US Banks Lock AI Agents Out of Moving Customer Money

Some of the largest financial firms in the United States have drawn a hard line around automated agents: they can look, but they cannot pay. Charles Schwab and JPMorgan Chase both said this week that they are blocking unauthorised AI agents from moving customer money, with Citigroup and Bank of America reported to be taking similar positions. The tools can still check a balance or pull data for research. Sending funds is off the table.

Schwab chief executive Rick Wurster put numbers to it. Speaking to Bloomberg Television, he said the firm was stopping unauthorised agents, including Meta's newly released Muse, that tried to move client funds, and that the larger agents were being turned away in the "tens and twenties per week." Schwab's plan is to offer read-only access through MCP servers, so an outside tool can see balances and do analysis without ever touching the money. The firm would rather customers use its own assistant, Charley, for anything that moves a dollar.

JPMorgan's Jamie Dimon framed it as a straightforward risk problem. "You don't want rogue agents and there could be thousands of them," he said. The bank's approach mirrors Schwab's: third-party software can view account information, but it is locked out of sending payments or paying bills. Citigroup and Bank of America have reportedly landed in the same place, with Bank of America wanting a human to sign off before money leaves an account.

Why the caution makes sense

The nightmare here is not science fiction. An agent with payment permissions and a flawed instruction can drain an account faster than any human fraudster, and it does not pause to wonder whether the request looks odd. We looked recently at the quieter version of this worry, the question of whether a shopping agent might spend your money without asking. The banks are answering that question for themselves by simply refusing to hand over the keys.

There is a commercial undercurrent too. Read-only access keeps customers inside the bank's own apps for the part that generates fees and relationships, and it keeps deposits from quietly routing out through someone else's assistant. A safeguard and a moat can be the same wall.

The stance also reflects how wary even big institutions remain about letting software act on its own. Enterprises have been pulling back from fully autonomous agents in production, and finance is about the least forgiving place to learn that an agent misread an instruction. For now the message from the money is clear. Automate the research, keep a human on the transfer.