Schwab and three big banks will not let AI agents move money

Charles Schwab blocks the big outside AI agents, Meta’s Muse among them, from moving client money, and its chief executive, Rick Wurster, told Bloomberg Television on Friday 16 October that the blocks run in the tens and twenties every week [1] [3]. On the earnings call the day before, Wurster said Schwab stops agents that log in to its systems with a client’s own credentials [1] [2]. Instead, Schwab will set up model context protocol servers, so a client’s own AI tool can check balances and do research but cannot move money [1] [3], and a push towards Charley, its own assistant [1] [2].

Schwab was one of four in a single week. Jamie Dimon, JPMorgan Chase’s chief executive, told analysts on the bank’s earnings call on Tuesday 13 October that outside agents would not get inside the bank, and warned of rogue agents [1] [2] [3]. JPMorgan lets authorised third-party tools read account data but not send money or pay bills [1] [3]. By Friday, the Financial Times had reported that Citigroup and Bank of America were restricting agent access to customer accounts as well [3] [4].

On the desk’s reading, all four banks are closing the same door. An agent that holds a customer’s password and drives the website is indistinguishable from the customer, so no bank can scope it, cap it or say who carries a loss. Wurster put it to Bloomberg as a question, asking who is liable if something goes wrong [1]. The route all four keep open is the scoped, read-only one, and it cannot move money.

The FCA wants a framework for agent identity and delegated authority

On Monday 19 October Jessica Rusu, the Financial Conduct Authority’s chief data, information and intelligence officer, told Bloomberg’s UK Policy Series that the regulator will build a framework for agentic finance with industry, other regulators and frontier labs, covering agent identity, delegated authority, accountability and execution [5] [6]. She said the major-incident reports that firms already owe the FCA must extend to significant AI failures and near-misses [5] [6], and that agentic systems need continuous, conditional assurance, because a system that is safe at deployment can behave differently at scale or when the model underneath it changes [5] [6]. The FCA published examples of good and poor AI practice the same day [5] [6].

Rusu’s four headings are the questions the US banks answered by refusing. An agentic commerce rulebook that settles who the agent is and what it was allowed to do would also answer Wurster’s question about who is liable. The speech gives no date for it [5].

Proof and Circle show identity and payment in one exchange

Proof and Circle Internet Group said on 19 October that they will show an AI agent completing an identity-gated purchase at Money20/20 in Las Vegas [7] [8] [9]. The merchant answers the agent with two requests: one over x401, Proof’s open identity protocol, naming the proof of identity it needs, and one over x402 for payment in USDC [7] [8]. The agent’s Proof wallet presents the person’s verified credential with a signed approval for that one purchase, the merchant checks the signature against Proof’s published keys, and the agent pays in USDC from a Circle Agent Wallet [7] [8]. The merchant keeps signed evidence of who approved the purchase for any later dispute, without holding a full copy of the buyer’s ID [7] [9].

Pat Kinsel, Proof’s chief executive, said the point of the demo was to give businesses “a reason to say yes to agents instead of blocking them” [7] [8]. The release describes a demonstration at a trade show [7] [9]. The approval travels with the purchase and is checked by the merchant, outside the agent, which is where the desk’s answer on spending limits says a limit has to sit before it means anything.

The demo runs at Proof’s booth, number 5069, until Money20/20 closes on 21 October [7] [9].