RBC Bars Third-Party AI Agents from Accessing Its Digital Banking Services

Royal Bank of Canada (RBC) will block third-party personal artificial-intelligence (AI) agents—such as Meta Platforms Inc.’s “Muse”—from directly accessing its online banking and credit-card interfaces. The decision follows an internal security review and will be implemented immediately, according to an internal memo. RBC’s head of technology and operations, Naim Kazmi, and head of personal banking, Erica Nielsen, said the move prioritises “the security of client information” over the convenience offered by AI-driven spending analyses.

The Globe and Mail (Toronto)Bloomberg

Canadian banks have been investing heavily in AI, with RBC ranking third globally for AI adoption for the fifth year in a row, per an Evident benchmark. The rapid rollout of “agentic AI” – semi-autonomous tools that can act on behalf of users – has sparked industry-wide concerns about cybersecurity, financial-crime exposure, and privacy. U.S. banks JPMorgan Chase & Co. and Charles Schwab Corp. have recently limited external AI agents’ data access, and Bank of Montreal chief executive Darryl White warned customers not to share sensitive banking data with such tools.

The Globe and Mail (Toronto)Bloomberg

• OSFI superintendent Peter Routledge, speaking at Tech Festival Canada, noted that regulators will leave the ultimate decision on AI agents to individual banks, provided they follow OSFI’s principles-based guidelines. He added that OSFI is preparing tighter AI guidelines after earlier-month consultations.

The Globe and Mail (Toronto)

• The Financial Stability Board has recommended that financial institutions reinforce oversight of AI systems, including restricting agents’ access to sensitive information.

The Globe and Mail (Toronto)

• RBC is the first Canadian bank to block external AI agents on its digital platforms.

The Globe and Mail (Toronto)

• OSFI’s upcoming AI guidelines will build on principles released in the spring, which ask banks to assess whether third-party connections pose institutional or customer risk.

The Globe and Mail (Toronto)

Blocking third-party AI agents limits customers’ ability to use automated tools that analyze transaction histories and generate spending recommendations. While this reduces convenience, regulators and banks argue it mitigates liability, unauthorized transactions, and data-privacy breaches. The move signals a shift toward more cautious AI integration across Canada’s financial sector, aligning with global supervisory recommendations.

The Globe and Mail (Toronto)

• “I don’t think we would get down to the level of you should do it this way, and so everyone should do it this way. I don’t think that’s not our highest and best use,” — Peter Routledge

The Globe and Mail (Toronto)

• “Where I stand right now on third-party risk and AI is we’re more principles-based.” — Peter Routledge

The Globe and Mail (Toronto)

OSFI has indicated that tighter AI guidelines will be rolled out later this year, giving banks a clearer framework for assessing third-party AI risk. RBC’s policy may serve as a benchmark for other Canadian institutions as they balance AI innovation with client-data protection.

The Globe and Mail (Toronto)