China Sets First Safety Standard for AI Agents in Finance

On August 27, the Beijing Fintech Industry Alliance published a group standard titled "Security Requirements for AI Agent Technology in Financial Applications," China's first industry standard focused specifically on the safety of AI agents operating in financial contexts, technology outlet Leiphone reported the same day. The standard states that third-party AI agents on mobile devices may not use system permissions to automatically read or operate the graphical interface of financial apps without authorization from the financial institution that runs them; when an agent needs microphone, screenshot, screen-recording or screen-sharing access to gather data, it must also comply with the security policy of the app being called. The industry has summarized this as "dual authorization": an agent can only act on a financial app once it has permission from both the end user and the institution.

The standard was led by the Beijing National Fintech Certification Center, working with financial institutions including China Postal Savings Bank, the Industrial and Commercial Bank of China, China UnionPay, Bank of China, Bank of Communications and Hua Xia Bank, alongside technology companies Huawei, Ant Group, ByteDance's Volcano Engine and Tencent Cloud. It covers five areas: initialization and input, model inference and decision-making, identity verification and operation, data security and privacy protection, and risk prevention and compliance. According to an independent analysis by tech outlet News.ai7788.cn, the core shift is that agents are now required to interact with financial institutions through official APIs rather than the screen-scraping methods many relied on before, putting control back in the hands of the banks themselves.

A banking outage that exposed a regulatory gap

The standard did not emerge in a vacuum. In December 2025, a smartphone model equipped with an AI assistant went on sale, and users soon reported abnormal logins and blocked payments across multiple banking apps; by December 6, the assistant's ability to operate financial apps had been pulled. At the time, no rules specifically governed how agents should behave in financial settings. News.ai7788.cn's coverage described the episode as an industry turning point: as agents raced into financial use cases, their combination of high system permissions and cross-app operation created fast-accumulating risk. Some agents worked by reading the screen, simulating taps and using OCR to interpret interface text rather than calling an app's official interface — a method with broad reach that also bypassed the app's own controls over permission scope, risk management and liability, with direct consequences for account and fund security in licensed payment and wealth-management scenarios.

Part of a wider wave of Chinese agent-security rulemaking

The finance-specific standard sits inside a broader run of national rulemaking. In May 2026, the Cyberspace Administration of China, the National Development and Reform Commission and the Ministry of Industry and Information Technology jointly issued implementation guidance calling for proper permission management and behavior control of AI agents. In July, a series of national standardization guidance documents on "AI agent interconnection" was published, and the national standards body opened work on a mandatory national standard for baseline agent application security; on July 15, regulators published a new batch of only seven approved on-device generative AI services. On September 9, at the 2026 Bund Summit, the China Cybersecurity Association and Ant Group launched two further group standards — on agent identity authentication and authorization, and on agent runtime security — this time covering office and everyday-life scenarios beyond finance, a sign that Chinese regulators are building technical baselines for agent safety on several fronts at once.

• Standard published: August 27, 2026, by the Beijing Fintech Industry Alliance
• Core rule: an agent needs both user AND financial-institution authorization to act on a financial app
• Lead body: Beijing National Fintech Certification Center; participants include six banks/payment networks plus Huawei, Ant Group, Volcano Engine and Tencent Cloud
• Trigger event: a December 2025 AI phone assistant pulled from financial-app control after banking outages
• What follows: a May 2026 national policy, July guidance documents and a mandatory standard in the works, and two broader agent-security standards launched in September

Device makers have already begun shifting their technical approach to match an "API-first, app-permitted" logic. Reports say ByteDance's newest Doubao phone changed how it cooperates with super-apps like Alibaba's and Tencent's, no longer reading the screen or simulating taps after user authorization — it now connects only when an app itself offers an MCP (Model Context Protocol) service and permits control. StepFun's STEPX Neo similarly switched to a GUI-MCP protocol that lets each app decide how much access to grant. In June 2026, WeChat and phone maker Honor rolled out an agent-to-agent (A2A) capability letting users start WeChat calls or send messages through a voice assistant — but only because WeChat itself opens an interface to the phone-maker's agent, creating a second layer of permission beyond the user's own. Overseas, Google and Samsung have taken a comparable approach on the Galaxy S26 line, with the system opening specific permissions and apps cooperating on the rest — suggesting the "dual authorization plus official interface" model is not uniquely Chinese, but a direction agent makers worldwide are converging on as they approach payments and other high-stakes tasks.

What it changes for AI agent makers outside China

According to News.ai7788.cn's analysis, the standard effectively raises the bar for entry into financial use cases: once dual authorization and official API access are mandatory, smaller agent vendors without the negotiating leverage to secure bank partnerships or official interfaces will struggle to operate in financial scenarios, concentrating the market further around firms that already work with major institutions. For financial regulators outside China still weighing how to handle AI assistants that can read a screen and tap a banking app on a user's behalf, this gives them a concrete template to study: rather than relying on after-the-fact enforcement, mandate dual authorization and official interfaces before an agent gets anywhere near a real transaction. As AI agents edge closer to actually moving money in markets from Europe to Southeast Asia, the question China's regulators have just answered — who has to say yes before an agent can touch a bank account — is one every financial regulator will eventually have to answer too.