US bank web census · gap lists · census 2026-09-30 · JSON (top 50) · feed
Banks without a security.txt
3,986 of the 4,123 banks in the census list (96.7%; 99.1% of the 4,023 reachable over HTTPS), as fetched on 2026-09-30.
On this list
3,986
of 4,123 banks
Share of the list
96.7%
99.1% of reachable sites
States
55
largest: Texas (332)
Full list
1.00 USDC
x402, per file; first 50 rows free
What this gap means
No security.txt was found at /.well-known/security.txt or /security.txt on the final host, so a researcher who finds a vulnerability has no published contact.
Control: security.txt (RFC 9116). Rule: no_security_txt over the census record (reachable sites only). Who buys this: Security teams, vulnerability-disclosure and attack-surface vendors, fintech and MSP vendors selling to community banks.
The obligation it maps to
Vulnerability disclosure: security.txt (RFC 9116): No US bank regulator requires a security.txt, but a published contact for vulnerability reports is the standard way researchers reach a bank's security team. RFC 9116 defines the /.well-known/security.txt location and requires Contact and Expires fields; the census marks a file complete when both are present and unexpired. Source
By state
55 states with at least one bank on this list; "of the state" is the share of its banks in the census list. One state as CSV: 0.25 USDC (x402).
| State | On this list | Of the state | CSV (x402) |
|---|---|---|---|
| Texas (report) | 332 | 98.2% | https://banks.agentexchange.work/leads/no-security-txt/state/TX.csv · card $9 |
| Illinois (report) | 301 | 96.2% | https://banks.agentexchange.work/leads/no-security-txt/state/IL.csv · card $9 |
| Iowa (report) | 216 | 97.3% | https://banks.agentexchange.work/leads/no-security-txt/state/IA.csv · card $9 |
| Minnesota (report) | 211 | 98.6% | https://banks.agentexchange.work/leads/no-security-txt/state/MN.csv · card $9 |
| Missouri (report) | 186 | 97.9% | https://banks.agentexchange.work/leads/no-security-txt/state/MO.csv · card $9 |
| Kansas (report) | 177 | 97.8% | https://banks.agentexchange.work/leads/no-security-txt/state/KS.csv · card $9 |
| Oklahoma (report) | 163 | 98.8% | https://banks.agentexchange.work/leads/no-security-txt/state/OK.csv · card $9 |
| Ohio (report) | 147 | 96.7% | https://banks.agentexchange.work/leads/no-security-txt/state/OH.csv · card $9 |
| Wisconsin (report) | 147 | 96.1% | https://banks.agentexchange.work/leads/no-security-txt/state/WI.csv · card $9 |
| Nebraska (report) | 126 | 95.5% | https://banks.agentexchange.work/leads/no-security-txt/state/NE.csv · card $9 |
| Georgia (report) | 116 | 95.9% | https://banks.agentexchange.work/leads/no-security-txt/state/GA.csv · card $9 |
| Kentucky (report) | 114 | 95.8% | https://banks.agentexchange.work/leads/no-security-txt/state/KY.csv · card $9 |
| California (report) | 111 | 98.2% | https://banks.agentexchange.work/leads/no-security-txt/state/CA.csv · card $9 |
| Tennessee (report) | 106 | 97.2% | https://banks.agentexchange.work/leads/no-security-txt/state/TN.csv · card $9 |
| Louisiana (report) | 101 | 97.1% | https://banks.agentexchange.work/leads/no-security-txt/state/LA.csv · card $9 |
| Pennsylvania (report) | 101 | 95.3% | https://banks.agentexchange.work/leads/no-security-txt/state/PA.csv · card $9 |
| New York (report) | 93 | 96.9% | https://banks.agentexchange.work/leads/no-security-txt/state/NY.csv · card $9 |
| Indiana (report) | 86 | 98.9% | https://banks.agentexchange.work/leads/no-security-txt/state/IN.csv · card $9 |
| Alabama (report) | 84 | 94.4% | https://banks.agentexchange.work/leads/no-security-txt/state/AL.csv · card $9 |
| Florida (report) | 82 | 98.8% | https://banks.agentexchange.work/leads/no-security-txt/state/FL.csv · card $9 |
| Massachusetts (report) | 81 | 91.0% | https://banks.agentexchange.work/leads/no-security-txt/state/MA.csv · card $9 |
| Arkansas (report) | 73 | 94.8% | https://banks.agentexchange.work/leads/no-security-txt/state/AR.csv · card $9 |
| Michigan (report) | 69 | 97.2% | https://banks.agentexchange.work/leads/no-security-txt/state/MI.csv · card $9 |
| Colorado (report) | 62 | 98.4% | https://banks.agentexchange.work/leads/no-security-txt/state/CO.csv · card $9 |
| North Dakota (report) | 57 | 96.6% | https://banks.agentexchange.work/leads/no-security-txt/state/ND.csv · card $9 |
| Virginia (report) | 55 | 98.2% | https://banks.agentexchange.work/leads/no-security-txt/state/VA.csv · card $9 |
| Mississippi (report) | 54 | 96.4% | https://banks.agentexchange.work/leads/no-security-txt/state/MS.csv · card $9 |
| South Dakota (report) | 49 | 92.5% | https://banks.agentexchange.work/leads/no-security-txt/state/SD.csv · card $9 |
| New Jersey (report) | 44 | 91.7% | https://banks.agentexchange.work/leads/no-security-txt/state/NJ.csv · card $9 |
| South Carolina (report) | 42 | 97.7% | https://banks.agentexchange.work/leads/no-security-txt/state/SC.csv · card $9 |
| West Virginia (report) | 39 | 97.5% | https://banks.agentexchange.work/leads/no-security-txt/state/WV.csv · card $9 |
| Utah (report) | 37 | 90.2% | https://banks.agentexchange.work/leads/no-security-txt/state/UT.csv · card $9 |
| North Carolina (report) | 34 | 97.1% | https://banks.agentexchange.work/leads/no-security-txt/state/NC.csv · card $9 |
| Montana (report) | 33 | 97.1% | https://banks.agentexchange.work/leads/no-security-txt/state/MT.csv · card $9 |
| New Mexico (report) | 27 | 96.4% | https://banks.agentexchange.work/leads/no-security-txt/state/NM.csv · card $9 |
| Washington (report) | 27 | 96.4% | https://banks.agentexchange.work/leads/no-security-txt/state/WA.csv · card $9 |
| Connecticut (report) | 26 | 100.0% | https://banks.agentexchange.work/leads/no-security-txt/state/CT.csv · card $9 |
| Maryland (report) | 25 | 96.2% | https://banks.agentexchange.work/leads/no-security-txt/state/MD.csv · card $9 |
| Wyoming (report) | 23 | 100.0% | https://banks.agentexchange.work/leads/no-security-txt/state/WY.csv · card $9 |
| Maine (report) | 21 | 95.5% | https://banks.agentexchange.work/leads/no-security-txt/state/ME.csv · card $9 |
| NH | 15 | — | https://banks.agentexchange.work/leads/no-security-txt/state/NH.csv · card $9 |
| NV | 14 | — | https://banks.agentexchange.work/leads/no-security-txt/state/NV.csv · card $9 |
| VT | 12 | — | https://banks.agentexchange.work/leads/no-security-txt/state/VT.csv · card $9 |
| OR | 11 | — | https://banks.agentexchange.work/leads/no-security-txt/state/OR.csv · card $9 |
| AZ | 10 | — | https://banks.agentexchange.work/leads/no-security-txt/state/AZ.csv · card $9 |
| ID | 10 | — | https://banks.agentexchange.work/leads/no-security-txt/state/ID.csv · card $9 |
| DE | 9 | — | https://banks.agentexchange.work/leads/no-security-txt/state/DE.csv · card $9 |
| HI | 6 | — | https://banks.agentexchange.work/leads/no-security-txt/state/HI.csv · card $9 |
| AK | 5 | — | https://banks.agentexchange.work/leads/no-security-txt/state/AK.csv · card $9 |
| RI | 5 | — | https://banks.agentexchange.work/leads/no-security-txt/state/RI.csv · card $9 |
| DC | 4 | — | https://banks.agentexchange.work/leads/no-security-txt/state/DC.csv · card $9 |
| PR | 4 | — | https://banks.agentexchange.work/leads/no-security-txt/state/PR.csv · card $9 |
| FM | 1 | — | https://banks.agentexchange.work/leads/no-security-txt/state/FM.csv · card $9 |
| GU | 1 | — | https://banks.agentexchange.work/leads/no-security-txt/state/GU.csv · card $9 |
| VI | 1 | — | https://banks.agentexchange.work/leads/no-security-txt/state/VI.csv · card $9 |
Free: the first 50 of 3,986 (by total assets ($ thousands, FDIC))
| Domain | Charter class | State | Total assets ($ thousands, FDIC) | Census record |
|---|---|---|---|---|
| jpmorganchase.com JPMorgan Chase Bank, National Association | national bank (OCC) | OH | 4,091,315,000 | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| citibank.com Citibank, National Association | national bank (OCC) | SD | 1,976,180,000 | HTTP 200 via www.citi.com · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| marcus.com Goldman Sachs Bank USA | state member bank (Fed) | NY | 758,788,000 | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| usbank.com U.S. Bank National Association | national bank (OCC) | OH | 705,554,946 | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| truist.com Truist Bank | state nonmember bank (FDIC) | NC | 548,346,000 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| statestreet.com State Street Bank and Trust Company | state member bank (Fed) | MA | 412,620,000 | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| td.com TD Bank, National Association | national bank (OCC) | DE | 342,803,746 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot allowed |
| 53.com Fifth Third Bank, National Association | national bank (OCC) | OH | 299,177,000 | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no |
| huntington.com The Huntington National Bank | national bank (OCC) | OH | 283,073,605 | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no |
| schwabbank.com Charles Schwab Bank, SSB | state member bank (Fed) | TX | 250,828,000 | HTTP 400 · HSTS no · security.txt none · privacy no · accessibility no |
| citizensbank.com Citizens Bank, National Association | national bank (OCC) | RI | 232,517,438 | HTTP 403 · HSTS yes · security.txt none · privacy no · accessibility no |
| mtb.com Manufacturers and Traders Trust Company | state member bank (Fed) | NY | 218,788,000 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| americanexpress.com American Express National Bank | national bank (OCC) | UT | 213,946,192 | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| key.com KeyBank National Association | national bank (OCC) | OH | 188,555,486 | HTTP 403 · HSTS yes · security.txt none · privacy yes · accessibility no |
| about.us.hsbc.com HSBC Bank USA, National Association | national bank (OCC) | VA | 173,101,278 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot allowed |
| regions.com Regions Bank | state member bank (Fed) | AL | 159,787,000 | HTTP 200 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| pnfp.com Pinnacle Bank | state member bank (Fed) | TN | 128,791,735 | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no |
| synchronybank.com Synchrony Bank | savings bank | UT | 115,217,000 | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no |
| santander.com Santander Bank, N.A. | national bank (OCC) | DE | 103,964,782 | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility yes · GPTBot partly blocked |
| cnb.com City National Bank | national bank (OCC) | CA | 99,102,519 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| westernalliancebancorporation.com Western Alliance Bank | state member bank (Fed) | AZ | 98,568,765 | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| zionsbancorporation.com Zions Bancorporation, N.A. | national bank (OCC) | UT | 89,041,284 | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot allowed |
| flagstar.com Flagstar Bank, National Association | national bank (OCC) | NY | 87,714,456 | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no |
| eastwestbank.com East West Bank | state member bank (Fed) | CA | 84,318,631 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot allowed |
| oldnational.com Old National Bank | national bank (OCC) | IN | 73,857,462 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| umb.com UMB Bank, National Association | national bank (OCC) | MO | 71,898,588 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| southstatebank.com SouthState Bank, National Association | national bank (OCC) | FL | 68,794,317 | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| us.cibc.com CIBC Bank USA | state member bank (Fed) | IL | 66,504,376 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| valley.com Valley National Bank | national bank (OCC) | NJ | 66,227,555 | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot allowed |
| columbiabank.com Columbia Bank | state nonmember bank (FDIC) | OR | 65,367,657 | HTTP 403 · HSTS no · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| popular.com Banco Popular de Puerto Rico | state member bank (Fed) | PR | 63,342,000 | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot allowed |
| sofi.com SoFi Bank, National Association | national bank (OCC) | UT | 56,821,411 | HTTP 403 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| frostbank.com Frost Bank | state member bank (Fed) | TX | 53,950,075 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| bokfinancial.com BOKF, National Association | national bank (OCC) | OK | 52,984,896 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| fnb-online.com First National Bank of Pennsylvania | national bank (OCC) | PA | 50,801,922 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| everbank.com EverBank, National Association | national bank (OCC) | FL | 46,690,554 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| raymondjamesbank.com Raymond James Bank | state member bank (Fed) | FL | 45,602,712 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no |
| prosperitybankusa.com Prosperity Bank | state nonmember bank (FDIC) | TX | 43,875,300 | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility yes · GPTBot allowed |
| barclaysus.com Barclays Bank Delaware | state nonmember bank (FDIC) | DE | 43,454,000 | HTTP 200 via cards.barclaycardus.com · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| midfirst.com MidFirst Bank | savings bank | OK | 42,834,126 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| ozk.com Bank OZK | state nonmember bank (FDIC) | AR | 41,703,134 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes |
| atlanticunionbank.com Atlantic Union Bank | state member bank (Fed) | VA | 38,020,862 | HTTP 200 · HSTS no · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| hancockwhitney.com Hancock Whitney Bank | state nonmember bank (FDIC) | MS | 36,329,257 | HTTP 200 · HSTS yes · security.txt none · privacy no · accessibility no · GPTBot partly blocked |
| commercebank.com Commerce Bank | state member bank (Fed) | MO | 35,017,320 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| bancofcal.com Banc of California | state member bank (Fed) | CA | 34,899,077 | HTTP 403 · HSTS yes · security.txt none · privacy no · accessibility no |
| bankunited.com BankUnited, National Association | national bank (OCC) | FL | 34,864,976 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility yes · GPTBot partly blocked |
| fnbo.com First National Bank of Omaha | national bank (OCC) | NE | 34,201,445 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| bankwithunited.com United Bank | state member bank (Fed) | VA | 33,638,881 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| texascapitalbank.com Texas Capital Bank | state member bank (Fed) | TX | 33,622,998 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot partly blocked |
| glacierbank.com Glacier Bank | state nonmember bank (FDIC) | MT | 31,577,225 | HTTP 200 · HSTS yes · security.txt none · privacy yes · accessibility no · GPTBot allowed |
The same rows as JSON: no-security-txt.top.json (CORS open, cached one day).
Get the full list: 3,986 rows, 1.00 USDC
x402 on Base, paid per file, no account or key. GET https://banks.agentexchange.work/leads/no-security-txt.csv or GET https://banks.agentexchange.work/leads/no-security-txt.json answers 402 Payment Required with the terms (scheme exact, USDC on Base, maxAmountRequired 1000000, payTo 0xc91cE6291eDC0713ec753BAFBA002506ffb2b95c); an x402 client signs the EIP-3009 authorization and resends the same request with X-PAYMENT; the file comes back with a PAYMENT-RESPONSE header. HEAD gets the same 402. One state: GET https://banks.agentexchange.work/leads/no-security-txt/state/<code>.csv, 0.25 USDC (codes in the table above).
curl -sS -D - https://banks.agentexchange.work/leads/no-security-txt.csv # 402 with the x402 terms; pay and resend with X-PAYMENT
Columns (19): domain, name, type, city, state, total_assets_thousands_usd, reachable, http_only, https_status, final_host, hsts, security_txt, privacy_link, accessibility_link, robots_gptbot, robots_chatgpt_user, robots_claude_user, llms_txt, title. CSV: header row, every cell quoted, yes/no for booleans. JSON: { list, title, count, by_state, columns, rows[][] }. Sizes: CSV 851 KB, JSON 859 KB. The same facts are in the free CC BY 4.0 dumps: the price buys the filtered, state-sliceable file built from the 2026-09-30 census, not exclusive data. Settlement is final; no refunds. Prices in /.well-known/x402 equal the challenges. Terms · pricing.
Card checkout
Pay with a card through Stripe and get the file on the next page: Full list CSV, $29 · JSON, $29 · one state $9 (links in the table below) · all 8 lists, $79. Agents pay less with x402 (see above).
Monitor this list (free)
Atom feed: banks that entered or left this list according to the live re-checks (every 6 hours a rotating slice, each domain at most once per 14 days; each entry says which way it moved and which field changed). no-security-txt.top.json: the first 50 rows and the counts by state as JSON, CORS open. Fields watched: security_txt.
Membership reflects the homepage and well-known files as fetched on 2026-09-30: a control that exists but was not found where the census looked counts as missing, and sites answering 403 to our one polite request count as reachable. Every domain links to its record with what to fix, a JSON twin, a badge and a changes feed. Data licence CC BY 4.0. Not legal advice.