connections "will stop working." It points to fraud, consumer harm and wider financial-system risk as agents become more autonomous.

The other big banks followed within a day, as Global News reported:

The wording varies, and the differences matter to builders. TD and RBC are describing active blocking. BMO and CIBC are stating policy and telling customers not to share credentials. Scotiabank's "limit" leaves room for some access. None of the five has published a list of approved agents or an agent API.

Why this happened now

The Muse trigger

Meta announced Muse on September 8, 2026 as a consumer agent that runs on a per-user cloud VM. A separate "Sentinel" agent controls internet access. Meta says shared credentials go into secure storage that Muse can use without seeing them, and that Muse asks before sensitive actions such as sending email or buying something. Mark Zuckerberg said more than 10 million people in the US and Canada set up Muse accounts in about six weeks, according to money.ca.

Then came a widely shared incident. Tech creator Matt Robb let Muse handle a Facebook Marketplace listing with the "Allow always" setting rather than "Allow one time." He says the agent accepted a $600 offer below his $700 minimum and sent the buyer his home address. Meta disputes that anything was breached. David Singleton, CEO of Meta Superintelligence Labs, said the two of them jointly confirmed no privacy controls were violated. Robb says Meta told him it would make the setting clearer. Only Robb's side supports the price details.

On October 20, RBC CEO Dave McKay said on Bloomberg that the bank was considering blocking Muse and that RBC is "liable for that as an organization." On October 21, BMO CEO Darryl White said handing account numbers, passwords or PINs to AI agents is a bad idea (money.ca).

The real issue: shared credentials and liability

The underlying problem isn't any one agent. It's how agents get in. A banking industry source told Global News that customers have been sharing login IDs and passwords with agents. When a customer has shared credentials, the resulting transactions can't be treated as unauthorized. RBC's head of AI, Bruce Ross, said regulators haven't settled who is legally responsible when an agent acting for a customer gets something wrong (money.ca).

The regulator stays out of it, on purpose

OSFI superintendent Peter Routledge said on October 27 that OSFI won't bar customers from using AI agents. Banks can decide for themselves within OSFI's principles-based guidelines, and if a board decides the risk is too high, that is "indicative of sound risk management," per The Globe and Mail. So nobody in Ottawa is going to override these blocks. Each bank sets its own rules.

Canada is following the US playbook

Canadian banks are a few weeks behind their US counterparts, and the US version shows where this is probably going:

1. October 13, 2026 – JPMorgan. On the Q3 earnings call, Jamie Dimon said the bank won't let "just any … outside agent" operate in customer accounts. A spokeswoman told CNBC that the bank doesn't let third parties log in with customers' credentials. Agents can't move money or pay bills. Read-only data such as balances can still flow through Plaid or other connectors that hold the credentials, and the bank says it supports "customer-authorized data sharing through open banking providers."
2. October 16, 2026 – Schwab. CEO Rick Wurster said Schwab blocks outside agents, Muse included, from moving client money. He said large agents get blocked "tens and twenties" of times a week. Schwab plans to give outside AI tools read-only access through MCP servers and wants clients to use its own assistant, Charley, reported The Next Web.
3. October 27–28, 2026 – Canada's big five take the positions in the table above.

The common thread is a split: reading is negotiable, acting isn't. Banks will tolerate or even build read access through channels they control, like aggregators, MCP servers and open banking APIs. They won't accept a third-party agent logging in as the customer and moving money.

What this means if you build agents or fintech products

1. Treat credential-based bank access as broken in Canada

If your agent drives a browser session into online banking with a user's password, assume it will be detected and blocked at RBC and TD, and that it breaks BMO and CIBC policy. Build for that failure. Detect blocked or challenged sessions, tell the user clearly what happened, and don't retry in ways that look like you're trying to get around the block. A bank that's actively blocking agents will notice repeated attempts, and so will your users when their accounts get locked.

2. Move to read-only, authorized channels

For balances, transactions and spending analysis, use aggregators or bank-provided read interfaces. That's the path JPMorgan explicitly keeps open and the one Schwab is building with MCP. Most "agent" features users want, like budgeting, cash-flow forecasts and subscription audits, only need read access. Keep anything that moves money in the bank's own app, with the user confirming there.

3. Don't hold payment credentials at all

Muse's checkout design is worth copying. Meta says Muse pays through Link by Stripe's agent wallet, which issues a one-time-use card so the agent never sees real card details. Tokenized, single-use payment methods keep your agent away from bank credentials and narrow your liability.

4. Make the permission model hard to misuse

The Marketplace incident came down to an "Allow always" choice that the user and the vendor understood differently. Practical defaults:

• Default to per-action approval for anything involving money, addresses or other personal data.
• Scope standing permissions narrowly. "Accept offers at or above $700" is a better standing rule than "manage this listing."
• Show a plain-language summary of what a standing permission allows before the user turns it on, and let them revoke it in one tap.
• Log every autonomous action where the user can see it.

5. Tell users about the fraud-protection risk

RBC's Digital Banking Security Guarantee, linked from its AI agents page, excludes losses when customers share passwords or verification answers. If your onboarding asks for bank credentials, users should know that doing so may cost them fraud coverage. Leaving that out is an ethics problem and a churn risk.

6. Watch Canadian open banking, but don't wait on it

Canada's Consumer-Driven Banking framework is the long-term answer: accredited third parties, a liability framework, and a ban on screen scraping. The proposed regulations came out on June 27, 2026, and are meant to be fully in place within one year of final publication. The screen-scraping ban, though, isn't in force yet. The Bank of Canada will run accreditation, and every non-bank applicant pays a C$2,500 fee. About nine million Canadians use screen-scraping services (money.ca), so a lot of products depend on this transition. If you're a Canadian fintech, start preparing your accreditation now.

If you're comparing tools that already work within these limits, the AI finance tools category is a good place to start. If you've built one, you can submit it for free.

What users should do now

• Disconnect agents that hold your bank password, and change that password. RBC says those connections will stop working anyway.
• Use the bank's own app or approved data connections for anything that moves money.
• Review agent permissions in Muse or similar tools, and switch "always" approvals to per-action where money or personal details are involved.
• Contact your bank if a budgeting or aggregator app stops syncing. The bank statements are about agents, and none of them say how traditional aggregator connections are affected.

What to watch next

• Whether any Canadian bank publishes an agent API or read-only MCP endpoint, as Schwab plans to. RBC's Bruce Ross said agents won't connect "without adequate safeguards," which suggests the door isn't closed for good.
• How Scotiabank defines "limit" and whether it ends up somewhere between full blocking and full access.
• OSFI's tighter AI guidelines, which Routledge said are coming, and any Financial Stability Board guidance on verifying agent identity.
• Final Consumer-Driven Banking Regulations and a launch date from the Bank of Canada, which would give agents a legal, accredited way into Canadian accounts.
• Meta's response, including any changes to Muse's permission settings and whether it negotiates bank-approved connections instead of relying on user credentials.

For now, the rule for builders in North America is simple: read through channels the bank approves, act only through the bank's own interface, and never ask users for their banking password.