AI agents are becoming the next banking channel. For financial institutions to stay at the center of their account holder relationships, they must continue to own the identity, entitlements, and fraud controls that shape how consumers securely interact with their brands.
Over the past 40 years, consumers have moved from visiting branches to banking online and then on mobile devices. The next major shift is the arrival of personal agents such as Meta Muse, Instinct, OpenAI’s Dots, Claude Duet, and others. These agents let consumers bring intelligence and automation to many parts of their lives, and that’s already started to extend into banking. Today, an account holder can connect their financial institution data into tools like ChatGPT to ask questions and get insights directly within the tool. While that approach is “read only” right now, the launch of tools like Meta Muse makes it easy to see a future in which agents can take action on behalf of an account holder.
This reality poses meaningful questions for financial institutions—and their partners—about consent and access, security and auditability, and, ultimately, the role of the financial institution and its brand.
At Q2, we believe financial institutions must retain control of the data, of fraud protection, and of the account holder identity. With the right controls in place, financial institutions will have optionality to decide what posture makes the most sense for their organizations, manage agent access to their systems, and be in a position to continue owning the account holder relationship.
However, it is incumbent on the financial institution’s digital banking and fraud partners to put those controls into their customers’ hands. Consumers also must be able to extend their preferences from their existing channels to agentic channels.
We are focused on two key areas to ensure financial institutions retain control. First is how their data and brand show up in AI tools they don’t own, like ChatGPT. Second is how they manage authorization, entitlements, security, and identity for agentic tools accessing digital banking.
Q2 is giving financial institutions secure, authorized connections between their banking application, brand, and data and the AI tools consumers use most. This is similar to open banking, but Q2's vision goes beyond exposing raw data through MCP and APIs. ChatGPT and Claude both let a connected service display its own branded interface inside the chat. Q2 is using existing UI components that put an FI's brand and interface into those conversations, so account holders get answers in a place that feels like their financial institution.
Q2’s Composable Content Blocks match common account holder questions. Ask about accounts, and a condensed accounts view appears. Ask about transactions, and recent activity appears. Trust is built into the design:
The FI hosts the login and consent screens
The connection is read-only
Every widget is labeled as coming from the FI and links back to the banking app
We see AI agents accessing digital banking systems in two ways: through authorized connections like FDX and other APIs via aggregators like Plaid, MX, Yodlee, and Finicity, or MCP; or through AI browsers and virtual machines that log in the way a person would. While we believe the second method represents a small fraction of agentic access, it raises real concerns about consent, privacy, data protection, and fraud.
Across both methods, we believe FIs shouldn't have to choose between completely blocking agents or ignoring them. Q2's goal is to give FIs visibility into agent activity and control over their own posture across several mechanisms and connection types, including:
Blocking or allowing declared agent browsers. Many AI browsers identify themselves. Q2 expects to offer FI-specific rules that block or allow these browsers before a request reaches digital banking.
Detecting undeclared agents. Some agents look like an ordinary person on an ordinary browser. Q2 is working with our cybersecurity platform partners to identify these sessions from behavioral, device, and session signals, so FIs can monitor them, step up authentication, or block them.
Controlling aggregator and FDX connections. Most agent activity is expected to reach FIs through aggregators and FDX integrators, so Q2 is building controls that let each FI decide which of those connections to allow. Different aggregators handle vendor blocking differently, so it’s important to speak with your digital banking partner and aggregator vendors to understand your options. FDX access is read-only, and Q2 is exploring more granular controls over what each vendor can reach.
Moving agent access to Q2's Digital Banking MCP. The most comprehensive solution is to give account holders a safe path that you can centrally manage. Q2's Digital Banking MCP, now in testing with early access customers, lets account holders grant consent at the FI's own login. FIs can then set action-level permissions and see which agents are connected and what they're allowed to do.
Q2's Fraud Intelligence solutions also apply to agentic traffic and offer additional detection and security. Q2 checks identity at login, monitors high-risk events with Q2 Patrol, monitors transactions with Q2 Sentinel, and monitors the full session with User Activity Monitoring. Q2 is also extending User Activity Monitoring to watch API activity by agents.
At Q2, we are consistently focused on our mission of building strong and diverse communities by strengthening their financial institutions. As AI continually changes the banking landscape, we believe that:
Risk tolerance varies. Different FIs will have different levels of risk tolerance for how they support the agentic channel.
Rich experiences matter. FIs want to keep delivering rich experiences through tools such as ChatGPT's intelligent UI or Muse's widgets.
Brand carries over. FIs want to retain their brand experience when consumers use an assistant-style approach in agentic channels.
Interoperability drives outcomes. Protocols such as the Personal Agent Protocol and MCP are important so that consumers get the best outcomes across agents.
Fraud is a critical risk. Systems must consider agentic footprints alongside regular web and mobile signals to drive security.
Transitions should be seamless. Consumers should move smoothly between actions their agents take for them and actions they take directly.
Agent transparency is essential. Auditability, reporting, and observability become critical for capturing agentic actions.
Personal agentic banking will change how consumers interact with their financial institutions, but it won't change the foundation of those relationships. Account holders trust their FIs with their financial lives, and that trust doesn't transfer to an algorithm. That's why Q2 is committed to building AI responsibly: designing for transparency and explainability from the start, keeping people informed and in control as agents act on their behalf, and building governance into the architecture rather than layering it on afterward.
We won't deploy AI for its own sake, and we'll be straightforward about what our technology can and can't do. As personal agents become the next banking channel, Q2 will work with FIs to keep them at the center of their account holder relationships, earning trust in this new channel the same way they've earned it for decades.