In the week of October 12, 2026, two of the largest US financial institutions said publicly that they stop outside AI agents from moving customer money. Meta's Muse agent was named as one of the agents Charles Schwab blocks. The comments matter because they show where large banks are placing a boundary for consumer AI agents: agents may look at an account, but may not act in it. This article lays out what each bank reportedly said, how the access split works technically, and what remains unresolved.
MetaWhat each bank said
Charles Schwab. CEO Rick Wurster told Bloomberg Television that Schwab blocks outside AI agents that try to move clients' money, including Meta's Muse, according to The Next Web's account of the interview. He described the underlying behavior as clients giving their passwords to an agent that then acts for them, and said the large agents are stopped "in the tens and twenties each week." His stated reasoning: "We can't control it, the client can't control it, something could go wrong and who's liable?"
JPMorgan Chase. Per reporting that cites the bank's third-quarter earnings call, CEO Jamie Dimon said JPMorgan would not let outside AI agents act inside its systems and warned of "rogue agents." A company spokesperson later confirmed that the bank currently blocks external AI agents from operating on behalf of retail customers, according to The Paypers. Some data, such as balances, remains visible to certain third-party tools, but agents cannot send money or pay bills. The bank also said it has no timeline for safeguards that would let agents interact directly with customer accounts.
Citi and Bank of America. Some outlets reported on October 16 that both banks also restricted agent access, but the reports we reviewed gave no detail on the controls or the affected functions, so this article does not treat their positions as established.
The line the banks are drawing
Across the two stated positions, the split is consistent. Information access is tolerated, and state-changing actions are not.
Where the line sits: read access yes, money movement no
How the reported bank positions split an outside AI agent's possible actions.
Based on reporting by Cybernews and The Next Web, October 2026. Bank policies may change.
This is a familiar pattern in security design, often described as separating reads from writes. A read leaks information at worst; a write moves value and is hard to reverse. A wire or bill payment that lands in the wrong place is usually difficult to recall, which is why a lender may treat the write side as a different risk class.
How read-only access works through MCP
Wurster said Schwab plans to run Model Context Protocol (MCP) servers. MCP is an open standard that lets an AI model connect to external data and tools through a defined interface. In this setup the bank hosts the server, so the bank decides which tools exist. Per the Next Web report, outside tools connected this way could check balances and do research but could not move money. The practical difference from what Schwab says it is blocking:
In the first pattern, the agent holds the customer's credentials and the bank sees what looks like the customer. In the second, the agent connects through an interface the bank built and can audit. For background on the standards layer, see our explainer on AI agent interoperability standards.
Why the liability question is the real constraint
Wurster's quote is a liability argument rather than a capability one. If an agent holding a customer's password moves money wrongly, three parties could plausibly be asked to bear the loss: the customer who delegated, the agent's developer, or the bank that processed the instruction. The Next Web reports that agent liability remains undecided in the US and is being debated in Congress. Until a rule or contract assigns that loss, a bank has little reason to carry an unpriced risk. This is analysis, not a legal conclusion, and the banks themselves have not published detailed policy terms.
We can't control it, the client can't control it, something could go wrong and who's liable?
Rick Wurster, Schwab CEO, as reported by The Next Web
Three things this does and does not settle
- It does not ban agents from banking. The reported blocks are aimed at outside agents moving money for retail customers. A bank-built assistant such as Schwab's Charley sits on the other side of the line.
- It does not mean the technology failed. Wurster read the weekly block counts as evidence that clients are not yet ready to hand accounts to AI, which is a statement about trust and accountability rather than model capability.
- It may not be permanent. JPMorgan said it has no timeline for safeguards, which leaves the question open rather than closed.
Two sectors are watching from different directions. Payments networks are building rails for agent-initiated transactions, as in our coverage of x402 agent payments on Base, while regulators in the US and Europe are reportedly questioning banks about their agent use and the related cyber risk.
What to watch
- Whether more banks publish written policies on agent access, and whether they distinguish read from write consistently.
- Whether a bank-run MCP offering becomes the default integration path, which would make the bank the permission authority.
- Any liability rule from Congress or a regulator that prices who covers an agent's mistake.
- Whether agent developers respond with narrower scopes, confirmations or per-transaction limits that banks are willing to accept.
For people who use AI agents with their own accounts and data, the same read-versus-write logic applies on a smaller scale. Tools that keep a human confirmation on every action, and that work across model providers such as Metir AI, follow the same principle the banks are reaching for.
Sources:
- Schwab and JPMorgan are blocking AI agents from moving customer money | The Next Web
- JPMorgan Chase blocks external AI agents from customer accounts | The Paypers
- JPMorgan blocks outside AI agents from customer accounts | Cybernews
- US Banks Harden Defenses Against Rogue AI Agents | Let's Data Science
- Citi restricts AI agents from accessing customer accounts | Crypto Briefing
Image credits
Header and in-body image: 270 Park Avenue (former building), by the "official-ly cool" team for Wikipedia Takes Manhattan, 4 April 2008, via Wikimedia Commons, licensed CC BY-SA 3.0.