Three of the largest institutions in American finance have quietly decided that AI agents can watch your money but may not move it. The policy shift, delivered across a single month of earnings calls and conference stages, could reshape the future of agentic finance before it has properly begun.
The Wall Goes Up
The biggest names in American banking have reached a rare consensus this autumn, and it is not good news for the companies building AI agents. Over three weeks, JPMorgan Chase, Charles Schwab and Citi each told the market that autonomous software acting on a customer's behalf will not be allowed to log in, move cash or execute transactions inside their systems. The message was blunt. AI agents can look, but they cannot touch.
JPMorgan chief executive Jamie Dimon set the tone on the bank's third quarter earnings call on October 13, warning that letting an outside agent operate inside the company was "too risky for clients and for JPMorgan." Two days later, Schwab chief executive Rick Wurster confirmed that the firm now blocks any agent trying to sign in with a client's credentials or drive its website through browser automation. Citi had already staked out the same ground. Speaking at the Sibos conference in Miami in late September, chief executive Jane Fraser argued that AI agents need rigorous identity checks before they touch a transaction, whether they act for a customer or for the bank itself.
The trigger was not abstract. Meta shipped a consumer agent called Muse in September that can shop, budget and carry out multi step tasks online, and a venture backed concierge named Instinct reportedly reached a ten billion dollar valuation on the promise of doing much the same. Suddenly the prospect of millions of customers pointing AI agents at their checking accounts stopped being a thought experiment and became an operational question the banks had to answer this quarter. You can read the banks' own framing in JPMorgan Chase and Charles Schwab investor materials.
Security Risk Or Turf War
The stated reason is safety, and the logic is not hard to follow. An agent that holds the keys to dozens of financial accounts is a concentrated target, and Dimon's warning about "rogue agents" numbering in the thousands captures a genuine fear inside bank risk departments. An autonomous system that can be manipulated, hijacked or simply instructed badly could drain balances faster than any human fraudster. Letting a third party collect login credentials and sign in on a customer's behalf is exactly the pattern security teams have spent a decade trying to eliminate.
Yet the economics complicate the story. Schwab earns a great deal of money on the cash its clients leave idle. Its sweep accounts held roughly 493 billion dollars, and those balances produced about 3.48 billion dollars in net interest revenue in a single quarter. An outside agent that worked purely for the customer would do the obvious thing and sweep that lazy cash into a higher yielding money market fund. As one industry consultant observed, an outside agent works for the client, while a bank's own assistant works for the bank. Wurster disputed the idea that cash was the motive, arguing that clients who use AI actually hold more cash because they trade more. The incentive, however, is impossible to ignore.
That tension explains why the banks are not simply banning the technology. They are redirecting it. Schwab is steering clients toward Charley, its in house assistant built on outside language models and the firm's own data. JPMorgan has launched a pilot of a tool called Smart Cash that projects a customer's cash flow needs and reallocates funds to optimise returns, the very behaviour it refuses to let an outside agent perform. The pattern is unmistakable. The banks want the agent relationship to run through them, not around them.
The Agentic Commerce Collision
This fight arrives at an awkward moment for the wider payments industry, which spent the past year racing to turn AI agents into spenders. Card networks built rails specifically so software could transact. Payment firms and AI labs published protocols meant to let an agent carry a verified mandate from a human and complete a purchase with no person clicking a button. The entire pitch of agentic commerce rests on one assumption, that the agent can reach the money.
Banks sit at the chokepoint of that vision. A shopping agent can fill a cart, but the funds still move through a deposit account or a card that a regulated institution controls. By drawing a hard line at account access, the largest deposit holders in the country have effectively told the agent economy that it will advance on their terms or not at all. For the startups whose business models depend on seeing and acting on a user's real balances, that is a direct hit to the roadmap, and it is why so many agentic finance pitches now feel suddenly fragile.
It also redraws the competitive map. If the only AI agents allowed deep access are the ones banks build or bless, then the institutions that already hold the deposits hold the customer's AI relationship too. The open and interoperable future that agent developers imagined starts to resemble a set of walled gardens, each guarded by a bank that decides which software earns a key. Independent coverage of that shift runs at Blumefield, where the clash between autonomous software and regulated money has become a recurring theme.
Liability, Identity And The Plumbing
Beneath the headlines sits an unresolved question of law and plumbing. When a customer authorises an agent to act and the agent makes a costly mistake, who pays? Dimon pointedly advised customers who hand access to outside agents to understand the risks and the potential shift in liability. Under existing consumer protection rules, a bank often absorbs the cost of unauthorised transactions. An instruction that a customer's own agent issued is not unauthorised in the usual sense, and no one has settled where that loss should land.
Identity is the other missing piece. Citi's answer is a governance platform it calls ARC, which every internal agent must pass through before it can operate. Fraser's point was that an agent must prove who it is and what it is permitted to do, with the same rigour a bank applies to any party initiating a transfer. Most of today's AI agents authenticate by impersonating the user, which is precisely the behaviour the banks are now refusing to accept.
There is a cleaner path, and it runs through open banking. Where a customer has authorised a data connector to hold their credentials, some AI agents can already retrieve balances on a read only basis, seeing the account without being able to move funds. United States regulators have been building toward exactly this kind of permissioned and revocable data sharing through the personal financial data rights framework. Read only access is the compromise on offer right now. The agents gain visibility, the banks keep control of the money, and the customer keeps a switch they can flip off at any time.
What Comes Next
The banks have bought themselves time, not a permanent settlement. Every one of them concedes that AI agents will eventually move money, and each is quietly building the infrastructure to let that happen on its own terms. Wurster expects Charley to become Schwab's primary access point, handling the full range of tasks by text or voice. JPMorgan says it has set no timetable for the safeguards that would open the door to outside agents, which is another way of saying the door is not locked forever. Even Citi frames its stance as governance rather than prohibition.
What the industry is really negotiating is the shape of the gate. The likely outcome is a tiered system, in which read only access flows relatively freely, low risk actions such as updating an address become routine, and the power to move funds stays tightly gated behind verified agent identity and a clear liability regime. The question of whose AI agents sit closest to the customer, the bank's or an independent one, will shape the next decade of consumer finance.
For now, the most powerful institutions in the country have answered the first question of the agent era in finance. They will let AI agents watch. They are not yet willing to let them spend. The companies betting their futures on software that can reach into a customer's account should read the signal plainly, because the gatekeepers have spoken, and the keys remain firmly on the banks' side of the counter. Follow the next moves in agentic finance at Blumefield.