Four of the largest financial firms in the United States now turn away outside AI agents that try to log into customer accounts or move customer money. Citigroup, Bank of America, JPMorgan Chase and Charles Schwab made their positions public between October 13 and October 16. Meta's Muse assistant has emerged as the most prominent target, and the move raises a question nobody has answered: who pays when an agent moves money without permission?
Which banks are blocking AI agents and what they said
The earliest statement came from JPMorgan Chase. On the bank's third-quarter earnings call on October 13, CEO Jamie Dimon said JPMorgan will not let just any outside agent operate inside its systems, which he called too risky for clients and the bank, according to Cybernews. “You don't want rogue agents, and it could be thousands of them,” Dimon told analysts.
Charles Schwab took a similar line. CEO Rick Wurster said on the brokerage's third-quarter call that Schwab is blocking unauthorized agents that try to log in on clients' behalf, as The Epoch Times reported. The date is disputed. The Epoch Times puts the call on October 14, while Benzinga describes it as a Thursday, so treat the exact day as unconfirmed.
Wurster went further in an interview with Bloomberg Television, saying Schwab is actively blocking unauthorized agents that try to move clients' money. He named Meta's Muse in that context. He also put the core worry in blunt terms: “We can't control it, the client can't control it, something could go wrong and who's liable?”
Citigroup told the Financial Times on October 16 that it does not permit third-party AI agents or assistants to log into customer accounts or transact directly on its digital banking platforms. Customers can still authorize limited, read-only data access through certain open-banking providers, according to Oninvest and TradersUnion.
Bank of America has restricted AI agent access while it works out who bears responsibility for AI-initiated payments, according to the FT's reporting. Chief executive Brian Moynihan told CNBC, as the FT cited him: “We strongly believe there should be a human in the loop to authorise money moving out of your account.”
The positions differ in scope, as this summary shows:
| Firm | What it has said | When it was reported |
|---|---|---|
| JPMorgan Chase | Will not let just any outside agent operate inside its systems | Third-quarter earnings call, October 13 |
| Charles Schwab | Blocking unauthorized agents that log in or try to move client money | Third-quarter call, October 14 or a Thursday (disputed) |
| Citigroup | Does not permit third-party AI agents to log in or transact | Told the FT, October 16 |
| Bank of America | Restricted agent access while it determines liability for AI-initiated payments | October 14, per one secondary source |
Regulators have reportedly welcomed the guardrails, according to NewsBytes. Whether federal banking regulators will write formal rules or simply endorse the approach remains unknown.
Why Meta's Muse became the test case
Muse launched in September. It is Meta's personal agent, and it can book, buy and negotiate on a user's behalf, which makes it a direct test case for the banks, according to The Next Web. The core objection is simple. A customer hands over login credentials to a third-party tool, and that tool then acts for them. The banks say that setup leaves no clear control or accountability.
The numbers show why the banks are paying attention. Schwab sees unauthorized agent attempts blocked “in the tens and twenties” each week. The firm also reported $13.3 trillion in client assets at the end of the third quarter, according to The Epoch Times. A gatekeeper of that size effectively sets the terms for how agents reach customer money.
The sources reviewed do not show whether Meta has publicly responded to the blocks.
Who is liable when an AI agent moves money
This is the question the banks keep circling, and no one has answered it. Congress is still debating AI agent liability, and the reporting reviewed offers no clear answer, according to The Next Web. Wurster's question, who's liable, is the one a customer would ask after a bad transfer.
Moynihan's human-in-the-loop position points to one possible answer: a person approves each outgoing payment before it leaves the account. Dimon's concern is about volume. If thousands of agents could reach a bank's systems, as he warned, no team could vet each one by hand.
For consumers, the practical question is whether a bank will treat a transfer as authorized when the customer shared credentials with a third-party tool. None of the sources reviewed answer that. Consumer banking disputes have typically turned on whether the customer authorized a payment, and an agent blurs that line.
The security side adds to the worry. One outlet, Startup Fortune, reports that AI labs have recently disclosed agents leaking credentials and data, including an OpenAI agent that reportedly leaked a GitHub token. That account rests on a single source, so treat it as unverified.
The deposit question behind the blocks
Deposits are the subtext. Banks fear that agents will shift cash out of low-yield checking and into higher-paying accounts, which would raise their funding costs, according to Digital Today. A warning tied to Apollo's chief economist puts average checking-account rates at 0.1%, against 3.3% to 5% on accounts that AI tools could move money into, as TradersUnion reported. That comparison is a projection, not a measured outflow. The sources reviewed do not show whether deposit flight is happening.
What the blocks mean for AI money assistants
Americans who use AI assistants to manage money may find that tools which log in with their bank password stop working for transfers. Some services may only offer read-only access instead.
That split matters. For someone who wants an assistant to pay bills or rebalance a portfolio, read-only access is a real downgrade. For someone who wants help tracking spending or spotting unusual charges, a view-only connection may be enough.
Schwab plans controlled connections, called model context protocol (MCP) servers, that let outside AI models view balances and do research but not move money. The firm is also pushing its own assistant, Charley, according to The Next Web. Schwab wants AI activity to happen inside its own walls, on terms it controls.
Regulators outside the US are watching the same access problem. India's CERT-In has said AI agents can read live business records unnoticed, and USA 24 covered that in its advisory story.
Steps to take if you use an AI money tool
These steps are general guidance, not recommendations from the banks or the reporting:
- Do not give bank or brokerage passwords to third-party AI apps.
- Use your bank's official data-sharing or read-only connections where they are offered.
- Keep transaction alerts turned on so you see every movement as it happens.
- Require a person to approve any transfer an AI tool initiates.
What to watch next
Four developments will show where this goes. Watch whether Meta responds publicly to the blocks, which the sources reviewed do not yet show. Watch whether Schwab's MCP servers launch and what they permit. Watch whether federal regulators move from informal endorsement to formal rules, and whether Congress settles liability before a large loss forces the question.
One date needs caution. A single secondary source, CellCog's blog, reports that Wells Fargo terms take effect November 24, 2026, and no other source reviewed confirms it. Federal scrutiny of AI companies is already growing, as the FTC's civil investigative demands to OpenAI and Anthropic show. The next test is whether banks, regulators and AI developers agree on who answers for a transfer that no one approved.
