If your product plan has an AI agent logging into a customer's bank or brokerage account with their password, two of the largest US firms in those businesses just said it will be blocked. In the same week, Charles Schwab and JPMorgan Chase both said they stop outside agents that use customer credentials or drive the website, and both laid out what replaces it: read access through a channel the bank controls, with money movement kept inside the bank's own tools. Expect other banks to adopt the same terms, so design for them now.
JPMorgan CEO Jamie Dimon went first, on the bank's third-quarter call on Tuesday, October 13: "We're not going to allow just any outside agent to come inside the company." Two days later Schwab CEO Rick Wurster opened his own call with it. "First, we are blocking unauthorized agents who try to log in on behalf of clients," he said, according to the Q3 earnings call transcript. The next day he told Bloomberg Television that Schwab's weekly report shows the big outside agents being stopped "in the tens and twenties" each week.
What Schwab and JPMorgan Actually Blocked
Both firms block the same thing: a third-party agent that holds a customer's username and password and uses it to act inside the account. American Banker reported that Schwab bars outside agents from using client login credentials or browser automation to reach its systems. Wurster told American Banker he gets a notice each time an agent is blocked, and called those notices "few and far between," which sits awkwardly beside the weekly figure he gave Bloomberg.
JPMorgan described the trigger in the same terms. A spokesperson told Fortune that the bank acts "when we detect a third-party agent attempting to access accounts by obtaining customers' banking credentials," and added that "we support secure, customer-authorized data sharing through open banking providers." The bank told CNBC, as PYMNTS summarized it, that agents can see balances read-only through an authorized connector such as Plaid, but cannot send money or pay bills, and it gave no timeline for changing that.
Wurster gave the reason in one sentence on Bloomberg, as The Next Web quoted it: "We can't control it, the client can't control it, something could go wrong and who's liable?" Dimon called it "the liability transfer," per PYMNTS: people who use outside agents should understand the risk and the liability they take on. "You don't want rogue agents, and there could be thousands of them," he said.
Screen scraping is the practice of logging in as the user and reading or clicking through the web pages a human would see. It is the technique banks and data aggregators have argued over for years. An agent that drives a browser uses the same technique and can also act, so it is the first thing the banks block.
What Schwab Will Let an Agent Do Instead
Schwab will give outside models a controlled door. That door is a Model Context Protocol (MCP) server, which is a bank-run interface that publishes a fixed list of tools an AI model may call, under the bank's own authentication. "We are allowing LLMs to connect, but we are controlling the experience," Wurster said on the call. "We control the authentication experience." He said Schwab will "allow clients to use their LLMs to connect to our MCP servers" and has "started a pilot for traders to safely and securely connect to our MCP layer via the LLM of their choice," starting with Claude and expanding "to additional clients and LLMs in the coming months."
The permission line is specific. Read access and research are in, and so is placing trades for the pilot group. American Banker reported that some traders can already use models such as ChatGPT to connect and transact, and that Wurster expects more clients and models to be able to trade. Moving money is out. "We do not allow them to move money because we think there is too much risk there to the client and to the firm," Wurster said.
The one agent that gets deeper access is Schwab's own. Charley, announced September 30 and rolling out to eligible US retail clients in phases from October, can read balances, positions, statements and tax documents, and can take a short list of actions: adding beneficiaries, updating contact details, enrolling securities in dividend reinvestment, managing alerts and watchlists. Wurster said he expects it to become "the primary way people connect to AI at Schwab." The release says Charley runs on third-party AI providers and carries Schwab's own disclaimer that it "may provide inaccurate or incomplete results."
Why the Banks' Position Is Self-Interested and Still Right
The strongest objection is commercial, and it deserves a hearing. "Charley works for Schwab," Tim Welsh of Nexus Strategies told American Banker. Analysts have warned that agents could sweep idle cash into higher-yielding products automatically, and Schwab earned about $3.48 billion of net interest revenue in the quarter, much of it on roughly $493 billion of sweep cash. An agent that moves money is the agent that moves that cash. Wurster argued on the call that clients who use AI hold more cash, because they trade more.
JPMorgan carries the same history. It began charging fintechs for customer data access in 2025 and signed a priced agreement with Plaid that September; the Financial Technology Association called the fees "anti-competitive," per PYMNTS. A bank that bills for read access has an obvious reason to keep the write path to itself.
The credential model is unsafe whatever the banks' motives: the bank cannot tell a client's agent from an attacker holding the same password, cannot limit what the session does, and cannot answer Wurster's liability question. A bank-issued token scoped to named actions fixes all three, whoever profits from it. The regulatory backstop is also weak. The CFPB's 2024 open banking rule under Section 1033 would have forced data access, but the bureau told a federal court in May 2025 that "the Rule is unlawful and should be set aside," as Consumer Finance Monitor reported. The bureau has since reopened the rule, and in August 2026 it sent a reconsideration proposal to White House review, per a law-firm summary; its contents were not public at that point. Today no binding federal rule makes a bank open a write channel to your agent.
What This Means for Agents That Touch Accounts
Every agent product that reaches customer accounts now has three access tiers to design for. The first is aggregator read access, which is how Plaid's integration with Meta's Muse works: balances, transactions, investment holdings and mortgage data, with consent, through a network Plaid puts at more than 12,000 US financial institutions and apps. Fortune reported that Meta declined to say whether Muse's finance features would survive more banks blocking agents. The second is a bank-run MCP server with the bank's authentication and the bank's tool list, which at Schwab includes trading for a pilot group. The third is money movement, which stays inside the bank's own assistant or its existing payment rails.
This mirrors the retail fight. Amazon already blocked Muse on its marketplace over credential capture, and Meta's answer was a personal agent protocol built with Sierra for agent identity and permission. Europe got there first in brokerage: Fortune notes that Germany's Scalable Capital opened its platform to AI models in August with users approving trades and no ability to withdraw money.
The calls were about retail and brokerage customers, and neither CEO mentioned commercial banking. Nothing either bank said exempts commercial portals. If your finance team runs an accounts payable or treasury agent that logs into a bank portal through a shared service account and clicks through payment screens, it is the same technique the banks just said they detect and stop. Programs that keep a person releasing the payment, like the agents shown at Sibos 2026, already sit on the right side of the line.
MCP does not remove the security work either. The Next Web reported on October 6 that a server-side request forgery flaw recurred across unrelated MCP servers, including a JPMorgan documentation-search server that the bank's disclosure team confirmed and fixed. A bank-run MCP layer narrows what an agent can do; it still needs the allowlisting and client-side enforcement any MCP deployment does.
What to Do About It
This Week:
- Inventory every agent, RPA bot and integration in your company that signs into a bank or brokerage portal with stored credentials. Include finance's AP and treasury automations and anything a vendor runs for you.
- If you build a consumer or advisor agent, list each account action it takes today and mark it read, trade, or money movement. Anything in the last column needs a bank-sanctioned path or a human step.
This Month:
- Ask each of your banks, in writing, whether they plan an MCP server or API for agent access, which actions it will expose, and what authentication it uses. Ask too whether their credential-detection blocks apply to commercial portals.
- For treasury and AP, move payment initiation to the bank's API or host-to-host channel and keep a named person approving release. Supervisors are already asking banks how they would shut agents down; your counterparties will ask you the same question.
Before Your Next Bank or Aggregator Renewal:
- Get liability for agent-initiated actions written into the contract. Dimon's "liability transfer" is today an assertion on an earnings call, and the contract is where it gets settled.
- If you rely on Plaid or another aggregator for agent read access, confirm the bank-level pricing and access terms behind it, since JPMorgan has already shown it will charge for that data.
The Bottom Line
JPMorgan's record with aggregators shows the sequence: steer access into a channel the bank controls, then put a price on it, as it did with data fees in 2025. Agents can act as well as read, so this time the controlled channel arrives with money movement already carved out. Wurster and Dimon drew the same line between reading and moving money in the same week, and with Section 1033 stalled, no regulator is setting a different one.
Plan your agent's account access around read, trade and money movement as separate permissions, and assume the bank grants the third one last.
Continue Reading
- Amazon Blocks Meta's Muse Agent Where the Perplexity Ruling Stops
- Meta's Personal Agent Protocol Signs Walmart Before It Has a Spec
- Fed, OCC and FDIC Ask Banks How They Would Shut Down AI Agents
- MCP Server Governance: Enforce at the Client, Not the Registry
- At Sibos 2026, Bank AI Agents Fix Payments a Person Still Releases
- Asurion Took AP From 20% to 70% Touchless Without New OCR
