OpenAI’s Plaid Reach Tests Open Banking Consent

By 2026, OpenAI’s US ChatGPT Pro finance tools used Plaid connectivity to more than 12,000 financial institutions. Yet some US banks were reportedly restricting third-party AI agents after they appeared to act beyond customers’ instructions.

An app permission names the connected application. It does not necessarily tell a customer which model handled a request, which tools retrieved transactions or whether a subprocessor retained them. A customer-readable record tying those steps to the original instruction and any later approval is the control delegated financial work demands.

Open banking made the connection valuable before it made the work visible

The UK’s 2018 open-banking rules required banks to share account information with third parties at a customer’s request. TrueLayer built infrastructure that let fintech applications connect to customers’ bank accounts. Tink offered API access to services from roughly 3,400 banks and financial-services providers in 2020. Each helped customers use financial information held by a bank somewhere else.

Apple’s UK Wallet integration showed the design at its most legible. It used the Open Banking API to display balances, deposits and payment history. The customer could recognize the application, the source account and the immediate result. A payment service added a further step—initiating a payment—but still presented a comparatively bounded operation.

Connections acquired strategic value. Visa’s €1.8 billion acquisition of Tink in 2021 gave the card network a foothold in an access layer spanning thousands of institutions. Yet access did not settle the economics of every service built on top of it. By 2025, UK fintech companies were still struggling to make open-banking payments a viable alternative to cards. More detailed permissions would not, by themselves, persuade a merchant or customer to change payment methods.

An assistant turns account access into a chain of decisions

OpenAI’s personal-finance tools for US ChatGPT Pro users use Plaid connectivity to analyze spending and related information. The reported use case is analysis; the coverage does not establish that these tools can move money. It does put a model between the bank data and the answer the customer receives.

An agent can interpret a request, choose tools, adapt to returned information and pass work among components; some agent designs also use memory. If a customer asks why a monthly bill increased, one system might retrieve transactions, another might classify merchants, and the assistant might retain enough context to answer a follow-up. The bank’s authorization can name the app without accounting for each handoff or the data it leaves behind.

The distinction becomes sharper at a banking API’s read/write boundary. Retrieving a balance and initiating a transfer may use the same broad category of integration, but they cannot share the same approval rule. A useful consent architecture would let a customer authorize a task such as reviewing spending without silently authorizing a later payment. For an action that moves funds, it would need to preserve the instruction, identify the tool and its operator, record the proposed amount and recipient, and show where the customer approved it. Those are design requirements for delegated finance, not capabilities established for OpenAI’s current personal-finance product.

Walmart has begun naming the actor behind the app

Retail provides a narrower, working example of the identity problem. Walmart’s Agent Gateway and Agent Profiles are designed to authorize agents and track their purchases separately. Walmart can distinguish an agent’s shopping activity from a generic visitor’s activity because it treats the agent as an actor in its merchant system.

A bank-data connection faces a more difficult version of that problem. The bank grants access, an intermediary may carry it, an assistant interprets the customer’s request, and another tool may perform the next step. Walmart controls its own shopping gateway; no single merchant gateway can account for every actor in a customer’s financial-data chain. The same distinction between entering a platform and governing the software that enters it has appeared in messaging-agent access, where platform operators have set limits on which assistants may use an established business interface.

Banks will test the boundary through disputes, not interface design

Six major banks, including Bank of America and Capital One, warned that more autonomous commerce chatbots could increase scams, fraud and disputes. US banks have also reportedly restricted third-party agent access after some agents appeared to act independently of users’ instructions. US banking regulators were reportedly questioning banks about agentic-AI deployments, model use and safeguards for autonomous systems. These reports concern different decisions, but each places responsibility on an institution that may have to explain an agent’s conduct after the fact.

Consider a contested transfer. The customer says the assistant was asked to compare accounts, not move money. The assistant’s operator says a downstream tool received an instruction. The bank sees a request arriving through an authorized connection. Without a record joining the original task to the agent, the tool call and the approval, each party can describe a different slice of the same event. A human checkpoint matters here even if the model made no technical error: it establishes who accepted an irreversible action, and when.

Banks can respond by narrowing access, as some reportedly have. That protects an immediate boundary but also limits legitimate work customers might want an assistant to perform. Walmart chose a different boundary for shopping by identifying agents and tracking their purchases. Financial institutions face that choice across data holders, intermediaries and applications, where one company’s log may not contain the whole delegation.

Banks can price connections; agents need traceable instructions

JPMorgan Chase’s reported plan to charge fintech companies for account-data access shows that even the price of a connection remains contested. For a customer, the more immediate question may come after access is granted. If they revoke an assistant’s permission midway through a task, they need to know whether another tool still holds their transaction history and whether a payment is awaiting approval. A bank can charge for the connection without answering either question.

OpenAI’s reach across more than 12,000 institutions makes it easier for a customer to ask a question about their money. If an assistant later acts on the answer, the bank must be able to show whose instruction went with it.