The contractual experiment of "authorization means self-assumption of liability": Wells Fargo has for the first time transferred the responsibilities for AI agents to users.
On November 24, 2026, the new version of Wells Fargo's Online Access Agreement will officially take effect. The newly added Article 15 in it has drawn widespread attention: if a user authorizes a third-party AI to access the online banking credentials during the trial period, any instructions and transactions initiated by the agent may be deemed as acts directly made by the user himself/herself, and the relevant risks shall be borne by the user; Wells Fargo does not promise to monitor the behavior of the agent, and reserves the right to restrict or block access to specific tools at any time.
This clause was exaggeratedly interpreted by some media as "for the first time, a bank completely shifts the responsibility for AI mistakes to users". Although this statement is not comprehensive, the legal logic behind it is worthy of in-depth examination.
I. Technical Premise: Banks Cannot Distinguish Between "User" and "User's AI"
The security model of traditional online banking is built on a basic assumption: the subject that can correctly enter the username, password and verification code is the account holder. However, the emergence of AI agents has broken this assumption.
When an AI agent logs in with the user's credentials, from the perspective of the bank's authentication system, there is almost no difference between this operation and the user's own operation at the keyboard — the same session token, permission level, and account view. At present, banks do not have cryptographic technical means to distinguish between the user's direct operation, the operation of a third-party AI agent authorized by the user, and the operation of a malicious program that steals credentials.
This leads to a key legal approach: since the subject cannot be distinguished technically, the behavior of the AI agent is "deemed" as the behavior of the user himself/herself through the contract. This is exactly the core of Article 15 of Wells Fargo — to solidify the legal relationship of "agent is the user" through contractual agreement.
However, the key for this kind of clause to be included in the contract lies in the room for interpretation left by Regulation E, the supporting rule of the US Electronic Fund Transfer Act.
Regulation E has a consumer protection mechanism for "unauthorized transfer". Under the premise of timely reporting, the maximum liability that users bear for fraudulent swiping is usually low. If the report is made within 2 working days, the maximum liability is 50 US dollars, and it is 500 US dollars within 60 days. More importantly, this rule clearly defines "unauthorized transfer": transactions initiated by a person other than the consumer who does not have actual authorization from the consumer. At the same time, this definition explicitly excludes "transactions initiated by a person to whom the consumer has provided an access device" as an exception.
In other words, when the user provides the online banking username and password to the AI agent, or authorizes an application to log in on his/her behalf, according to the literal interpretation of this rule, the user has already "provided the access device". The AI agent is not an unauthorized intruder, but an authorized user holding the user's credentials. If the agent subsequently initiates a transaction that the user never intended, the bank's legal argument is: the user has given his own key to others, and the user should be responsible for it.
The Consumer Bankers Association clearly pointed out in its white paper in January 2026 that this is "a core doctrinal issue in this field": if a consumer authorizes an AI agent to access his/her bank account and initiate transactions, has the consumer "provided" the access device, thus triggering the exception clause of Regulation E?
Up to now, no court or regulatory authority has made a clear ruling or interpretation on this issue. Article 15 of Wells Fargo's new version of the agreement formally establishes the bank's position in the form of a contract in advance.
II. Industry Differentiation: Blocking Route and Open Route
In the same period, other large US banks have adopted completely different strategies . JPMorgan Chase, Bank of America, Citigroup, and Charles Schwab have all chosen to restrict or block the login of third-party AI agents, emphasizing that human participation is required for fund transfer. Wells Fargo, on the other hand, chooses not to set hard restrictions, allows agents to access, but shifts the responsibility to the user side in advance through the contract.
The two routes reflect different business judgments. The logic of banks that choose to block is: before the standards of identity identification and scope authorization mature, allowing AI agents to operate fund accounts is equivalent to introducing uncontrollable risks; Wells Fargo's logic is: agent access is the traffic entrance of future financial services, so it will occupy the scenario first, and then isolate potential risk losses through contracts.
Wells Fargo chose to make the new clause take effect on November 24, 2026, just before Black Friday (November 27). This is also a manifestation of the above business logic. The days after Thanksgiving are the period with the highest transaction volume of retail payment activities in the United States. AI shopping agents — tools designed to find discounts, complete purchases and manage returns without manual review — are being actively promoted to consumers, which is a key time node that Wells Fargo wants to seize.
III. Technical Solution: Scoped Delegated Authorization
The technical solution to this problem is actually not mysterious, and the idea is very clear: do not let the AI agent get the user's main password, but issue it a "temporary key with limited use". This key can only do one specific thing — such as "pay this month's electricity bill", but cannot "transfer all deposits to another account". Each key has a clear expiration time, the user can revoke it at any time, and the revocation behavior itself can be recorded and verified.
This idea has a set of ready-made tools in the technical circle. OAuth is an authorization protocol that allows users to authorize third-party applications to access part of their data without handing over the password. On this basis, there are more refined extensions: Rich Authorization Requests allow users to specify "which bill can only be paid and what the maximum amount is", and back-channel authentication allows users to independently confirm on another device "yes, this transaction is approved by me". These tools already exist at the specification level, and have practical applications in some non-financial fields.
But the problem is that there is a huge engineering gap between "the specification exists" and "banks build it into a reliable production system". Most of the core transaction systems of major US banks were built in the 1980s and 1990s, and transforming them requires years of time and huge investment. More importantly, no current regulatory rules force banks to do so — the CFPB's open banking rule has been suspended due to litigation, and that rule originally only governs data opening, not transaction authorization. Without regulatory pressure and large-scale loss cases, banks have no incentive to start this transformation.
In October 2026, Meta and Sierra jointly released the "Personal Agent Protocol" (code-named Poppy), trying to establish an authorization standard specifically for AI agents on the basis of OAuth. Wells Fargo is one of the early banks participating in the design. However, this protocol is still a draft with version number 0.2, which clearly states that "any part may be changed without backward compatibility", and the payment function is excluded from the core scope. In other words, there is still a long way to go before it becomes a production-grade infrastructure that banks can rely on.
Therefore, the real situation is like this: The blueprint of the technical solution is already available, but the engineering transformation on the bank side has not yet started, the regulatory impetus is temporarily missing, and the industry standard is still in the draft stage. During this window period, AI agents can only continue to take the path of "borrowing the user's password" — and Article 15 of Wells Fargo is exactly the contractual arrangement that was implemented in advance during this window period.
IV. Comparison with the Chinese Market
For Chinese readers, the reference significance of this incident is clearer — the starting point of domestic rules is not "shifting the responsibility to users", but "anchoring the responsibility to licensed institutions first".
On August 24, 2026, the China Payment and Clearing Association issued the Self-Discipline Convention on Agent Payment Applications, which is the first special industry rule for agent payment in China. Article 5 of the Convention establishes the principle of "who provides payment services is responsible": all core links involving account management, transaction processing, fund clearing and settlement must be carried out by licensed entities such as banking financial institutions, non-bank payment institutions, and clearing institutions, which shall bear the main responsibility for user fund and information security. In terms of identity governance, the Convention requires "exploring and establishing a KYA (Know Your Agent) mechanism" in addition to traditional KYC, to identify and verify the identity of agents accessing the payment link, clarify the corresponding relationship between agents and users, and implement hierarchical management according to risk levels. At the authorization level, it is required to draw a clear authorization boundary, sign a responsibility agreement, and control fund risks through transaction limits; before initiating independent payment, it must report to the association and accept business, technical and ethical assessments; key transaction nodes must retain verifiable and traceable evidence chains for dispute handling and responsibility identification.
At the level of governance philosophy, Liu Zeng, President of Industrial and Commercial Bank of China, once proposed a more penetrating framework: when banks face AI, the first question is not "how to use it", but "who it is, who benefits, and who takes the responsibility". Using the language of the blockchain "proof" mechanism, he proposed the "proof of benefit" — whoever obtains benefits from the deployment of the agent shall independently bear the corresponding responsibility. This idea, which is still under industry governance discussion and has not been transformed into regulatory provisions, echoes the underlying logic of the Convention's "main responsibility of licensed institutions".
Comparing with Article 15 of Wells Fargo, the difference is obvious: the US clause contractualizes "benefits go to the bank and risks go to the user"; the domestic convention tries to take "risks follow services, responsibilities follow benefits" as the starting point. The former is a transitional arrangement during the responsibility vacuum period, while the latter is a governance attempt to build the responsibility framework before the vacuum period.
This article is from the WeChat Official Account "Internet Law Review", Author: Joshua Mitchell, Translated and edited by Chief Editor of *Internet Law Review*, authorized for release by 36Kr.