Schwab Blocks Dozens of AI Agents a Week. Citi, JPMorgan and Bank of America Are Building the Same Wall

Every week, the chief executive of Charles Schwab receives a report listing which AI agents tried to get into customer accounts. The count, Rick Wurster told Bloomberg Television on October 16, runs "in the tens and twenties" of blocked attempts, mostly from the big consumer agents now pitching themselves as personal assistants. His reasoning is one sentence long: "We can't control it, the client can't control it, something could go wrong and who's liable?"

Schwab is not an outlier. On its third-quarter earnings call a day earlier, the brokerage said it was blocking unauthorized agents that try to log in on behalf of clients, including ones that drive a browser with saved credentials. Citigroup told the Financial Times it does not allow third-party AI agents or assistants to log into customer accounts or transact directly on its digital platforms, though customers can still grant read-only access through approved open-banking providers. Bank of America CEO Brian Moynihan put the principle plainly to CNBC: "We strongly believe there should be a human in the loop to authorise money moving out of your account." And JPMorgan's Jamie Dimon, on the bank's October 13 earnings call, said "we're not going to allow just any outside agent to come inside the company," warning that "you don't want rogue agents, and there could be thousands of them."

The proximate trigger was Meta's Muse, the personal agent launched in September that can link to bank accounts through Plaid and explain balances, transactions and investments. Amazon had already blocked Muse from its marketplace on September 20, joined by Delta and Yelp; in October the same logic arrived at the place where the money actually lives. The fear is not only that an agent might act on a bad instruction. It is that customers are handing their actual login credentials to software the bank cannot see, authenticate or audit.

None of the four firms is shutting AI out entirely. Schwab is building a controlled door: outside models can connect to its own MCP servers to read balances, positions and statements, and its in-house assistant Charley, announced September 30, can handle a short list of actions such as adding beneficiaries or managing alerts. A pilot lets some traders connect the LLM of their choice, starting with Claude, and even place trades through the bank-controlled layer. The line stops at payments: "We do not allow them to move money because we think there is too much risk there to the client and to the firm," Wurster said. JPMorgan's version is the same shape - read-only through authorized connectors, no transfers, no bill pay.

The hard edge underneath the liability talk is money. Apollo chief economist Torsten Slok estimates that agents could automatically sweep idle household cash from checking accounts paying an average of 0.1 percent into products yielding 3.3 to 5 percent. JPMorgan, Bank of America and Wells Fargo together hold about $1.6 trillion of non-interest-bearing deposits, roughly 16 percent of their liabilities; repricing that money at just 3 percent would cost around $47 billion a year, close to half their combined annual profit. Schwab has its own version of the exposure: about $3.5 billion of net interest revenue last quarter rests on roughly $493 billion of sweep cash - exactly the pool a helpful agent might optimize away.

Regulators have not filled the vacuum. There is no federal statute governing who is liable when an autonomous agent moves money, and the legislative attempts - the Warner AI AGENT Act, the Hawley-Murphy AI Agent Accountability Act, the Great American AI Act - are all stalled in committee. Wall Street executives have privately approached Federal Reserve officials about agent-driven transactions, according to the Financial Times, and regulators privately welcome the banks' blocks while acknowledging that authorization and liability rules will eventually need legislation. Until then, the industry is writing its own rules by exclusion - what lawyers call private ordering.

That is why the read-only MCP server is quietly becoming the de facto standard for agent-to-bank access in the United States: observe everything, touch nothing, keep money movement inside the bank's own tools. Meta, for its part, is working with the startup Sierra on a protocol that would let personal agents identify themselves and obtain a customer's permission, and it built a Personal Agent Protocol for shopping with Walmart. The banks' message to every agent builder is now uniform - you may look, you may even trade in a supervised pilot, but until there is an identity and liability framework nobody will let an agent touch the wire.