‘Fight AI with AI’: Singapore banks warn against third-party AI agents as observers flag liability risk

[SINGAPORE] The Republic’s three major banks are warning customers against using artificial intelligence agents to access their accounts, as financial institutions around the world grapple with security risks and who should bear responsibility when autonomous bots make unauthorised transactions.

While the local lenders have yet to see the use of such agents among their customers, market observers noted that their adoption is inevitable.

“Every bank now has to look at their terms and conditions to see whether a third-party AI agent used by a first-party client should be considered a first party or third party,” said DBS CEO Tan Su Shan, at the lender’s third-quarter results briefing.

This comes as US banks detect third-party AI agents accessing customer accounts, with some moving to block such activity amid reports of bots attempting actions beyond users’ instructions.

Leong Yung Chee, UOB’s group chief financial officer, said such use of AI agents among customers is effectively “ring-fenced” at the bank.

OCBC’s group CEO Tan Teck Long also said the lender will not allow third-party agents to interact with the bank, such as to transfer money out autonomously.

Tan Su Shan said that DBS actively discourages customers from sharing credentials with and using AI agents, “because you just don’t know how and what (the third-party agents) are going to do with these credentials”.

Currently, visible agentic activity in Singapore has largely been through authorised channels, where banks deploy their own agents and payment networks have dedicated rails for agentic transactions, said Nitin Datta, EY Asean financial services AI leader.

But given the speed of AI development and adoption, Tan Su Shan noted that it will be “sooner or later” that customers will use agents for various reasons.

DBS is therefore studying how it can allow the use of third-party agents in some lower-risk transactions in a safe way. This requires customers to have basic cyber hygiene, which is to trust no one with one’s own details.

For the bank, it will employ a multi-layer approach to fend off cyberattacks, and study ways to use AI to counter AI, given the speed of autonomous attacks, she said.

“You cannot have humans against AI,” said DBS’ chief. “You must fight AI with AI, and that’s exactly what we’re trying to do – which then helps you to do your patching faster.”

In July, the Monetary Authority of Singapore proposed a framework for AI agents in financial services, which has checkpoints to verify and record an AI agent’s proposed actions before the execution of its tasks.

First party versus third party

With customer-driven agentic banking, observers said it is difficult to distinguish between malicious bots and legitimate, customer-authorised bots.

For example, AI agents that interact through the same digital channels and credentials as the customer display similar actions to legitimate human behaviour, said Yura Mahindroo, banking and capital markets, global banks practice leader at PwC Singapore.

AI agents by nature are also meant to be goal-oriented, said Cheryl Seah, director, corporate and finance, at Drew & Napier.

This means the agent can decide what steps are to be taken to achieve a goal, even if the steps are not aligned with the customer’s intentions, she said.

This poses risks to banks and individuals alike. For banks, observers expect AI will make liability and accountability more complex.

PwC’s Mahindroo said: “It will no longer be the simpler case of whether the customer has authenticated a transaction, but whether each subsequent action was specifically intended and authorised by that customer.”

Joyce Lee, special counsel for technology and intellectual property at Withers KhattarWong, also noted that liability could become complicated because more relationships are involved, apart from the customer and the bank.

Questions may arise around the AI provider’s responsibility, the permissions given to the agent and the circumstances in which the agent departed from instructions, she said.

“This makes audit trails increasingly important because it may no longer be sufficient simply to establish that valid credentials were used,” she said.

Furthermore, AI agents operate with speed and at scale, so a compromised or poorly instructed agent can rapidly execute multiple transactions before a customer or bank has time to intervene, PwC’s Mahindroo said.

Banks may also suffer from reputational risk.

Meng Liu, principal analyst at Forrester, noted that banks will risk losing control over authentication, customer consent, liability and the customer relationship.

Meanwhile, the bank would also not want to become a “policeman” of all bots used on its platform, said Drew & Napier’s Seah.

As a result, the lender needs to balance between security controls and ensuring a frictionless experience for customers, she said.

Solutions for the inevitable

Given the rapid adoption of AI, US banks are looking to pre-emptively prevent such risks by blocking third-party agent access altogether.

But simply blocking agents is not a sustainable long-term strategy, said Forrester’s Liu.

“Agentic banking will arrive whether individual banks welcome it or not,” he said. “Ultimately, the winning model will be controlled delegation, not blanket blocking.”

Forrester expects AI agents will be in around one-third of business-to-business payments in 2026, as such transactions already operate within approval policies, invoices, purchase orders and predefined business rules.

Thus, banks should move from thinking about “human versus bot” to “trusted versus untrusted agent”, said Liu.

For example, he expects the banks will need identifiable agents, explicit and revocable customer mandates, and auditable records of what the customer instructed the agent to do.

For a more durable solution, EY’s Datta suggests a sanctioned channel for third-party agents, where the agent has its own identity, a defined mandate, and step-up confirmation for anything that moves money.

Banks will also increasingly need to combine authentication with behavioural and transaction-risk signals – such as Web page scrolling speeds – to indicate deviations from normal human behaviour, said PwC’s Mahindroo.

For higher-risk actions, banks may also require additional confirmation from the customer, he added.

Overall, Drew & Napier’s Seah expects banks would have to decide their risk appetite.

If its stance is to ban AI agents, then the user could be said to have breached the terms of use and the bank is not liable, she said.

But if a bank decides to allow AI agents, then it must have controls in place, such as more authentication measures before a significant action is taken.

EY’s Datta said: “The question for banks is no longer whether to allow agents, but how quickly they can stand up the authorised route so customers do not default to the unauthorised one.”