Bank of America and Charles Schwab block AI agents attempting to move customer money

• Research window (from, sole source of truth): 2026-10-14 → 2026-10-17 (inclusive).
• story_count: 10. This artifact covers exactly one assigned story: S08.
• Window validation: primary event date 2026-10-16 (Charles Schwab CEO Rick Wurster confirms active blocking in a Bloomberg TV interview) falls inside the window — PASS. Bank of America's CEO position statement (2026-10-14 CNBC interview) also falls inside the window; the FT report of the BofA/Citi restrictions is dated 2026-10-16 by relays — inside the window.
• Context events outside the window are explicitly labelled as context (JPMorgan 2026-10-13; Meta Muse launch 2026-09-08; Personal Agent Protocol draft 2026-10-09).

Date record (kept separate)

--

FACT (CONFIRMED): In the week of 13–16 October 2026, four of the largest US financial institutions went on record — in three cases via CEOs on earnings calls or television, in all four via reporting — drawing a hard boundary around third-party AI agents accessing customer accounts, with money movement by outside agents refused outright for now and read-only data access tolerated through regulated aggregator channels:

1. JPMorgan Chase (2026-10-13, context): CEO Jamie Dimon told analysts on the Q3 earnings call: "We're not going to allow just any … outside agent to come in inside the company, because it's just too risky for clients and for JPMorgan," adding "You don't want rogue agents, and it could be thousands of them." A JPMorgan spokeswoman confirmed to CNBC that the bank blocks external AI agents for retail customers: "Because it is not safe, we do not permit third parties to access accounts by obtaining customers' banking credentials and logging in on their behalf." Read-only access via Plaid or another connector remains possible with the user's credentials, "but they can't send money or pay a bill" (CNBC, 2026-10-13).
2. Bank of America (position aired 2026-10-14; restriction reported 2026-10-16): On CNBC's Squawk on the Street (aired Wed 2026-10-14, 10:49 AM EDT, alongside Q3 earnings and a $1.2 billion money-laundering fine), CEO Brian Moynihan argued the payment system needs human authorization: per FT's relay, "We strongly believe there should be a human in the loop to authorise money moving out of your account." The Verge (2026-10-15), citing a CNBC reel of the interview, reports Moynihan "is working with the AI industry" to press that position "at least until the risk of error is mitigated by 'further development of the capabilities' of agents." FT subsequently reported (headline verified; article paywalled) that BofA has restricted AI agents' access to customer accounts while it works through liability questions, alongside a similar Citi restriction; banks are described as raising concerns with regulators that agents could drain deposits.
3. Charles Schwab (2026-10-16): CEO Rick Wurster, interviewed on Bloomberg TV, described an operational block already in force: "We don't want someone just giving their password to Muse, and letting Muse come in and take action on that client's behalf. We can't control it, the client can't control it, something could go wrong and who's liable? For the protection of the client and for the protection of us, we're not allowing it." He also disclosed the internal metric: "I get a report on how many times we've blocked clients from using one of these agents in a week and it's in the tens and twenties—per week—that the big agents are being blocked. What that tells me is that while people love AI, they're not willing to turn their financial accounts over to them just yet" (verbatim in Gizmodo's relay of the Bloomberg interview, 2026-10-16).

FACT (CONFIRMED): The immediate trigger in the coverage is Meta's Muse personal agent, launched 2026-09-08 with a Plaid-powered "Finances" experience (balances, transactions, investment holdings, mortgage information), followed in September by OpenAI's agent "Dots" and the earlier invite-only rise of Instinct (Spear Street Technology; $10 billion valuation in September per CNBC/Reuters). CNBC reports bank stocks were hit in September as Muse topped app-download charts, on fear consumers would sweep funds from low-yielding deposits to higher-yielding alternatives.

Before: Consumer finance agents operated in a permission grey zone. The dominant pattern was the aggregator model (Plaid and peers): a consumer shares banking credentials with a fintech app, the aggregator logs in as the consumer, and reads account data — long-contested (JPMorgan previously fought fintech middlemen over data access and charged Plaid-era data requests) but legally settled enough to be ubiquitous. Fully autonomous "personal agents" (Muse, Dots, Instinct) raised the stakes: an agent logging in as the customer could not just read balances but attempt transactions — payments, transfers, trades — with no bank-side agent identity, no scoped authorization, and no agreed liability when it went wrong.

Change (CONFIRMED): Within one week, the four largest US banks by various measures publicly refused the credential-handoff model for agents and refused agent-initiated money movement, while explicitly keeping the read-only aggregator channel open:

• JPMorgan: blanket refusal of outside agents, credential-login ban, read-only via open banking preserved, no timeline for change; Dimon frames users who proceed as having accepted "a liability transfer."
• BofA: FT-reported restriction on agent access to deposit accounts while liability is worked out; CEO advocacy for human payment authorization as an industry position ("working with the AI industry").
• Schwab: active operational blocking with per-week detection metrics, plus an announced sanctioned alternative: external LLM access will be allowed only through Schwab's own MCP servers with controlled authentication — read-only (balances, research), explicitly not money movement.
• Citi (context): FT-reported restriction mirroring BofA, read-only open-banking access preserved.

After: A de-facto two-lane regime for consumer AI in banking: lane 1 (blocked) — an outside agent holding the customer's credentials logging into the bank's customer-facing surface and acting; lane 2 (tolerated/sanctioned) — read-only data via customer-authorized aggregators today, and bank-controlled API/MCP endpoints with bank-issued, scoped, revocable authentication tomorrow (Schwab's stated plan; the direction the Sierra/Meta "Personal Agent Protocol" draft — with Bank of America itself as a design partner — would formalize).

• Before: Personal agents could ask users to hand over banking credentials and log in as them, transact with the bank's ordinary web/app surface, and leave banks unable to distinguish agent traffic from human traffic or to allocate liability. Read-only aggregator sharing was the established, if grudgingly accepted, channel.
• Change (2026-10-13 → 2026-10-16): JPMorgan (Dimon, earnings call), BofA (Moynihan, CNBC + FT-reported restriction), Schwab (Wurster, Bloomberg TV, operational block with volumes) and Citi (FT) all refuse outside-agent account access for action; credential-based logins by agents are named as the thing being blocked; read-only data sharing through open-banking providers is explicitly preserved.
• After: Agents retain sanctioned read access (Plaid and peers) but no sanctioned write path at US mega-banks; Schwab commits to a bank-controlled MCP/API route for read-only LLM access and already has "a growing subset of clients that are trading through LLMs and APIs" via firm-controlled endpoints (Wurster on the Schwab Q3 earnings call, per Gizmodo's relay); the industry's proposed identity/authorization layer (Personal Agent Protocol, draft v0.1, published 2026-10-09 with BofA, Wells Fargo, Mastercard, Visa, PayPal, Plaid, OpenAI et al. as design partners) becomes the visible candidate for reopening agent write access safely.

5.1 The three access paths an "AI agent" can take to a bank account

Everything in this story resolves into which of three paths an agent uses, and which each bank allows:

FACT (CONFIRMED — Plaid primary): Plaid's own blog (2026-09-08) states Muse's "Finances experience" connects accounts "through Plaid to share balances, transactions, investment holdings, mortgage information and more," with Plaid establishing the connection and users managing it via Plaid Portal. Plaid supports 12,000+ institutions. This is the aggregator read path (P2) — Muse's sanctioned mode is data, not money movement.

FACT (CONFIRMED — CEO statement via two relays): Schwab's future external-LLM path is P3: Wurster told Bloomberg Schwab "is preparing to allow external LLM connections, but only through Model Context Protocol (MCP) servers with controlled authentication, and their actions will be restricted: 'We're not going to allow them to move money, but if they want to come in and see their account balances and do research, they will be able to do that through their LLMs.'" On the Schwab Q3 earnings call he noted a "growing subset of clients … that are trading through LLMs and APIs," which can only submit requests through the firm's APIs and MCP servers "where Schwab can control and verify interactions" (Gizmodo relay, 2026-10-16).

5.2 Why the banks say P1 is intolerable

• Control: "We can't control it, the client can't control it" (Wurster) — an agent session is indistinguishable from the human customer, so the bank cannot scope, monitor, rate-limit or revoke it.
• Liability: "something could go wrong and who's liable?" (Wurster); Dimon: users of outside agents "should understand there's a liability transfer"; FT: BofA is restricting "while it works through questions about liability for AI-initiated payments." No liability framework exists for an erroneous agent-initiated payment the customer didn't directly authorize.
• Rogue-agent scale: Dimon: "You don't want rogue agents, and it could be thousands of them." A JPMorgan-linked concern echoed in a Cloud Security Alliance research note (via Fortune) summarizing a campaign in which three open-source AI agents allegedly breached 27 organizations and took 600,000+ credit card records — the CSA note urges treating agentic-AI attack scenarios as current, not future, retail/payments risk (EARLY RESEARCH — CSA claim relayed via Fortune, not independently audited here).
• Deposit economics (the unspoken second rail): FT reports banks are concerned agents could move billions from low-yield deposits to better returns; CNBC notes Apollo's Torsten Slok and others flagged risks to cheap bank deposits, a fear credited with contributing to the September bank-stock drop when Muse topped download charts. INTERPRETATION: the "human in the loop" position conveniently also defends deposit franchise value; sources evidence both the security and the deposit-deployment rationales, and banks do not distinguish their weight.

5.3 The industry's proposed fix: Personal Agent Protocol ("Poppy")

FACT (CONFIRMED — primary sources fetched): Sierra (Bret Taylor, Clay Bavor) with Meta announced Personal Agent Protocol on Tue 2026-10-06 (with Genesys, Instinct, NiCE, Rocket, Shopify, Stripe, Walmart) and published a draft on 2026-10-09 with 35 more design partners including Bank of America, BBVA, Chime, Mastercard, Nordstrom, PayPal, Plaid, Target, Visa, Wells Fargo, and OpenAI (sierra.ai/blog/poppy). The draft site (personalagentprotocol.org) defines:

• Discovery: a standard /.well-known/poppy.json file telling agents how to interact with a company and how customers sign in;
• Agent identity: the personal agent always identifies itself, so the company knows it is dealing with an agent and whom it represents;
• Sign-in on the company's own page via OAuth, with the agent receiving a session token (signed JWT) granting only approved scopes; the customer chooses whether the agent may view the account, make changes, or both;
• A permission spectrum from "blocked" through guest/search, signed-in read, user-approved actions, up to full access — the company sets the parameters;
• Interfaces: OpenAPI, MCP, the company's own agent, or its regular web pages in the same session;
• Plain framing of the current dilemma: "Today it is all or nothing: the company blocks the agent, or the agent signs in as the person and can do anything they can" — precisely the P1 impasse the banks describe.

INTERPRETATION: Poppy is the standards-track answer to Wurster's and Moynihan's stated objections: agent identity (kills "we can't control it"), customer-owned OAuth sign-in (kills credential sharing), scoped authorisation and revocation (starts answering "who's liable?"). Bank of America's dual role — restricting agents per FT while co-designing this protocol — is not a contradiction but a sequence: block the unsafe path now, enable a governed path later. Schwab's MCP-server plan is the same architecture implemented privately by one firm.

FACT/INTERPRETATION: This is the clearest signal yet that the consumer AI-agent wave has hit its first hard institutional floor: the banking perimeter. Reading and acting are being institutionally separated. Read access to financial data is now treated as a consumer right routed through aggregators; write access — moving money — is being asserted as a bank-controlled privilege requiring bank-side identity, scoped authorization, and a liability answer. Because these four banks hold a vast share of US consumer deposits and brokerages, their stance functions as a de-facto American standard until regulators or standards bodies act. It also relocates the agent-infra battleground: away from "which model is best" toward who issues and verifies agent credentials at the account boundary — banks (Schwab's MCP route), protocol consortia (Poppy), or aggregators (Plaid's installed base).

PREDICTION/INTERPRETATION grounded in evidence:

1. Bank-controlled agent gateways become a product category: MCP servers or APIs with customer-issued, scoped, revocable tokens, per-action approval, full audit trails. Schwab has announced one (read-only first).
2. Standards compliance as market access: implementing /.well-known/poppy.json + OAuth scoping becomes the sanctioned route for Meta/OpenAI/Sierra-class agents to re-enter bank environments; design-partner banks get first-mover advantage in defining scopes.
3. Agent-aware liability products: given Dimon's "liability transfer" framing and BofA's liability workstream, error-and-omission and transaction-guarantee products for agent-initiated payments become a visible insurance/plausibility track (EARLY RESEARCH — no such product evidenced yet).
4. Compliance-side agent surveillance: banks already detect and count blocked agent logins (Schwab's weekly "tens and twenties" report); that detection capability is itself a sellable fraud/anti-bot asset.
5. Internal-agent acceleration: all four banks contrast external refusal with internal ambition — JPMorgan's Smart Cash pilot (CFO Jeremy Barnum, Q3 call: forecasts cash flow and moves funds to maximize yield), Dimon "we're building tools to do that, too," Schwab's Charley. External walls fund internal moats.

1. What is BofA's actual enforcement mechanism — credential-login detection (as at JPMorgan), ToS prohibition, or something technical at the aggregator layer? No document was retrievable.
2. When did the BofA/Citi restrictions take effect, and do they cover brokerage/credit-card surfaces or only deposit accounts (FT says deposit accounts; relayed)?
3. What liability framework is BofA "working through," and is any regulator (OCC, Fed, CFPB) formally engaged? FT says banks are raising concerns with regulators; no proceeding was found.
4. Will Schwab's MCP access remain read-only, and what per-action approval model will govern any future write scope? What is the launch date?
5. Is JPMorgan building its own P3 gateway, given "no timeline" but internal agent deployment plans and the Smart Cash pilot?
6. Does Poppy reach 1.0 on the promised "over the next month" timeline, and do BofA/Wells Fargo implementations follow design-partner status with shipped endpoints?
7. Are Instinct's and Dots' access paths P1 or P2 at these banks today? (Instinct is a Poppy design partner; its concierge model was not examined here.)
8. Schwab's block volumes are "tens and twenties per week" — for which agents, and what share of attempts succeeds before detection?

• Near-term (weeks): Poppy design workshops and reference implementation (Sierra's stated "over the next month" from 2026-10-09); watch for BofA/Wells Fargo/Mastercard scope announcements; Schwab's MCP read-only launch details; more bank CEOs asked on Q4 calls to match Dimon/Moynihan/Wurster positions (COMPANY CLAIM-derived expectation).
• Medium-term (quarters): First bank-shipped agent gateway with per-action approval (most likely Schwab, given its stated plan and existing API-trading subset); BofA's liability framework announcement (its FT-reported workstream); possible first regulatory engagement following the FT-reported bank lobbying on deposit drain; Poppy 1.0 or a competing/bank-led standard (e.g., through FDX) formalising view-vs-change scopes.
• Watch metric: Schwab's weekly blocked-agent volume. Wurster frames "tens and twenties" as proof consumers aren't ready; PREDICTION: if that number scales into the hundreds as agent UX improves, the political economy shifts from "no demand" to "denied demand," raising pressure for the sanctioned P3/Poppy rails to ship faster — or for regulation to force them.

The banks did not reject AI agents — they rejected who holds the keys. In a single week, JPMorgan, Bank of America, Schwab and (per the FT) Citi drew the same line in the same place: an outside agent holding your password and moving your money is refused; an agent reading your balances through Plaid is fine; and the future belongs to the bank's own MCP/API gateway, with your identity verified, your scopes granted, and — for now, says Bank of America's CEO — a human approving the payment. The volume Schwab publishes ("tens and twenties" blocked logins a week) says the revolution is still small; the protocol BofA is co-designing with Meta says the institutions plan to be ready for it anyway. This is less a story about banks versus AI than about the account boundary becoming the most valuable real estate in the agent economy — and its owners charging rent in the form of identity, scopes, and a human in the loop.