Wells Fargo to require proof of revoked AI agent access

Wells Fargo's updated online access agreement, effective Nov. 24, goes beyond the terms that large banks including JPMorganChase have introduced to make customers liable for authorized AI agent actions. The new clause requires customers to properly and timely revoke an AI agent's authorization, retain evidence of that revocation, and provide it to the bank on request; until they notify the bank under Section 17(d), they remain responsible for the agent's activities to the extent permitted by law or regulation. A Wells Fargo spokesman said the agreement asks customers to keep a record because the bank may not have visibility into when an agent's authority was revoked outside its systems.

Critics question whether consumers can realistically produce such evidence. Douglas Borthwick, a former Morgan Stanley and Standard Chartered executive who hosts the Old Men, New Money podcast, said a screenshot of a chat shows only that the customer asked, not that the agent stopped, and that screenshots are easy to fake. Borthwick founded a startup, The Insumer Model, that provides wallet authentication for developers and AI agents.

Even with proof of revocation, liability may remain unsettled. Elaine Duffus, a senior specialized consultant at Wolters Kluwer, asked what happens if an agent goes rogue despite clear instructions to stop, and who is at fault among the customer, the bank, and the AI provider. Duffus said this calls for a governance process or agent-governance layer, which Wolters Kluwer is developing, so that if things go off the rails, the bank can see it and reach out to the customer or hit the kill switch.