RBC blocks outside AI agents from online banking, cutting off existing connections

Royal Bank of Canada is blocking third-party personal AI agents from its online banking services, including connections customers already use. In a customer notice dated October 27, 2026, RBC said those connections will stop working. Bloomberg separately reported that an employee memo called the technology an “unacceptable customer risk” after a security review.

The block applies behind the login

The policy applies to RBC services that require a customer login, including online banking. It is more than a warning to be cautious with an outside assistant: RBC says connections that let third-party personal AI agents reach its accounts will stop working.

Bloomberg’s Christine Dobby reported that the restriction includes agents such as Meta’s Muse. A memo sent to all employees on October 27 said the decision followed a “full security review of the technology and its functionality” and aligned with RBC’s guidelines for responsible AI use.

Customers retain their normal banking routes. RBC’s notice lists three ways they can continue to manage accounts or get assistance:

• Access digital banking directly through RBC’s official website and mobile app.
• Use RBC’s own digital tools and features.
• Contact the bank’s customer service team for account help.

Password access raises the stakes

RBC’s explanation focuses on the access personal agents need to carry out tasks. The bank says they need entry to online accounts, including financial accounts, and may store passwords to get there. Its concern is that greater autonomy increases the consequences when software makes a mistake or something goes wrong.

But as these systems become more autonomous, the stakes go up when something goes wrong—from fraud and consumer harm to risks that could ripple more broadly through the financial system.

Royal Bank of Canada, October 27 customer notice

That warning describes potential harm, rather than an announced loss or fraud case. RBC presents the restriction as a decision based on what it knows today. The customer notice does not identify a particular incident as the trigger or give customers a date when outside-agent access might return.

The bank also acknowledges potential benefits: agents could help consumers find better deals, make more informed choices and reduce everyday friction. It says businesses could operate more efficiently, too. Its decision therefore draws a boundary around direct account access, while recognizing uses for the technology beyond that restricted route.

The security guarantee has conditions

Alongside the restriction, RBC’s notice repeats its Digital Banking Security Guarantee. It promises reimbursement for eligible unauthorized transactions through RBC Online Banking or the RBC Mobile app, provided customers fulfill their responsibilities. That protection is conditional, not a blanket promise to cover every loss involving a digital account.

The terms include reimbursement for certain transactions after customers report compromised passwords or suspicious activity. They also cover qualifying cases of fraud, theft or coercion, subject to immediate reporting and cooperation with an investigation. Other covered causes include negligent conduct by RBC or specified service providers, and certain system failures.

The exclusions are especially relevant to the notice’s password warning. RBC says it will not reimburse losses when customers share passwords or personal verification questions, fail to follow their agreements or instructions, or consent to, contribute to or authorize a transaction in any way. The notice does not give an agent-specific reimbursement example; it directs customers to their account agreements for full protections and limitations.