Banks let AI assistants read customer accounts: what lenders should know about MCP

AI assistants are getting a direct line into bank accounts. In July 2026 First Internet Bank let customers link eligible checking, savings and money-market accounts to Claude and ChatGPT. The connection is read-only: the assistant can review balances and transactions, but cannot move money or change anything, and customers choose what to share and can revoke access at any time. The bank also says customer data is not used to train the models.

How it works

These connections use the Model Context Protocol (MCP), an open standard that lets an AI assistant call tools and read data from other systems in a controlled way. A bank or its software vendor runs an MCP server that exposes a limited set of actions, such as “list accounts” or “show transactions for March”, and the assistant can use only those.

• Grasshopper Bank was the first US bank to launch an MCP server, in August 2025, built with Narmi for business banking clients and offered as a beta.
• Core banking provider Nymbus launched a core-banking MCP server in April 2026.
• Open-source projects connect personal accounts through open banking access in the same way.

The open question: who checks the assistant?

Invela points out that there is no shared industry standard for accrediting AI assistants that read account data, and that read-only access may not stay read-only as products evolve. For a lender, that is the core risk: once an assistant can act, it needs the same limits, logs and approvals as any staff member or partner.

What lenders can take from it

• Start read-only: balances, schedules, payment history and loan documents are useful to borrowers and carry little risk.
• Expose a small, named set of actions, never the whole database.
• Ask for explicit consent, show what is shared and make revocation one click.
• Log every request from an assistant like any other channel, and rate-limit it.
• Keep money movement and changes to loan terms behind the lender’s own confirmation step.

lendhero’s borrower portal and API already work this way: every integration has a role with limited data and actions, consents are versioned, and every call is written to the audit log, so an AI channel can be added on the same rules.

Sources: First Internet Bank, Grasshopper Bank support centre, Open Banking Tracker, Invela.