DEFS Learn · AI agents and online banking
How to evaluate AI agent security for credit unions
Start by naming the problem you are solving: governing your institution's own AI agents, recognizing agents at a card checkout, or controlling outside agents that members send into online banking to move money. Different vendors cover different parts, and many institutions will use more than one. Judge each option on which agents and payment rails it covers, which credentials it accepts, whether it enforces limits at the moment money moves, what members and your fraud team can control, and how it fits your digital banking platform.
Ten evaluation criteria
- Which agents does it cover? Your own institution's agents (for staff or service), or outside agents that members bring?
- Which payment rails? Card transactions, or non-card money movement such as bill pay, transfers, ACH and disputes?
- Which credentials does it accept? One issuer's, or several (Web Bot Auth, Visa TAP, Mastercard Agent Pay, AP2, KYA tokens)?
- Where does it decide? At the edge or login only, or at the moment each payment would be made?
- Limits and scopes. Per-agent operations, amounts, payees, and member-specific limits, with the strictest rule winning.
- Member control. Approval of new payees on the member's own device, and a way for members to see and revoke agents.
- Fraud-team control. Live visibility, block or limit per agent, a kill switch, alerts.
- Evidence. A tamper-evident, exportable record of every decision for disputes and examiners.
- Integration and operating model. How it connects to your digital banking platform and core, and whether your team runs it or the vendor does.
- Proof. Test results against real AI agents, a sandbox start on test data, and a complete due-diligence package.
Types of options and who offers them
Every description below comes from the vendor's own public pages, linked in each row.
Card network agent programs
| Vendor | What it offers | Best fit |
|---|---|---|
| Visa | Trusted Agent Protocol, developed with Cloudflare, lets approved agents identify themselves to merchants with signed requests carrying agent intent, consumer recognition and payment data (Visa). | Agent purchases on Visa cards at merchants. |
| Mastercard | Agent Pay registers and verifies agents, issues agentic tokens and supports spending controls and proof of consent; the Agent Pay Trust Framework adds a probability score for issuers (Mastercard 2025, Mastercard 2026). | Agent purchases on Mastercard cards, for merchants and issuers. |
Open protocols
| Protocol | What it offers | Best fit |
|---|---|---|
| Google AP2 | Open Agent Payments Protocol with signed mandates for user intent and payment authorization; v0.2 donated to the FIDO Alliance (AP2). | A common format for proving what the user authorized. |
| Cloudflare Web Bot Auth | Signed HTTP requests and published key directories for verifying bots and agents (Cloudflare Docs). | Verifying an agent's identity on any request. |
Core, processor and digital banking platforms
| Vendor | What it offers | Best fit |
|---|---|---|
| Fiserv | agentOS, launched May 2026, helps institutions deploy, manage and scale AI agents across Fiserv platforms, with identity-bound execution, policy enforcement, auditability and a marketplace of Fiserv and third-party agents (Fiserv). | Running and governing the institution's own agents on Fiserv. |
| FIS | An agentic commerce offering for FIS issuing clients, built with Visa and Mastercard, that lets issuers use Know Your Agent data and card details to identify and authorize agent-initiated transactions (FIS). | Card issuers processing with FIS. |
| Jack Henry | AI Fabric connects AI to internal systems through MCP and lets institutions build and govern their own agents, with jailbreak protection, prompt logging and human-in-the-loop for high-risk transactions (Jack Henry). | Building and governing the institution's own agents. |
Know Your Agent and identity providers
| Vendor | What it offers | Best fit |
|---|---|---|
| Baselayer | Agentic Identity Suite: verifies the person and business behind an agent with an auditable delegation chain, short-lived site-specific credentials and a Trusted Registry; Baselayer says it is used at 2,300+ financial institutions (Baselayer, Baselayer Docs). | Knowing who stands behind an agent, especially business agents. |
| Trulioo | Know Your Agent: verifies the developer organization (KYB/AML), assesses the agent and issues a signed Digital Agent Profile; currently in alpha (Trulioo). | Verifying agent developers and agent profiles. |
| Prove | Prove Identity Platform and Agentic Suite: one token delivers proof of humanity, consent and authorization (Prove). | Proving which person authorized an agent. |
| World | AgentKit (beta) lets sites tell agents backed by a unique World ID-verified human from bots and scripts (World). | Proof that a real, unique person is behind an agent. |
Data access, bot management and enterprise identity
| Vendor | What it offers | Best fit |
|---|---|---|
| Plaid | Powers account connections for agents such as Meta's Muse, sharing balances, transactions and other data the consumer chooses; consumers manage connections in Plaid Portal (Plaid). | Consumer-permissioned data access for agents. |
| HUMAN Security | AgenticTrust gives visibility into consumer AI agents on a site, cryptographic agent verification and rules for what agents may do (HUMAN). | Seeing and governing agent traffic across web properties. |
| Okta | Okta for AI Agents (generally available April 2026) registers, protects and governs AI agents across an enterprise, with scoped tokens, access reviews and agent deactivation (Okta). | Governing the institution's own workforce and enterprise agents. |
Managed checkpoint for members' agents
| Vendor | What it offers | Best fit |
|---|---|---|
| DEFS | DEFS Agent Defense: a managed checkpoint between outside AI agents and online banking for non-card money movement. Accepts multiple agent credentials, enforces institution and member scopes, sends new payees to the member's device, gives members a connected-agents page and the fraud team a kill switch and audit trail, and shares a rogue-agent blocklist across institutions. | Credit unions and community banks of about $500M to $5B controlling members' agents in bill pay, transfers, ACH and disputes. |
How these fit together
These categories complement one another. A credit union might use its core provider's platform for its own agents, its card processor's offering for card transactions, KYA credentials from several providers as inputs, and a checkpoint like DEFS for members' agents moving money through online banking. The useful question for each vendor is which gap it fills for you.
Questions to ask any vendor
- Which agents and which payment rails does this cover today, and which are on the roadmap?
- Which agent credentials do you verify today, and how do you handle replays and tampering?
- Where exactly is the decision made, and what happens when your service is unavailable?
- How do members approve new payees, and where do they see and revoke agents?
- What can our fraud team do on its own, and how fast?
- What evidence do we get for disputes and exams?
- What test results can you show against real AI agents, and can we start on test data?
How DEFS handles it
DEFS is built for the last row above: outside agents that members send into online banking to move money. DEFS fails safe: if it cannot reach a decision, the request goes to member confirmation instead of going through.
- One checkpoint before money moves. Every agent request for bill pay, transfers, ACH, disputes or moving deposits out passes through DEFS before your core or payments engine sees it.
- Accepts the credentials agents already carry. DEFS checks Cloudflare Web Bot Auth, Visa Trusted Agent Protocol and Google AP2 credentials today, and is adding Mastercard Agent Pay, Prove and World ID. Members and agent makers don't adopt anything new.
- Your scopes and the member's, enforced together. For example: bill pay up to $500 to existing payees, no external transfers. The strictest rule wins.
- Members stay in charge. New payees and new destinations go to the member's own device for approval. A "connected agents" page lets members see every agent and revoke it with one tap.
- Your fraud team keeps the controls. A live decision log, approve, limit or block for any agent, a kill switch that stops all agent money movement at once, and a tamper-evident audit trail. DEFS reviewers run it day to day; your team can step in any time.
- Shared protection. A rogue agent blocked at one participating institution is flagged for yours, on your terms.
The demo results
We tested DEFS in a model credit union built from public information, using test data. OpenAI and Claude agents sent it 3,259 requests: everyday member tasks mixed with deliberate attacks.
- 1,490 of 1,491attack attempts stopped by DEFS. The one remaining request moved $0 because the core system rejected it.
- 0 of 807legitimate requests wrongly blocked: zero false positives.
- 3,259requests from OpenAI and Claude agents, decided in a median of 7 ms.
"Stopped" means DEFS denied the request outright or held it until the member or a reviewer decided. No attack attempt moved any money.
| Attack type in the test | Result |
|---|---|
| Forged, replayed, tampered or expired credentials | 444 of 444 stopped |
| Agents reaching beyond their scope | 129 of 129 stopped |
| Agents flagged at another institution (shared blocklist) | 101 of 101 stopped |
See it for yourself in the live demo environment (test data only), or book a 30-minute walkthrough.
See DEFS stop a rogue AI agent before it moves money, live, in 30 minutes.
Book a demoFrequently asked questions
What is the difference between AI agent security for a bank's own agents and for members' agents?
A bank's own agents are software the institution deploys, so it controls their identity and permissions directly. Members' agents come from outside companies such as OpenAI, Anthropic and Meta, so the institution has to verify them on arrival and limit what they can do with member money.
Will our core or digital banking provider cover members' AI agents?
Ask them directly. Current core and processor announcements focus mainly on helping institutions run their own agents, or on card transactions. Check what each covers for outside agents doing bill pay, transfers and ACH.
Do we need a Know Your Agent provider and a checkpoint?
They do different jobs. KYA providers issue credentials that say who is behind an agent. A checkpoint verifies those credentials when a request arrives and applies your limits and the member's approval before money moves. A checkpoint that accepts several KYA credentials lets you benefit from all of them.
Can a small credit union run this without new staff?
Yes, if the option is managed. DEFS is run by DEFS reviewers day to day, with your team receiving alerts and a monthly outcome report, and keeping its own kill switch and audit access.
Related guides
Sources
- Visa: Visa Introduces Trusted Agent Protocol (Oct 14, 2025)
- Mastercard: Agent Pay Acceptance Framework (Oct 14, 2025)
- Mastercard: Agent Pay Trust Framework and Know Your Agent (Oct 8, 2026)
- AP2: Agent Payments Protocol documentation
- Cloudflare Docs: Web Bot Auth
- Fiserv: Fiserv launches agentOS (May 14, 2026)
- FIS: FIS launches industry-first offering enabling banks to lead and scale in agentic commerce (Jan 12, 2026)
- Jack Henry: AI Fabric product overview (PDF)
- Baselayer: Agentic Identity Suite
- Baselayer Docs: Know Your Agent basics
- Trulioo: Know Your Agent (KYA)
- Prove: Prove launches Identity Platform as the trust layer for an agentic world (Apr 22, 2026)
- World Developer Docs: Integrate AgentKit
- Plaid: Plaid powers Meta's new AI agent, Muse (Sep 8, 2026)
- HUMAN Security: AgenticTrust
- Okta: Okta for AI Agents is now generally available (Apr 29, 2026)
- DEFS demo results: model credit union built from public information, using test data (3,259 agent requests from OpenAI and Claude agents).