Census fetched 2026-09-30 · population: FDIC BankFind Suite institutions API (active institutions with a web address, FDIC index of 2026-09-29) · datasets (CC BY 4.0)

The US bank web census, September 2026: what 4,123 FDIC-insured banks publish for customers, security researchers and AI agents

Every active FDIC-insured bank and savings institution with a website address in FDIC BankFind (4,123 institutions) was fetched once over HTTPS on 2026-09-30, with robots.txt, security.txt (both locations), llms.txt and the A2A agent card. 4,023 answered with a website. Lists and lookup pages are ordered by total assets from the FDIC record.

Reachable over HTTPS

97.6%

4,023 of 4,123 banks

security.txt

0.9%

37 of reachable sites; 19 complete and current

Accessibility statement linked

25.8%

1,037 homepages

Privacy policy linked

75.5%

3,039 homepages

Block GPTBot

68 block ChatGPT-User; 83 ClaudeBot

llms.txt

228

0 publish an A2A agent card

What we found

security.txt: 37 of 4,023 reachable sites (0.9%) publish one; 19 are complete and current (a Contact line and an unexpired Expires line, RFC 9116); 3 have expired; 3 serve it only at /security.txt instead of /.well-known/security.txt.
Accessibility: 25.8% of reachable sites link an accessibility statement from the homepage.
Privacy: 75.5% link a privacy policy from the homepage.
HTTPS: 4,023 of 4,123 domains (97.6%) answered over HTTPS; 51 answer only over plain HTTP; 74.9% of reachable sites send HSTS; 145 homepages redirect to a different domain.
AI crawlers and assistants: 3,182 sites serve a robots.txt; 87 block GPTBot, 83 ClaudeBot and 68 ChatGPT-User; 64 disallow every bot; 65 block both ChatGPT-User and Claude-User; 13 block GPTBot while leaving OAI-SearchBot allowed; 218 name an AI crawler explicitly; 22 carry a Content-Signal line.
Machine-readable surfaces: 228 publish an llms.txt and 0 an A2A agent card; 1,546 homepages carry schema.org structured data.

By charter class

Charter class	In list	Reachable	security.txt	valid	privacy link	accessibility link	HSTS	blocks GPTBot	blocks ChatGPT-User	llms.txt
state nonmember bank (FDIC)	2,336	2,287 (97.9%)	13 (0.6%)	7	74.5%	23.7%	73.8%	49	42	100
state member bank (Fed)	684	670 (98.0%)	9 (1.3%)	5	77.0%	27.8%	77.2%	21	12	47
national bank (OCC)	640	628 (98.1%)	10 (1.6%)	3	75.5%	28.7%	75.2%	13	11	40
state savings institution	224	211 (94.2%)	3 (1.4%)	3	79.1%	33.2%	80.1%	1	1	22
savings bank	196	187 (95.4%)	2 (1.1%)	1	77.5%	25.1%	74.9%	3	2	16
state savings and loan	43	40 (93.0%)	0 (0.0%)	0	82.5%	27.5%	65.0%	0	0	3

By state

States with at least 20 banks in the list; percentages are of reachable sites.

State	In list	Reachable	security.txt	privacy link	accessibility link	HSTS	blocks GPTBot
TX	338	334 (98.8%)	2	67.4%	18.9%	69.5%	13
IL	313	302 (96.5%)	1	71.5%	30.5%	79.8%	4
IA	222	219 (98.6%)	3	86.3%	24.2%	78.1%	2
MN	214	212 (99.1%)	1	74.1%	20.8%	70.8%	3
MO	190	188 (98.9%)	2	79.8%	21.8%	79.3%	3
KS	181	178 (98.3%)	1	78.1%	18.0%	77.0%	0
OK	165	163 (98.8%)	0	77.9%	19.0%	74.2%	2
WI	153	149 (97.4%)	2	83.2%	37.6%	73.2%	1
OH	152	148 (97.4%)	1	79.7%	23.0%	75.0%	5
NE	132	127 (96.2%)	1	75.6%	15.7%	65.4%	0
GA	121	117 (96.7%)	1	82.9%	23.9%	75.2%	4
KY	119	114 (95.8%)	0	56.1%	19.3%	77.2%	3
CA	113	112 (99.1%)	1	82.1%	39.3%	75.9%	4
TN	109	108 (99.1%)	2	80.6%	26.9%	79.6%	6
PA	106	103 (97.2%)	2	71.8%	30.1%	65.0%	0
LA	104	101 (97.1%)	0	74.3%	22.8%	71.3%	8
NY	96	93 (96.9%)	0	77.4%	38.7%	74.2%	1
AL	89	85 (95.5%)	1	76.5%	21.2%	71.8%	1
MA	89	83 (93.3%)	2	81.9%	42.2%	89.2%	0
IN	87	87 (100.0%)	1	77.0%	31.0%	80.5%	0
FL	83	82 (98.8%)	0	72.0%	50.0%	81.7%	3
AR	77	75 (97.4%)	2	80.0%	29.3%	70.7%	6
MI	71	69 (97.2%)	0	73.9%	17.4%	72.5%	1
CO	63	62 (98.4%)	0	64.5%	19.4%	62.9%	0
ND	59	57 (96.6%)	0	82.5%	21.1%	73.7%	0
VA	56	56 (100.0%)	1	80.4%	35.7%	75.0%	2
MS	56	54 (96.4%)	0	77.8%	14.8%	59.3%	2
SD	53	52 (98.1%)	3	76.9%	11.5%	71.2%	0
NJ	48	44 (91.7%)	0	68.2%	31.8%	81.8%	2
SC	43	42 (97.7%)	0	88.1%	35.7%	73.8%	1
UT	41	40 (97.6%)	3	57.5%	17.5%	75.0%	2
WV	40	39 (97.5%)	0	53.8%	15.4%	79.5%	0
NC	35	35 (100.0%)	1	54.3%	20.0%	77.1%	0
MT	34	33 (97.1%)	0	84.8%	9.1%	63.6%	2
NM	28	27 (96.4%)	0	66.7%	14.8%	88.9%	0
WA	28	27 (96.4%)	0	74.1%	40.7%	85.2%	0
MD	26	25 (96.2%)	0	80.0%	48.0%	84.0%	1
CT	26	26 (100.0%)	0	88.5%	57.7%	84.6%	1
WY	23	23 (100.0%)	0	82.6%	13.0%	73.9%	1
ME	22	21 (95.5%)	0	90.5%	28.6%	85.7%	1

Named lists

Sites telling ChatGPT-User and Claude-User not to open pages for users (first 60 of 65)

camdennational.bank · trustcobank.com · 1stnb.com · primisbank.com · odnb.bank · southwesternbank.com · sabinebank.com · fnbgranbury.com · newfieldnationalbank.bank · bankfcb.com · farmersebank.com · libertycapital.bank · fncbank.com · verimore.bank · mycsb.bank · centurybank.net · 1cb.com · txtraditionsbank.com · bankoftexasonline.com · staffordsavingsbank.com · merchantscommercial.bank · thebank.bank · yourcbsm.com · ssbok.com · universalbank.com · unionbnk.com · myosb.bank · ozona.bank · milestonebank.com · mibanc.com · traditionsfirst.com · wsbankla.com · collinsstatebank.com · fsbnv.com · colemanbank.com · stlandrybank.com · firstcolonybank.net · thecommercialbanksc.com · cbtgrainger.com · bankofjamestown.com · madisonvalleybank.com · bksalem.net · lafayettestate.bank · nbt-texas.com · firstbankofboaz.com · citizensbankjackson.bank · fsbodem.com · exchange-bank.com · communityelmhurst.com · bankofcavecity.com · pboflebanon.com · upbnet.com · hcbonline.us · cbtbanking.com · riverwindbank.com · wcgb.com · j-cbank.com · vermilionbank.com · fnbrotan.com · fnbwauchula.com

Sites blocking GPTBot (OpenAI's training crawler) (first 60 of 87)

ally.com · camdennational.bank · trustcobank.com · communitybank.net · 1stnb.com · primisbank.com · bankencore.com · bankofannarbor.com · banksouthern.com · ombbank.com · odnb.bank · southwesternbank.com · sabinebank.com · richwoodbank.com · thebank1905.com · finfedmem.com · presidential.com · fnbgranbury.com · newfieldnationalbank.bank · bankfcb.com · freedombanknj.com · farmersebank.com · libertycapital.bank · fncbank.com · bradfordbank.com · verimore.bank · mycsb.bank · kingstonnationalbank.com · centurybank.net · 1cb.com · txtraditionsbank.com · bankoftexasonline.com · myconnectionbank.com · staffordsavingsbank.com · merchantscommercial.bank · thebank.bank · yourcbsm.com · ssbok.com · universalbank.com · unionbnk.com · myosb.bank · ozona.bank · milestonebank.com · mibanc.com · traditionsfirst.com · wsbankla.com · collinsstatebank.com · fsbnv.com · colemanbank.com · stlandrybank.com · firstcolonybank.net · thecommercialbanksc.com · cbtgrainger.com · bankofjamestown.com · madisonvalleybank.com · bksalem.net · lafayettestate.bank · nbt-texas.com · firstbankofboaz.com · hsbofmn.com

Homepages that redirect to another domain (first 60 of 145)

citibank.com → www.citi.com · barclaysus.com → cards.barclaycardus.com · stifelbank.com → bankwithstifel.com · northwest.com → www.northwest.bank · stifelbankstl.com → bankwithstifel.com · bealbankusa.com → www.bealbank.com · manasquanbank.com → manasquan.bank · tbogc.com → www.bankofgreene.com · qcbt.com → qcbt.bank · machiassavings.com → www.machiassavings.bank · bankfidelity.com → www.bankfidelity.bank · cogentbank.net → cogentbank.com · firstcommunitysc.com → www.firstcommunitybankers.com · cashmerevalleybank.com → www.cvb.bank · mybrb.com → www.mybrb.bank · firstnationalbanks.com → firstnationalbanks.bank · bankesb.com → trunorthbank.com · bankwest-sd.com → www.bankwest-sd.bank · firstsavingsbanks.com → www.firstsavingsbanks.bank · pegasusbankdallas.com → pegasus.bank · meadowsbank.bank → meadowsfin.com · ambankiowa.com → myasb.bank · marquettesavings.com → www.marquettesavings.bank · centralbankhouston.com → www.cbhou.com · croghan.com → croghan.bank · sbical.com → sbic.bank · yourlifeyourbank.com → www.cfsbky.com · yellowstonebank.com → www.yellowstone.bank · piedmontfederal.com → www.piedmontfederal.bank · cbtks.com → www.corefirstbank.com · firstgeneralbank.com → www.fgbusa.com · firstusbank.com → www.fusb.com · fnbames.com → www.fnb247.com · tbank.com → t.bank · midcountrybank.com → www.midcountry.bank · bankfnbt.com → brooks.bank · unitedtexasbank.com → www.utb.com · midwestbank.net → www.midwestbank.bank · fnbofwyo.com → www.firstnorthern.bank · primemeridianbank.com → www.midflorida.com · firststatebnk.com → www.firststatebnk.bank · oxfordbank.com → www.oxfordbank.bank · wabt.com → www.wab.bank · jvbonline.com → www.jvb.bank · versabankusa.com → us.versabank.com · stifeltrust.com → bankwithstifel.com · fnbc.us → myfnbc.bank · freedombanknj.com → www.fbnj.com · maconbankandtrust.com → www.macon.bank · fwbank.com → www.firstwestern.com · homestateonline.com → www.homestbk.com · greenbeltbank.com → www.greenbeltbank.bank · albanybank.com → albank.com · flcb.com → www.floridacapitalbank.com · washingtoncountybank.com → www.wcbank.com · hometownbankalabama.com → hometownbankal.com · marinebankandtrust.com → www.elgacu.com · milfordbank.com → milford.bank · northeastgabank.com → www.ngb.bank · highplainsbank.com → www.hpbgo.com

Sites with a Content-Signal line in robots.txt (22)

citizensstatebank.us · frontierbankco.com · unitedcitizensbank.com · gatewayfirst.com · washingtonstatebank.com · luminate.bank · faheybank.com · insouth.com · bbok.com · hydencitizensbank.com · farmersandtradersbank.com · valleycentral.org · tarborosavingsbank.com · firstfederalwashington.com · arborbanking.com · bankofannarbor.com · thechampionbank.com · farmersstatebankky.com · bankwithlnb.com · altonbankmo.com · pbtb.com · hsbofmn.com

Largest banks without an accessibility link on the homepage (first 60 of 300)

jpmorganchase.com · citibank.com · marcus.com · capitalone.com · statestreet.com · 53.com · huntington.com · schwabbank.com · firstcitizens.com · citizensbank.com · mtb.com · americanexpress.com · key.com · regions.com · pnfp.com · synchronybank.com · westernalliancebancorporation.com · zionsbancorporation.com · flagstar.com · umb.com · southstatebank.com · valley.com · columbiabank.com · popular.com · sofi.com · bokfinancial.com · fnb-online.com · raymondjamesbank.com · midfirst.com · hancockwhitney.com · bancofcal.com · fnbo.com · bankwithunited.com · texascapitalbank.com · fultonbank.com · glacierbank.com · easternbank.com · citynational.com · amerisbank.com · wesbanco.com · customersbank.com · firstinterstatebank.com · provident.bank · ameriprise.com · cathaybank.com · tscbank.com · boh.com · fhb.com · townebank.com · wsfsbank.com · bankatfirst.com · beaconbank.com · firstmerchants.com · applebank.com · stifelbank.com · 1firstbank.com · servisfirstbank.com · thirdfederal.com · enterprisebank.com · firstunitedbank.com

What banks are expected to publish

Gramm-Leach-Bliley privacy notice (Regulation P, 12 CFR Part 1016): Banks must give customers a clear notice of what nonpublic personal information they collect and share and, where sharing is optional, how to opt out (15 U.S.C. 6801-6809). Posting the notice online is one accepted delivery method; the census checks for a privacy link on the homepage. Source
ADA Title III and website accessibility: Banks are public accommodations under Title III of the Americans with Disabilities Act, and the Department of Justice's position is that their websites must be accessible to people with disabilities. The census checks only whether the homepage links an accessibility statement. Source
FDIC official digital sign (12 CFR Part 328): The FDIC's amended sign and advertising rule (December 2023) extends the official FDIC sign to digital deposit-taking channels such as websites and mobile apps and requires non-deposit products to be clearly distinguished; the FDIC has postponed the digital-channel compliance date more than once; the current date is on the FDIC rule page. Source
Vulnerability disclosure: security.txt (RFC 9116): No US bank regulator requires a security.txt, but a published contact for vulnerability reports is the standard way researchers reach a bank's security team. RFC 9116 defines the /.well-known/security.txt location and requires Contact and Expires fields; the census marks a file complete when both are present and unexpired. Source
robots.txt and AI crawlers (RFC 9309): robots.txt is voluntary and only tells well-behaved crawlers what to fetch. The census records what each bank asks of GPTBot, ClaudeBot, ChatGPT-User, Claude-User, Perplexity-User and Googlebot, and whether any AI crawler is named explicitly. Source

Look up any bank

Questions

How many US banks publish a security.txt?

37 of the 4,023 reachable bank websites (0.9%) publish a security.txt; 19 are complete and current and 3 have expired.

How many banks block AI crawlers and assistants?

87 bank websites block GPTBot, 83 block ClaudeBot and 68 block ChatGPT-User in robots.txt; 65 block both ChatGPT-User and Claude-User, so those assistants cannot open the bank's pages for a customer who asks. 228 publish an llms.txt.

Do bank websites link a privacy notice and an accessibility statement?

75.5% of reachable bank homepages link a privacy policy and 25.8% link an accessibility statement. 74.9% send an HSTS header.

Which banks are included?

Active FDIC-insured banks and savings institutions that list a website address in FDIC BankFind: 4,123 institutions on 2026-09-30, ordered by total assets. Credit unions are insured by the NCUA, not the FDIC, and are not in this list.

Can I reuse the data?

Yes. The findings, the CSV and every per-bank JSON record are published under CC BY 4.0; cite Agent Exchange and link the report.

Method and limits

Population: FDIC BankFind Suite institutions API (active institutions with a web address, FDIC index of 2026-09-29) with each institution's charter class, city, state and total assets in thousands of dollars as reported to the FDIC.. Fetch: one HTTPS request to the apex (then www.), following redirects, 8-second timeout, user agent agentexchange-census/1.0; then robots.txt, /.well-known/security.txt, /security.txt, /llms.txt and /.well-known/agent-card.json on the final host. "Reachable" means any HTTP response over HTTPS, including 403s from bot protection. Homepage links are detected from anchor targets and visible text, so a policy that exists but is not linked from the homepage is not counted. A robots.txt "blocked" verdict means the agent's own group (or the * group) disallows the whole site; "partly blocked" means some paths are disallowed. One snapshot per domain; slow sites and sites that block automated requests are counted as unreachable or reachable-with-error as the server answered. Per-domain records: lookup; downloads: CSV, NDJSON and JSON (CC BY 4.0).

Run one of these sites?

Instant AI visibility report for your bank: $9 · $49 full report or $99 monthly monitoring · Hosted accessibility feedback and privacy request desk

Other censuses

Government web census (.gov) · US college web census · US school district web census · US public library web census · Top 100,000 websites census · AI crawler census (top 10,000 sites)