--- title: "Banco Santander: the 360 check | Agent Ready Checklist" description: "Banco Santander on Ora's agent-readiness scan, read 2026-11-09: 37 of 100, grade D. 2 of 17 checklist rows met, 10 not met." canonical: https://agentreadychecklist.com/blog/santander-agent-readiness site: "Agent Ready Checklist" last_updated: 2026-11-09 date: 2026-11-09 section: "360 checks" --- # Banco Santander: the 360 check | Agent Ready Checklist > Banco Santander on Ora's agent-readiness scan, read 2026-11-09: 37 of 100, grade D. 2 of 17 checklist rows met, 10 not met. Source: https://agentreadychecklist.com/blog/santander-agent-readiness Site: Agent Ready Checklist Last reviewed: 2026-11-09 Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search) Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free). # Banco Santander against the checklist: the 360 agent-readiness check 360 check, 9 November 2026. Banco Santander is Spain's largest bank, with retail arms across Europe and the Americas. Banco Santander scores 37 of 100 on Ora's agent-readiness scan, a D, read 9 November 2026. At the door, site accessible to 6 AI agent user-agents. 2 of the 17 checklist rows with an Ora check are met. 1 of 3 MUST rows is met. A read that credits a third-party tracker, on a domain with the usual gaps. On 9 November 2026 the public site at santander.com scored **37 of 100** on [Ora's](https://ora.ai/?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check) agent-readiness scan, a D. Ora probes a site the way an agent would: it requests pages with the agents' own user agents, reads robots.txt, looks for the files agents read, and tries the API, MCP and payment surfaces. Below, each of the 31 checklist rows is read against the Ora checks the [crosswalk](https://agentreadychecklist.com/checklist/ora-checks/) names for it, so the result says which requirements this company meets, not only how many points it scored. Ora's one-line summary: Comprehensive banking content available, but lacks OAuth, OpenAPI specs, and agent integration standards. ## The score | Layer | Points | Share | What the layer asks | | --- | --- | --- | --- | | Discovery | 17 of 37 | 46% | Can agents find and recommend it | | Identity | 18 of 40 | 45% | Can agents tell what it is | | Access | 25 of 48 | 52% | Can agents read it | | Agent Integration | 5 of 36 | 14% | Can agents integrate with it | | User Experience | 5 of 25 | 20% | How the site reads inside an agent | | Total | 37 of 100 | 37% | Grade D | ## Row by row A row is met when every Ora check the crosswalk names for it passes, not met when every one fails, and partly when the checks disagree or one is partial. A row with no Ora check in the catalogue, or whose checks did not apply to this site, is marked as such; the [Verify Kit](https://agentreadychecklist.com/kit/) tests those by hand. | Row | Level | Result | Ora checks, and what Ora saw | | --- | --- | --- | --- | | AR-FIND-01; Do not block agents | MUST | Met | robots.txt AI crawler policy, robots.txt agent-user policy, Agent crawler reachability, Not blocked by bot detection (pass).; Site accessible to 6 AI agent user-agents | | AR-FIND-02; Answers on one first-party page | SHOULD | No Ora check | No check in Ora's catalogue names this row. | | AR-FIND-03; Sitemap listed in robots.txt | SHOULD | Not met | Sitemap exists (fail).; No sitemap.xml found | | AR-FIND-04; AI Catalog at .well-known | MAY | No Ora check | AI Catalog discovery, ARD discovery. | | AR-READ-01; Answer in the initial HTML | MUST | Partly | Content without JavaScript (partial).; Only 3346 chars of text content, no H1 tag - agents see limited content | | AR-READ-02; Real HTTP status codes | MUST | No Ora check | Redirect hygiene. | | AR-READ-03; Home page with real links | SHOULD | Met | Public API/docs linked from homepage (pass).; Documentation site found at https://www.openbankingtracker.com | | AR-READ-04; Docs that answer agent tasks | SHOULD | No Ora check | No check in Ora's catalogue names this row. | | AR-READ-05; Fenced, language-tagged code | SHOULD | No Ora check | Code fence validity. | | AR-READ-06; Link the discovery files | SHOULD | No Ora check | No check in Ora's catalogue names this row. | | AR-READ-07; Ship llms.txt | SHOULD | Partly | llms.txt exists (pass), llms.txt formatting (partial), llms.txt links resolve.; Found llms.txt at https://www.openbankingtracker.com/llms.txt | | AR-READ-08; JSON-LD on key pages | SHOULD | Not met | JSON-LD structured data (fail).; No JSON-LD structured data found on homepage | | AR-READ-09; Advertise a markdown mirror | MAY | No Ora check | Markdown alternate link. | | AR-READ-11; Pricing as first-party HTML | SHOULD | Not met | Pricing info accessible (fail).; No pricing page or pricing data found | | AR-ACT-01; Auth an agent can finish | SHOULD | Not met | OAuth 2.0 support (fail), Scoped permissions (fail).; No OAuth 2.0 or OpenID Connect support detected | | AR-ACT-02; OpenAPI contract | SHOULD | Not met | OpenAPI spec published (fail).; No OpenAPI/Swagger specification found | | AR-ACT-03; MCP over Streamable HTTP | SHOULD | Partly | MCP server / manifest (partial), Listed in MCP registries (fail), MCP PKCE S256 support (not applicable), MCP OAuth metadata (not applicable).; MCP mentioned at https://www.openbankingtracker.com/provider/santander but no standard manifest endpoint found | | AR-ACT-04; MCP server card | MAY | Not met | MCP server-card.json (fail).; No MCP server card found at /.well-known/mcp/server-card.json | | AR-ACT-05; MCP Apps view | MAY | Not met | MCP Apps support (fail).; No MCP Apps support detected (no ui:// resources or tool UI metadata) | | AR-ACT-06; SDKs and a CLI | SHOULD | Partly | CLI tool available (fail), Multi-language SDK packages (partial), NPM/PyPI SDK package (pass).; No CLI tool found | | AR-ACT-07; WebMCP tools | SHOULD | Not met | WebMCP support (fail).; No WebMCP support detected | | AR-ACT-08; Agent payments | MAY | No Ora check | x402 payment protocol (not applicable), MPP payment protocol (not applicable), UCP - Universal Commerce Protocol (not applicable), ACP - Agentic Commerce Protocol (not applicable), ACP delegate payment (not applicable). | | AR-ACT-09; NLWeb /ask endpoint | MAY | No Ora check | NLWeb /ask endpoint (not applicable). | | AR-ACT-10; An MCP server or a CLI | MUST | Partly | MCP server / manifest (partial), CLI tool available (fail).; MCP mentioned at https://www.openbankingtracker.com/provider/santander but no standard manifest endpoint found | | CF-CONTENT-SIGNALS; Content-Signal line | cloudflare | No Ora check | No check in Ora's catalogue names this row. | | CF-MARKDOWN-NEGOTIATION; Markdown by Accept | cloudflare | Not met | Markdown content negotiation (acceptmarkdown.com), Markdown agent docs (fail).; No markdown content negotiation support | | CF-PAY-PER-CRAWL; Pay per crawl, HTTP 402 | cloudflare | No Ora check | No check in Ora's catalogue names this row. | | CF-OAUTH-DISCOVERY; OAuth discovery files | cloudflare | Not met | OAuth Protected Resource metadata (RFC 9728) (fail).; No /.well-known/oauth-protected-resource found (RFC 9728) | | CF-AGENT-SKILLS; Agent Skills index | cloudflare | No Ora check | Agent Skills index conformance (v0.2.0). | | VERCEL-NEGOTIATION-HEADERS; Markdown headers | vercel | No Ora check | Markdown content negotiation (acceptmarkdown.com). | | VERCEL-ROBOTS-EXCLUSIONS; Robots exclusions | vercel | No Ora check | robots.txt AI crawler policy, robots.txt agent-user policy. | ## The fixes worth most points Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Banco Santander, each tied to the checklist row whose recipes cover it. OpenAPI spec published Fail, 0 of 7, about 4.7 points to gain. Ora saw: No OpenAPI/Swagger specification found. Row [AR-ACT-02](https://agentreadychecklist.com/checklist/ar-act-02/), OpenAPI contract. MCP Apps support Fail, 0 of 10, about 3.8 points to gain. Ora saw: No MCP Apps support detected (no ui:// resources or tool UI metadata). Row [AR-ACT-05](https://agentreadychecklist.com/checklist/ar-act-05/), MCP Apps view. OAuth 2.0 support Fail, 0 of 5, about 3.3 points to gain. Ora saw: No OAuth 2.0 or OpenID Connect support detected. Row [AR-ACT-01](https://agentreadychecklist.com/checklist/ar-act-01/), Auth an agent can finish. Scoped permissions Fail, 0 of 5, about 3.3 points to gain. Ora saw: No scoped permissions or security schemes found. Row [AR-ACT-01](https://agentreadychecklist.com/checklist/ar-act-01/), Auth an agent can finish. Category share of voice Fail, 0 of 6, about 3.1 points to gain. Ora saw: Use-case search "retail banking and financial services": Santander is completely absent from the search results; no mentions by name, no URL matches, and no contextual references to the company appear in any of the top 9 results. No checklist row names this check. ## Our read Santander's read needs a correction before a verdict, because three of Ora's findings point at a third party. The llms.txt, the documentation site and the developer portal it credits are all at openbankingtracker.com, a third-party directory of open banking APIs, not a Santander property; the one first-party developer surface it found is the API marketplace at apimarket.santandercib.com, for the corporate and investment bank. Read with that in mind, santander.com is an open corporate site with the usual gaps: all six agent user agents got in, the home page gives 3,346 characters and no H1, there is neither a sitemap nor JSON-LD, no OpenAPI specification, and OAuth is not published for agents. Ora scored the domain with its five-layer model, Agent Integration at 5 of 36. Spain's largest bank runs real developer programmes; an agent starting from this domain would not find them. ## Verify your own site The scan above is free and needs no account: enter a domain at [ora.ai](https://ora.ai/?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check) and read the same four layers for your own site, then take each failing row to its recipe on this site. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Payments did not apply to this company; a site that sells is read on that layer too. [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/). ```bash npx ax@0.10 audit https://example.com --min-score 70 ``` [All 360 checks](https://agentreadychecklist.com/blog/), one company a day. Corrections to [the corrections page](https://agentreadychecklist.com/corrections/). ## Sources - [ora.ai/api/score/santander.com, Ora's scan (vendor)](https://ora.ai/api/score/santander.com?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check)read 2026-11-09 - [ora.ai/api/checks, contract 1.38.0 (vendor)](https://ora.ai/api/checks?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check)read 2026-11-05 - [santander.com, the company's site](https://www.santander.com/en/home)read 2026-11-09 Edition Data 2026-11-04 Reviewed 2026-11-05 Spec AgentReady v2.0, 273d2d7 Crawl 13,071 rows, 2026-11-04 Ora 132 checks, contract 1.38.0, 2026-11-05 Verify with Ora The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account. `npx ax@0.10 audit --min-score ` [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/) Method - [How rows, commands and rates are made](https://agentreadychecklist.com/method/) - [How an Ora check is matched to a row](https://agentreadychecklist.com/checklist/ora-checks/) - [Pass rates by rank band](https://agentreadychecklist.com/data/by-rank/) Sources and read dates sit at the foot of the page. Last reviewed 2026-11-09. AgentReady v2.0, read 2026-11-04.