The Payload in the Vault: Why Agentic Banking May Be a Compliance Trojan Horse

At the heart of every bank account is a fiction: the idea that a legal person can be held responsible. Anchorage Digital, the digital asset bank with a federal charter from the OCC, just extended that fiction to AI agents. The bank announced that it has opened its first bank accounts for AI agents and introduced an "agentic banking" platform designed for autonomous software to hold assets, sign payments, and execute financial tasks. On paper, this looks like a milestone in AI-human coexistence. From where I sit, it looks like we skipped a step. I am not skeptical about the technology. Anchorage Digital has built a serious custody infrastructure, and its compliance DNA is strong — the kind that makes bankers sleep at night. But whenever an institution applies a new label to an old legacy rail, I start reading the fine print. This is not a blockchain breakthrough. This is a bank service with a new customer class. And new customers, especially non-human ones, rarely arrive without introducing new risks into old legal codes. Anchorage Digital's platform sits in the application layer of a much larger stack. It relies on the bank's existing digital asset custody, its OCC charter, and the traditional banking system. What is new is the identity layer. In conventional KYC, a bank must know its customer. But what does it mean to "know" an AI agent? Does an algorithm have a beneficiary? When a machine signs a transaction, who holds the private key — or, in this case, who holds the liability? That question matters beyond philosophy. During the DeFi summer of 2020, I spent more than 600 hours manually auditing Aave V2's early scripts, and I found several errors in the interest rate model before they became exploits. Here is what I learned: the most dangerous bug is not a misplaced decimal. It is a misplaced assumption about who controls the system. Bankers assume AI agents will behave like ideal customers — rational, predictable, and quick to respond to compliance requests. Anyone who has run a bot that sold too early or bought into a honeypot knows that assumption is false. The architecture Anchorage is deploying has to solve three hard problems without immediate regulatory clarification. First, the AI agent must be bound to an identity that the bank can verify. That could be a decentralized identifier (DID), a verifiable credential, or simply a token wallet. The article does not disclose the mechanism, but the choice will shape everything. Second, the agent must be authorized to operate within limits. If the agent has full bank account access, a single prompt-injection attack could drain funds. Third, the bank must maintain auditability. Every decision the agent makes must be attributable to a fixed code version, an external context, and a cryptographic signature. If any one of these lapses, the account becomes a laundering vector. Now add the regulatory reality. The Bank Secrecy Act and its anti-money-laundering rules require financial institutions to identify beneficial owners. But an AI agent is not a beneficial owner; it is a tool. The question that will keep compliance officers awake is not whether the agent has a name, but whether the human who deployed the agent understands that they remain ultimately responsible. Anchorage can call the agent a customer, but the OCC has not issued a new category of legal identity. Until it does, every AI-operated account is really an account controlled by an unknown natural person — or by code that no person can meaningfully explain. That is the kind of ambiguity that gets financial institutions fined long after the innovation is celebrated. We should not call that "banking." We should call it "controlled autonomy." And controlled autonomy is precisely what the industry's loudest freedom narrative was supposed to escape. This is why I keep returning to a phrase I wrote in the margins of my Portuguese edition of the Ethereum whitepaper: "Code is law, but ethics is soul." Anchorage's platform offers the code — the API, the custody, the compliance wrapper. What it cannot offer is the soul. The agent has no moral intuition, no liability, no stake in the reputation of the bank. If it behaves badly, the bank pays the fine. The agent simply gets patched — or worse, deleted, leaving investors with another anonymous black-box collapse. Here is where the contrarian in me steps in. A bank account is not the same as financial autonomy. In fact, it may be the opposite. A self-custodial wallet gives an AI agent the ability to hold assets without permission. Anchorage's agentic banking, by contrast, is a custody product with the bank in the middle. That creates a strange paradox: AI agents are now being "freed" by the very institution that can freeze them. The platform extends capability while concentrating control. It is a leased autonomy, far closer to the gig economy than to sovereignty. The account can be closed, the API key rotated, the agent deplatformed. As someone who has spent 27 years watching open-source promises erode into terms of service, I find this difficult to celebrate without qualification. Yet I also try to test my own skepticism. There is a pragmatic case for Anchorage's approach, because real-world compliance is not an enemy of autonomy — sometimes it is the only reason autonomy is permitted at all. A mutable regulation is better than a theoretical purity that gets shut down after the first headline. If Anchorage's platform ever wants to support programmatic salary payments, accounting, tax filing, or invoice settlement, it needs a legal entity. The bank is essentially becoming a guardian for creatures that the legal system has not fully recognized. That is not cowardice. It is scaffolding. The risk is that the scaffolding becomes the building, and we mistake permission for freedom. I have thought a great deal about whether there is a better design, and I keep coming back to zero-knowledge proofs. If the industry is serious about AI agents as economic actors, we need a way for an agent to prove it has sufficient funds, valid authorization, and a clean operating history without exposing its entire private strategy or exposing the human operator to unnecessary surveillance. Anchorage has the compliance infrastructure to support such proofs, but doing so would require a far more sophisticated identity layer than a simple bank account. That is the information gain most coverage has missed: the real innovation will not be in AI agents holding accounts, but in proving, cryptographically, that an agent is acting within a pre-authorized boundary. Without that proof, we are just granting a machine access to a vault and asking the machine to be careful. My deeper concern is the timing. This announcement arrives at a moment when AI narratives are peaking and bull-market euphoria is hiding technical flaws. Nobody does a serious security audit of a feature announcement made on a Wednesday. The market sees "AI agents + banking" and imagines autonomous traders; it does not ask how an AI agent responds to a subpoena, or whether the bank can demonstrate that the agent truly understood the terms of its own account agreement. Those questions might seem boring next to the promise of a self-driving economy, but they are the questions that determine whether this becomes stable infrastructure or another liability pile. Transparency isn't the oxygen of trust. Accountability is. An API that lets an agent trade at 2 a.m. is not accountability. A dashboard that shows the agent's full decision log in a human-auditable format would be a start. A hard cap on agent holdings would be better. Circuit breakers triggered by sudden pattern changes would be even better. But none of this exists in the announcement. There is no code repository, no threat model, no formal classification of who bears liability if a hacked agent authorizes a fraudulent transfer. I do not need Anchorage to release its entire architecture, but I do need more than a press release that positions an opening of accounts as a technological revolution. Maybe I am asking for too much. In the tradition of open source, you ship a first version, then you iterate after the community responds. This is exactly how the market will respond. The first terrible AI-agent financial hack will become the industry's education. And once again, we will promise to do better, give the government a few slides about responsible decentralization, and then wait for the next exciting announcement. I have seen this cycle before. I was there when DeFi promised to make intermediaries obsolete; now the intermediaries are back — better dressed, with bank charters. I was there when NFTs promised to put artists first; the secondary market is now a liquid haze. I do not say these things to be cynical. I say them because the history of crypto is a history of forgetting the lesson that systems are not made of code alone. They are made of trust, and trust is made of habits, limits, and the ability to say no. Anchorage Digital has done something genuinely new. It has given a machine the right to hold capital under the protective shadow of a regulated bank. That may be an inevitable evolution of AI and finance. But the ethical question is not whether the agent can have an account. The question is whether the agent can be held to account. Until we answer that, every account opened by an AI agent is a liability disguised as progress — a vault with a payload inside, waiting for someone, or something, to open the door. The next line in this story should not be written by the marketing department. It should be written by regulators, auditors, and the open-source community. Otherwise, we will look back and realize that in our rush to make agents bankable, we forgot to make them trustworthy. Code is law, but ethics is soul.