SKN | Citi Restricts External AI-Agent Access as Bank Prioritizes Security and Regulatory Controls

Key Takeaways:

• Citi is taking a deliberately cautious approach to allowing external artificial intelligence agents to interact directly with its banking systems.
• The bank has blocked agent-driven access to its systems, apart from certain existing read-only open banking capabilities.
• Citi is considering a “know your agent” process, similar to know-your-customer procedures, to establish safeguards and address regulatory expectations before expanding access.

Citigroup is holding back from opening its banking systems to external artificial intelligence agents until it can establish the appropriate controls. Speaking at the Money20/20 conference in Las Vegas, Naveed Anwar, Citi’s global head of AI, digital and data platforms within its Services business, said the bank would not rush a decision despite growing demand from companies seeking to connect their AI systems with financial institutions.

“There are places in which we want to go faster. This is not one of those places,” Anwar said. His comments underline Citi’s position that the potential benefits of AI-driven interaction must be weighed against uncertainty about how external agents may behave when given access to banking infrastructure.

Citi Draws a Clear Boundary Around System Access

Anwar said Citi had blocked agent-driven access to its systems, with limited exceptions for existing read-only open banking access. He stated that, at the time of the interview, no external agents were connecting to Citi agentically because the bank did not yet know what those AI models might be capable of doing.

This distinction is important. Read-only access allows permitted information to be retrieved, whereas agentic systems may be designed to perform tasks or initiate actions with less direct human intervention. The potential consequences of granting such systems access therefore extend beyond ordinary data connectivity.

For a bank managing sensitive financial information and complex client relationships, the challenge is to determine not only who or what is requesting access, but also what an external system can do, what permissions it holds, and how its actions can be controlled.

Why Citi Wants a “Know Your Agent” Framework

Citi is considering a “know your agent” process analogous to know-your-customer (KYC) protocols. According to Anwar, the objective would be to establish suitable guardrails and meet regulatory expectations before allowing companies to interact with the bank through external AI agents.

Such a framework could help Citi assess the identity, permissions, and intended functions of external agents before granting access. However, the bank has not yet disclosed a finalized framework, implementation timetable, or specific technical requirements in the supplied report.

The approach reflects a broader operational principle: access should depend on verifiable controls rather than demand alone. For Citi, the priority is establishing confidence in how external AI systems interact with its infrastructure before opening additional channels.

What Citi’s Approach Means for Clients

Citi says it wants to enhance the client experience, but Anwar’s remarks indicate that convenience will not take precedence over unresolved security and governance questions. For corporate clients and wealth holders, this may mean a more gradual introduction of AI-enabled banking connections, particularly where systems could access sensitive information or initiate transactions.

The bank’s caution does not amount to a rejection of AI integration. Instead, Citi is signalling that broader access will depend on controls capable of addressing operational risks and regulatory requirements.

The next milestone will be Citi’s decision on how external agents can be identified, authorized, and constrained. Until those safeguards are established, the bank’s message is clear: innovation must proceed at a pace consistent with the protection of its systems and clients.

For a confidential discussion regarding your cross-border banking structure and global wealth management arrangements, contact our senior advisory team.

“There are places in which we want to go faster. This is not one of those places,” said Naveed Anwar, global head of AI, digital and data platforms within Citi’s services business.

“There’s a lot of demand right now, but with the guardrails in place that we want to implement, we are going to be talking in the future on how we actually open this up to companies to start interacting with us,” Anwar said in a Monday interview at the Las Vegas conference.

The $2.6 trillion-asset bank wants to enhance client experience but has to consider the consequences, he added.

Citi has “blocked anything that is trying to access our walls agentically, beyond some open banking read-only access that we’ve had in the past,” Anwar said. “As of right now, no one is connecting to Citi agentically, because we just don’t know what those models will be able to do.”

A “know your agent” process is needed, akin to know-your-customer protocols, “to make sure that we have the right guardrails and we’re meeting the regulators’ demands as well,” he said.