Notes from Việt Nam on law, technology, languages, history, culture and travel.

Read, Maybe Trade, Never Move Money: JPMorgan and Schwab Draw the First Hard Line for AI Agents

For two years the agent pitch has been that an AI assistant should be able to do anything you can do in a browser. Last week two of the largest US financial institutions said no to that, in plain terms and on the record.

On Tuesday, 13 October 2026, during JPMorgan Chase’s third-quarter earnings call, CEO Jamie Dimon said: “We’re not going to allow just any outside agent to come in inside the company because that’s just too risky for clients and for JPMorgan.” He added: “You don’t want rogue agents.” Two days later, on Thursday, 15 October, Charles Schwab CEO Rick Wurster used Schwab’s own call to say the firm is “blocking unauthorized agents who try to log in on behalf of clients.” The agent most often named in coverage of both blocks is Meta’s Muse assistant, which can link to bank accounts.

Nobody released a model and no robot did anything new. It still matters for the AI industry, because it is the first time major banks have publicly set a policy on autonomous agents acting for their customers. The policy has a clear shape that other industries are likely to copy.

What exactly is being blocked

The two firms describe the same target. It is not “AI” in general. It is a third-party agent that uses the customer’s own username and password to drive the bank’s website, which is screen scraping done by a large language model.

  • JPMorgan: a spokesperson told Fortune the bank acts “when we detect a third-party agent attempting to access accounts by obtaining customers’ banking credentials.” The bank said it still supports “secure, customer-authorized data sharing through open banking providers.” In practice an agent can see read-only data such as balances through an aggregator like Plaid, but it cannot send money or pay bills, and JPMorgan gave no timeline for changing that.
  • Schwab: Financial Planning reports that Schwab is “specifically preventing AI agents from using clients’ login credentials or browser automation to access its systems.” Wurster’s description: “that’s just an agent coming to our site and trying to log in on behalf of a client. We are not going to allow that.”

On scale, the accounts conflict. Speaking on Bloomberg Television the day after the call, Wurster said blocks happen “in the tens and twenties each week,” according to two outlets that quoted the interview. Financial Planning quotes him calling such cases “few and far between.” Both statements can be true, since a few dozen events a week is small next to Schwab’s client base. Either way, this is not yet a flood. It is a policy set before the volume arrives.

The sanctioned alternative: MCP, scoped by the institution

The part most relevant to developers is what Schwab is offering instead. Schwab is not banning LLMs. It is moving them off the browser and onto an interface it controls. “We are allowing LLMs to connect, but we are controlling the experience,” Wurster said. Outside models can connect through Schwab-run MCP servers. MCP, the Model Context Protocol, is the open standard Anthropic introduced in 2024 for wiring models to tools and data. Through it, a model can read balances and positions and run analysis. Coverage describes three tiers:

  1. Read and analyse: open to outside models through the MCP servers.
  2. Trade: a pilot for active traders, reportedly starting with Claude and expanding to more models “in the coming months.” This detail comes from a single newsletter summarising the call, so treat it as reported rather than confirmed.
  3. Move money: not allowed. “We do not allow them to move money because we think there is too much risk there to the client and to the firm.”

Schwab is also steering clients to its own assistant, Charley. According to Schwab’s 30 September announcement as summarised in coverage, Charley can read balances, positions, statements and tax documents, and can make limited account changes such as updating contact details or adding a beneficiary.

For anyone who builds agents, this is the important part. The bank is treating MCP as the equivalent of an API gateway: authenticated, scoped per capability, logged, and revocable by the institution, not the user. Browser automation with stored credentials offers none of that. The bank cannot tell a person from an agent, cannot limit what the agent does, and cannot tell afterwards who clicked “transfer.”

The real issue is liability

Both CEOs framed the decision around who pays when something goes wrong. Coverage paraphrases Dimon as saying that people who use outside agents take on the risk and liability themselves. Wurster was more direct on Bloomberg TV: “We can’t control it, the client can’t control it, something could go wrong and who’s liable?”

The US has no settled answer. The CFPB’s 2024 Section 1033 open-banking rule would have required banks to share data with authorised third parties. In 2025 the bureau told a federal court the rule was unlawful, and it is now reconsidering it. Even the original rule was about access to data, not payments. No binding federal rule currently forces a bank to give an agent a write channel. Until one exists, banks will default to read-only.

A pattern beyond banking

Banks are not alone. Amazon sued Perplexity in November 2025 over its Comet agentic browser. A preliminary injunction Amazon won was later reversed on appeal. In September 2026 Amazon blocked Meta’s Muse with a pop-up stating that “continued access by an unauthorized AI agent violates Amazon’s Conditions of Use.” Delta told TechCrunch it has “no partnerships or integrations that allow third-party AI agents to purchase or book Delta flights.” The common pattern is that platforms will accept agents through a door they built and metered. They will not accept agents through the door built for humans.

Skepticism worth keeping

Security is not the only motive. Tim Welsh of Nexus Strategies told Financial Planning: “An outside agent works for the client. Charley works for Schwab.” He noted that Schwab earns substantial interest on uninvested client cash, about $3.48 billion in net interest revenue last quarter. An outside agent that moves idle cash into higher-yield accounts elsewhere directly threatens that revenue. Fintech groups have separately called JPMorgan’s data-access fees for aggregators anti-competitive. “Safety” and “keeping control of the customer relationship” lead to the same policy, so it is hard to tell which one is driving it.

The open questions for builders:

  • Agent identity. Amazon said Muse did not identify itself as an AI. Signed, verifiable agent identity, meaning a header or credential that says “I am agent X acting for user Y with scope Z,” is the obvious missing layer.
  • Who writes the scopes. If every institution runs its own MCP server with its own permissions, general-purpose assistants become a patchwork of integrations, which is the same situation the open-banking movement spent a decade trying to fix.
  • Human approval for writes. Europe offers a middle path. Germany’s Scalable Capital opened to ChatGPT, Claude and Grok in August, but users approve every trade and assistants cannot withdraw funds.

The direction is clear even if the details are not. The phase in which agents could do whatever a logged-in browser could do is ending in regulated industries. The next phase runs on explicit, institution-issued capabilities, and MCP is quickly becoming the format they are issued in. If your agent depends on scraping a logged-in session, now is the time to redesign it.

Sources