Schwab is blocking Meta’s Muse. JPMorgan sees “rogue agents.” Citi, BofA, and Wells Fargo have all picked their own path. With no federal law in sight, Wall Street has invented its own rules for the AI agent economy—and the clock is ticking.
Last Thursday, Charles Schwab CEO Rick Wurster appeared on Bloomberg Television and revealed something most of his peers had only muttered internally: every week, his bank gets a report showing AI agents—including Meta’s flagship Muse assistant—attempting to access and move client money. And every week, Schwab blocks them. The number? “Tens and twenties” per week, Wurster said. Not hundreds, not thousands. But enough to matter. Enough to have built a system around stopping it.
“We can’t control it, the client can’t control it,” Wurster said. “Something could go wrong—and who’s liable?”
That question—who is liable—is the one nobody in Washington has answered. And while Congress debates three separate AI agent liability bills, all stalled in committee, the five largest US banks have quietly started writing their own answer.
The Week Wall Street Decided
In a span of four days last week, the C-suites of America’s biggest financial institutions each staked out their position on AI agents—and the positions vary enough to matter.
JPMorgan Chase: On its October 13 earnings call, CEO Jamie Dimon drew the sharpest line. “There’s a liability transfer,” he said, warning customers that using outside agents means taking on the risk personally. JPMorgan won’t let any outside agent access account systems for now—though it allows some third-party tools to view account data in read-only mode.
Charles Schwab: Wurster announced on October 16 that Schwab blocks unauthorized agents from moving client money, full stop. This explicitly names Meta’s Muse as one of the agents being blocked. But Schwab is building a path forward: Model Context Protocol (MCP) servers that let outside AI tools connect to Schwab’s systems with read-only access—enough to check balances and run research, but not to execute trades. Clients who want AI-driven trading are being steered toward “Charley,” Schwab’s own AI assistant, announced September 30.
Citigroup: In a statement to the Financial Times on October 16, Citi announced it will not permit “third-party AI agents or assistants to log into a customer’s account” or transact directly on its platforms. No exceptions named. No transition plan offered.
Bank of America: CEO Brian Moynihan took a softer tone on the October 14 earnings call, signaling that BofA is working with agent providers to ensure “the human remains in the loop before money is moved out of their account.” Moynihan notably declined to frame this as blocking—calling it collaboration.
Wells Fargo: The outlier. Rather than blocking agents, Wells Fargo rewrote its Online Access Agreement, effective November 24, 2026, to shift liability to customers. Under the new terms, requests sent through a third-party AI tool “may be treated as if they came directly from you.” The customer carries the risk. The bank gets out from under it.
Why “Private Ordering” Is the Strategy
Legal scholars have a term for what the banks are doing: private ordering. When regulators won’t or can’t set the rules, private actors write their own—and those rules become the de facto standard.
In financial services, private ordering is nothing new. Card networks wrote their own fraud liability rules. ACH networks developed their own error-resolution frameworks. The difference now is speed: AI agents are already attempting to move money, and the legal framework to govern them doesn’t exist yet.
Three bills are currently working through Congress. The Warner AI AGENT Act would establish minimum standards for autonomous financial agents. The Hawley-Murphy AI Agent Accountability Act would require agents to disclose their actions in real time. The Great American AI Act takes a broader approach to agent liability across sectors. All three have stalled in committee. The Department of Justice has taken a hands-off approach to standalone AI enforcement.
In that vacuum, the banks are setting the terms. And the terms break down roughly into three models:
Block and build your own (Schwab): Stop outside agents entirely; develop proprietary AI tools; offer controlled read-only API access as a path forward.
Block and hold (JPMorgan, Citi): No outside agents in the door, period, until the liability question is resolved.
Collaborate and watch (Bank of America): Work with agent developers to enforce human approval steps before money moves.
Contractually offload (Wells Fargo): Allow agents in, but make the customer legally responsible for whatever happens.
The MCP Problem
Schwab’s pivot to Model Context Protocol as the safe middle ground may turn out to be more complicated than it looks. MCP—the protocol that lets AI assistants communicate securely with external services—has had its own security issues. Earlier this year, both Google and JPMorgan patched the same MCP vulnerability, one that allowed a compromised server to impersonate a trusted service. If banks build their financial access infrastructure on MCP, the security of that access is only as good as MCP’s security guarantees.
The irony is hard to miss: JPMorgan patched an MCP vulnerability while simultaneously announcing it won’t let outside agents into its systems. Schwab is building MCP-based connections as the “safe” alternative to unsanctioned agent access—even as MCP’s own track record is being written in real time.
Who Gets Blocked, and Why It Matters
The agent being most visibly blocked is Meta’s Muse—the AI assistant announced alongside the 816-billion-parameter Muse Spark Open model released earlier this month. Muse is designed to “book, buy, and negotiate” on a user’s behalf. Financial transactions are a natural use case. Banks see them as an unacceptable liability.
From Meta’s perspective, this is a significant constraint. If Muse can search the web, book flights, and negotiate contracts but can’t access a user’s bank account without a human sign-off, the agentic vision Meta has been selling—an AI that handles your life end-to-end—runs into a wall the moment money has to move.
For users, the practical effect is a fragmented experience. An agent can check your Schwab balance and run a stock screen. It cannot execute the trade. It can tell you your mortgage payment is due. It cannot pay it. The “human in the loop” that banks are demanding is not a technical constraint—it’s a policy choice, driven by liability, that is now being encoded into the architecture of how AI agents interact with financial infrastructure.
What Comes Next
Two things are likely to change the current picture: a federal decision or a major incident.
If Congress resolves the liability question—even partially—the banks’ private ordering frameworks will either align with the rules or need to be rewritten. Schwab’s CEO has already said the company would open more access if liability is clarified. Dimon has consistently tied JPMorgan’s caution to the absence of legal clarity.
The other catalyst is messier: a large, public AI agent failure involving someone’s money. An unauthorized transaction executed by a compromised agent. A portfolio disruption triggered by an agent acting on bad data. These are the scenarios the banks are pricing in—and the ones that would immediately accelerate both federal legislation and industry coordination.
For now, the most advanced AI systems in history are allowed to look at your portfolio. They’re not allowed to touch it. Whether that balance holds depends less on technology than on how quickly Washington decides who pays when it doesn’t.
Sources: Bloomberg Television (Oct 16, 2026); Yahoo Finance / Priya Nair (Oct 17, 2026); The Next Web (Oct 17, 2026); cellcog.ai Bank-by-Bank AI Agent Policy Tracker (Oct 18, 2026); Wells Fargo Online Access Agreement (effective Nov 24, 2026)
