Banks block AI agents from customer accounts

Across JPMorgan Chase, Citigroup, Bank of America and Charles Schwab, the policy converges on one distinction: an AI agent may look at an account, but it may not move money out of it on its own ^[2]. Schwab CEO Rick Wurster frames the problem as a loss of control that happens the moment a customer hands bank login credentials to an unauthorized agent like Meta's Muse: "We can't control it, the client can't control it, something could go wrong and who's liable?" ^[1]Schwab's answer is to build its own channel instead - letting clients connect their own LLMs to Schwab-run Model Context Protocol (MCP) servers, where the bank controls authentication and limits access to balances and research, with no ability to move funds ^[1]. That controlled-access model already has a working precedent: Grasshopper Bank, partnering with Narmi, launched the first MCP server operated by a US bank in August 2025 and later became the first bank listed in Anthropic's MCP Directory ^[3][4], showing that bank-gated, permissioned AI access is technically live - just not the credential-sharing kind Meta's Muse was attempting. The emerging shape of 'safe' agentic banking, then, looks less like a personal assistant with your password and more like a scoped, bank-issued API key that a customer's AI can read from but not spend from.

The timing lines up with Meta's launch of Muse in September 2026, an agent that connects to more than 12,000 financial institutions via Plaid and can already read a user's full financial picture without yet moving money ^[12]. Apollo Global Management's chief economist Torsten Slok has warned that if AI agents are used broadly to chase yield, banks could lose a large share of the cheap deposits they rely on for lending ^[5]- a risk reporting pegs at roughly $1.6 trillion in non-interest-bearing deposits sitting at JPMorgan, Bank of America and Wells Fargo alone ^[2]. The incentive for households is stark: traditional checking accounts pay around 0.1% interest versus 3.3%-5.0% on some fintech cash platforms ^[6]. Not everyone buys the bank-run framing, though - former Morgan Stanley executive Jeff McMillan and M&T Bank's Rhea Rajwani both call a near-term, AI-triggered bank run unlikely, even as they agree AI will make deposit movements faster and more coordinated ^[7], while PSECU's Erin Hennessy takes the opposite view, calling a large-scale AI-driven deposit shift 'absolutely coming' ^[7].

Underneath the security rhetoric, the dispute banks keep coming back to is who is responsible when an agent gets it wrong. JPMorgan, Citigroup and Schwab have chosen to simply block credential-based third-party access rather than resolve that question case by case ^[1][8]. Wells Fargo has taken a different route: instead of blocking agents outright, it updated its Online Access Agreement, effective November 24, 2026, to state that requests made through third-party AI tools may be treated as if they came directly from the customer ^[8]- shifting the liability onto the account holder rather than the bank. JPMorgan CEO Jamie Dimon has been the most explicit about what that liability transfer actually means for a customer: handing an outside agent your credentials means 'they are in your bank and you're assuming they're going to act properly on your behalf and they may not' ^[9][10].

Dimon's objection isn't only financial - it's operational. He has warned against 'rogue agents' operating with live banking credentials outside the bank's view, noting there could eventually be 'thousands of them' acting on behalf of different customers at once ^[10]. That concern is now being echoed by supervisors: a Reuters report citing six people familiar with the matter found that US banking regulators are actively questioning banks about their AI model safeguards, how agent decisions get monitored and approved, whether a human stays in the loop, and whether a kill-switch exists to shut an agent down ^[11]. The parallel timing - banks announcing blocks in the same window regulators are asking these questions - suggests the industry is positioning itself ahead of rules that haven't been written yet rather than reacting to a single incident.