Contents5
There is something instructive about watching the most cautious institutions in the world answer the same question as you. Should an AI agent be allowed to act in our systems on someone’s behalf? In October 2026, two major US financial firms answered publicly, and their answer fits in one sentence: looking, yes; touching, no. This article from our Business AI section draws out what applies to a company of 20 to 500 people connecting agents to its own tools.
In short
Schwab blocks external AI agents that try to move its customers’ money, and plans read-only access through MCP servers.
JPMorgan blocks external agents that would act for its retail customers; reading certain data remains possible through connectors.
The problem is not AI, it is the delegation of login details: an agent that signs in with a customer’s password.
The lesson for any company: read-only first, one identity per agent, keys in a vault, and governance of write permissions.
What the two banks decided
According to The Next Web, Charles Schwab’s chief executive, Rick Wurster, explained that the firm blocks external AI agents that try to move its customers’ money, and that it stops several dozen of them every week. Instead, it will offer read-only access through MCP servers, the protocol that lets an AI model connect to a service under rules set by that service: checking a balance, running a search, but not moving money. American Banker specifies that the block targets agents that use customers’ login credentials or drive a browser in their place.
At JPMorgan, Jamie Dimon said during the quarterly results presentation that he would not let an external agent act inside the bank. Agents can read certain data through connectors, but not send money or pay bills.
What the banks accept
Reading a balance or account data
Through a designated channel, under rules set by the bank
What they block
Moving money or paying on the customer’s behalf
Signing in with the customer’s login details
The real issue: who owns the key
The refusal is not about AI as such. Schwab is developing its own assistant, Charley, and opens reading to external tools. What is blocked is a specific mode of access: a customer hands their password to an agent, which impersonates them. In that case, the bank can no longer tell the customer from the machine, can no longer limit what the agent does, and no longer knows who is responsible if something goes wrong. Rick Wurster puts the question bluntly: who is responsible? In the United States, the answer has not yet been settled.
An agent that signs in with your password is not your assistant: it is you, without your judgement.
The lesson for a company
Replace the bank with your CRM, your invoicing software or your business bank, and the customer with an employee who wants to save time. The situation is the same, and the banks’ answer provides a simple model.
- Read-only first.
A new agent starts by consulting: it prepares, summarises, suggests. It changes nothing until its work has been observed.
- One identity per agent.
Never a person’s account. The agent has its own named access, which can be suspended without getting in anyone’s way.
- Keys in a vault.
The agent uses access without ever reading it: a relay adds the key at the time of the call, towards the one intended service. That is what our article on the secrets vault describes.
- Write permissions decided and logged.
Writing, sending, paying or deleting is a permission granted explicitly, for a task, with a log and human validation on actions that commit the company.
The choice of channel matters as much as the permissions. The banks open reading through MCP servers they control, rather than letting an agent drive their website as a human would. In your company, the same principle means connecting agents through connectors designed for them, with limited permissions, rather than lending them an open session.
Watch out
The shortcut you regret
Lending your login details to an agent “just to test” is exactly what the banks block. In a company, nothing blocks it by default: it is up to you to set the rule before the test becomes the habit.
Our view
The banks’ answer is not a rejection of AI, it is a method: open what carries no risk, close what commits, and choose the channel through which you open. It applies as it stands to any company that wants to benefit from agents without losing control of its tools.
That is the approach of our AI vault offer: access in your name, which your agents use without seeing it, with a log of every use. To go further on dividing permissions and allocating responsibilities, our guide to AI governance in the enterprise sets out the framework, and our guide to integrating AI in business puts these decisions in order. On the budget side, our AI at the right cost offer caps what each agent consumes.
Frequently asked questions
Why are Schwab and JPMorgan blocking AI agents?
Because these agents were trying to act on customers’ accounts, often by signing in with their login details. The bank then can neither tell the customer from the machine, nor limit what the agent does, nor establish who is responsible for an error. Reading through controlled channels remains possible.
What is read-only access through MCP?
MCP is a protocol that lets an AI model connect to a service through functions designed for that purpose. In read-only mode, the agent can consult information, such as a balance, but no function lets it modify, send or pay.
How do I apply this rule to my own AI agents?
Give each agent its own identity, start in read-only mode, store its keys in a secrets vault, and only grant a write permission for one specific, clearly defined task, with a log and human validation on actions that commit the company.
Is a read-only AI agent really useful?
Yes. Preparing a file, summarising a customer history, spotting an anomaly or suggesting a reply requires no write permission. That is often where most of the time saving lies, and it is the best way to observe an agent before entrusting it with more.
Sources
- The Next Web, Schwab and JPMorgan are blocking AI agents from moving customer money (new tab)thenextweb.com
- American Banker, Schwab blocks unauthorized AI agents (new tab)americanbanker.com
The Next Web, Schwab and JPMorgan are blocking AI agents from moving customer money
Read on thenextweb.com(new tab)Jim · founder of Brain Plus AI
Also in business ai
Practical guide12 min
Enterprise AI governance: who can access what
An AI assistant reads whatever your access rights let it read, sharing mistakes included. Here is how to split your knowledge bases by department, keep a common core and decide who writes to the shared memory.
Understand12 min
Secrets vault: your AI uses your keys without seeing them
Passwords sent by email, API keys forgotten in code, AI agents that could copy everything: these are the leaks we come across most often. And how a vault in your name lets your AI use your keys without ever reading them.
Practical guide11 min The topic guide
Integrating AI in business: private and at the right cost
For teams of 20 to 500 people, integrating AI comes down to answering five questions in order: which task, where the data goes, which model, at what price, under what rules. This guide takes them one by one and points to our detailed articles.