Two of the largest US financial firms have drawn a hard line on AI agents. Charles Schwab and JPMorgan Chase say outside AI agents will not be allowed to move customer money, even when the customer has handed the agent their login. The decisions set a working rule for agentic AI in banking before any regulator has written one.
Schwab chief executive Rick Wurster told Bloomberg Television on Friday, 16 October, that the broker blocks unauthorised third-party agents that try to move client funds, according to reporting by The Next Web. He named Meta's Muse, a personal agent that can book, buy and negotiate for users, among the agents being stopped. Three days earlier, JPMorgan chief executive Jamie Dimon used the bank's earnings call to say outside agents would not be allowed to act inside its systems, and warned about "rogue agents", Cybernews reported.
Why the banks are blocking AI agents
Wurster's objection is about control and liability. When a client gives an agent their username and password, the agent acts with the full authority of that client. "We can't control it, the client can't control it, something could go wrong and who's liable?" he said.
He also said he receives a weekly report on the blocks, and that large agents are being stopped "in the tens and twenties each week". He reads those numbers as a sign that most clients are not yet ready to hand their accounts to software.
JPMorgan's position is narrower than a full ban. The bank already lets some third-party tools view account data. What it will not allow is for those tools to send money or pay bills.
Read access yes, write access no
Both banks are separating two kinds of access:
- Read access: an agent can see balances, holdings and transaction history.
- Write access: an agent can initiate transfers, trades or payments.
Schwab plans to offer read access through model context protocol (MCP) servers. Under that setup a client's chosen AI model could check balances and run research, but could not move money. For anything that touches funds, Wurster wants clients to use Charley, Schwab's own assistant, which the firm announced on 30 September.
That split mirrors a familiar pattern in financial security. Viewing data carries privacy risk. Moving money carries fraud and loss risk, and the second is where disputes over who pays tend to end up.
The liability gap
The banks are acting because the law has not settled the question Wurster raised. The Next Web noted that liability for AI agents is still being debated in Congress and that there is no clear US answer yet. Existing consumer protection rules were written for a person, or a person's device, making a payment. They do not describe an autonomous system that a customer authorised in general terms and that then made a specific decision the customer did not foresee.
Several questions follow from that gap:
- If an agent misreads an instruction and sends money to the wrong account, is that an unauthorised transaction or an authorised one made in error?
- If an agent is tricked by a malicious website or a prompt injection, does the loss sit with the customer, the bank or the agent provider?
- Does sharing credentials with an agent breach a bank's terms of service, and if so, does that remove the customer's protections?
Until lawmakers or courts answer those questions, banks are using their own terms of service and technical controls to decide. That is a form of private rule-making, and it shapes how agents can be built and sold.
What it means for agent builders
Agentic commerce is growing quickly in other parts of the payments system. Dan Hill, head of consumer product at Stripe, told Upstarts Media that about 200 agents now use Stripe's Link checkout, up from about 70 covered in Stripe's September data. "The volume we're seeing now is becoming very material," he said.
Card checkouts and bank accounts work differently, though. A card payment through a processor such as Stripe comes with established chargeback rules. A transfer straight out of a brokerage or bank account does not offer the same safety net. That difference helps explain why the strongest resistance is coming from account holders rather than payment processors.
For companies building agents, the practical result is that bank-account actions will likely run through approved channels, such as bank-hosted MCP servers, official APIs or the banks' own assistants, rather than through screen scraping with shared passwords.
A question for regulators
The Next Web also reported that US and European regulators are asking banks about their use of AI agents and the related cyber risks. Those conversations could lead to formal guidance on authentication for agents, on how consent is recorded and on how losses are shared.
For now, the rule in practice is simple. Customers can let an AI agent look at their money at Schwab and JPMorgan, but not move it. We have covered related accountability questions in our report on the FTC investigation of OpenAI and Anthropic, and we will follow whether other banks adopt the same split between read and write access.
