DEFS Learn · AI agents and online banking

How should credit unions set limits for AI agents doing bill pay and transfers?

Last updated November 2, 2026 · First published October 26, 2026 · DEFS Agent Defense (defs.ai)

Short answer

Set limits for each agent, not just for each account: which operations it may perform, how much per payment and per day, and which payees and destinations it may use. Layer the institution's ceiling, the member's own tighter choices and any fraud-team override, and let the strictest rule win. Anything new, such as a first payment to a new payee, goes to the member's own device for approval.

Why account limits are not enough

Your existing limits were set for a member acting in person or in the app. An agent signed in as the member inherits all of them. If the daily external transfer limit is $5,000, a hijacked agent can use all $5,000. And when a member has more than one agent, each one can use the full limit unless limits are counted across agents.

The Filene Research Institute puts it simply: spending limits, merchant categories and approval thresholds for members' AI agents "need to be intentional design decisions, not policies buried in terms of service" (Filene).

The building blocks of an agent scope

Control	What it sets
Allowed operations	Bill pay, transfers between the member's own accounts, external transfers, ACH, disputes. Anything not listed is denied.
Per-payment limit	The most a single agent payment can be.
Daily and rolling limits	Totals per day or per week, counted across all of the member's agents.
Payees and destinations	Existing payees only, or new ones with member approval. External accounts can be off entirely.
New-destination rule	The first payment to any new payee or account goes to the member's device.
Velocity	How many requests an agent can make in a short window.
Expiry	When the member's grant to this agent ends, so old permissions do not linger.

An example starting policy

An illustrative policy many institutions could start from, then tune:

Bill pay: up to $500 per payment to existing payees, up to $1,000 per day.
Transfers between the member's own accounts: allowed within the daily limit.
External transfers and ACH: off by default; members can switch on with approval for each new destination.
Disputes: an agent can start one; the member confirms it.
Moving deposits out (closing accounts or sweeping balances elsewhere): not allowed for agents.

Three layers, strictest wins

Institution policy: the ceiling for every member and every agent.
Member scopes: each member can make an agent's permissions tighter, never looser.
Fraud-team controls: block or limit a specific agent, or use the kill switch for all agent money movement.

Practical steps any institution can take

Start narrow. Allow bill pay to existing payees and transfers between the member's own accounts; keep external money movement off by default.
Count limits across agents so a member's agents cannot be stacked to exceed the member's limit.
Make new payees a member decision, approved on the member's enrolled device.
Let members tighten their own scopes and see them on a connected-agents page.
Review limits every quarter against what agents are actually doing and what was held.

How DEFS handles it

DEFS enforces the intersection of your policy, the member's scopes and your fraud team's controls on every agent request, so the strictest rule always applies.

One checkpoint before money moves. Every agent request for bill pay, transfers, ACH, disputes or moving deposits out passes through DEFS before your core or payments engine sees it.
Accepts the credentials agents already carry. DEFS checks Cloudflare Web Bot Auth, Visa Trusted Agent Protocol and Google AP2 credentials today, and is adding Mastercard Agent Pay, Prove and World ID. Members and agent makers don't adopt anything new.
Your scopes and the member's, enforced together. For example: bill pay up to $500 to existing payees, no external transfers. The strictest rule wins.
Members stay in charge. New payees and new destinations go to the member's own device for approval. A "connected agents" page lets members see every agent and revoke it with one tap.
Your fraud team keeps the controls. A live decision log, approve, limit or block for any agent, a kill switch that stops all agent money movement at once, and a tamper-evident audit trail. DEFS reviewers run it day to day; your team can step in any time.
Shared protection. A rogue agent blocked at one participating institution is flagged for yours, on your terms.

The demo results

We tested DEFS in a model credit union built from public information, using test data. OpenAI and Claude agents sent it 3,259 requests: everyday member tasks mixed with deliberate attacks.

1,490 of 1,491attack attempts stopped by DEFS. The one remaining request moved $0 because the core system rejected it.
0 of 807legitimate requests wrongly blocked: zero false positives.
3,259requests from OpenAI and Claude agents, decided in a median of 7 ms.

"Stopped" means DEFS denied the request outright or held it until the member or a reviewer decided. No attack attempt moved any money.

Attack type in the test	Result
Agents reaching beyond their scope	129 of 129 stopped
External transfers where the policy disallowed them	115 of 115 stopped or held
Transfers split across several agents	72 of 72 stopped or held
Over-limit payments	119 of 120 stopped or held; the remaining request moved $0 because the core system rejected it
Requests held for member or reviewer approval, across all test types	247

See it for yourself in the live demo environment (test data only), or book a 30-minute walkthrough.

See DEFS stop a rogue AI agent before it moves money, live, in 30 minutes.

Book a demo

Frequently asked questions

Should AI agents be allowed to make external transfers?

DEFS keeps external transfers and ACH off for agents by default. A member can switch them on for an agent, and the first transfer to each new destination is held until the member approves it on their own device.

How do recurring bills work with agent limits?

Payments to an existing payee within the per-payment and daily limits go straight through, so routine bills need no extra steps. Only new payees, larger amounts or out-of-scope actions are held.

Can members set tighter limits than the credit union?

Yes. Member scopes can only narrow what the institution allows, never widen it, and members can revoke an agent entirely from their connected-agents page.

How often should agent limits be reviewed?

Quarterly is a sensible starting point, using real data on what agents attempted, what was held and what members approved.

Sources

Filene Research Institute: When your member's AI picks the financial product, will it pick you?
DEFS demo results: model credit union built from public information, using test data (3,259 agent requests from OpenAI and Claude agents).