Schwab and JPMorgan block outside AI agents from client accounts

What Schwab said

Wurster's objection was about control and liability. "We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf," he said, as quoted by The Verge and Bloomberg Law. "We can't control it, the client can't control it, something could go wrong and who's liable?"

According to The Next Web, Wurster said Schwab stops attempts by the big agents in the tens and twenties each week. Instead of logins by outside agents, Schwab plans controlled MCP servers. MCP, the Model Context Protocol, is a standard way for an AI tool to connect to another system under rules that system sets. Wurster said outside tools would be able to check balances and do research this way, but not move money.

Schwab also wants clients to use its own assistant. It announced Charley on 30 September, with a phased rollout to eligible US retail clients from October.

JPMorgan's position

On JPMorgan's third-quarter earnings call on 13 October, Jamie Dimon said the bank would not let "just any … outside agent" operate inside it, CNBC reported. "You don't want rogue agents, and it could be thousands of them," he said.

A JPMorgan spokeswoman told CNBC the bank does not permit third parties to access accounts by obtaining customers' banking credentials and logging in for them. It supports customer-authorised data sharing through open banking providers. In practice, CNBC explains, agents can see some data such as balances in read-only form through a connector such as Plaid, but cannot send money or pay bills. The spokeswoman gave no timeline for allowing more. Dimon added that people using such agents "should understand there's a liability transfer".

The real issue is password sharing

Neither firm is rejecting AI. JPMorgan says it uses agents internally, and Schwab is launching its own assistant. What they are blocking is the shortcut where an agent logs in as the customer. Wurster's point was that Schwab cannot control that, the client cannot control it either, and if something goes wrong it is unclear who is liable.

The alternative both describe is a permissioned connection: the bank decides what an outside tool can see or do, and money movement stays off the list for now. Evoogen's reading is that other banks and payment platforms are likely to take similar positions while there is no agreed way for an agent to prove whom it acts for. That is a forecast, not a reported fact.

What this means for a small business

These are US consumer and wealth accounts, but the same caution applies to business bank accounts elsewhere. If you are considering an AI agent for finance admin, such as chasing invoices, matching payments or preparing supplier runs, do not give it your online banking password. Use the read-only bank connections your accounting software or bank already offers, and keep a person approving every payment.

Before you start, check three things: what your bank's terms say about sharing login details, who would carry the loss if an agent made a mistake, and whether the task needs money movement at all. Many useful jobs, like flagging overdue invoices, only need read access.