Analysis
JPMorgan, Schwab, BofA and Citi locked the door. Wells Fargo rewrote the contract instead — and that tells you where the real problem sits.
Between October 13 and October 16, 2026, JPMorgan Chase, Bank of America, Citi, Schwab, and Wells Fargo moved to restrict third-party AI agents from accessing customer accounts. In a span of three days, the financial sector erected a digital wall, creating a banking twin to the access tax Amazon imposed on Meta’s Muse agent months earlier.
The Wall Rises
The precedent for this exclusion was set in September, when Amazon blocked Meta’s Muse agent, citing unauthorized access and credential capture. That incident highlighted the friction inherent in the fragmenting gate of the digital economy. Just as retailers struggled to verify agent identity – often finding that tools like Muse presented as ordinary browsers to bypass detection – banks are now deciding that the risk of autonomous actors is too high to manage.
Seven months after Mastercard and Santander completed Europe’s first live agent payment, the trust layer is still under construction, and the banks stopped waiting for it. While the technology promises efficiency, the banks are choosing to lock their doors while federal legislation, such as the Hawley-Murphy AI Agent Accountability Act and Warner’s AI AGENT Act, remains stalled at introduction stage.
Four Blocks and a Contract
The response from the banking sector has been bifurcated. Four major institutions have opted for hard blocks, while one has chosen to rewrite the terms of engagement.
JPMorgan Chase led. During the bank’s Q3 earnings call on October 13, CEO Jamie Dimon was explicit about the perceived threat: “We’re not going to allow just any … outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan.” He added: “You don’t want rogue agents, and it could be thousands of them.” Dimon concluded: “If people are using them, they should understand the risk. They should understand there’s a liability transfer.”
A JPMorgan spokeswoman clarified the operational reality to CNBC: “Because it is not safe, we do not permit third parties to access accounts by obtaining customers’ banking credentials and logging in on their behalf.” Read-only data access remains available through connectors like Plaid, but agents are barred from sending money or paying bills – the actions that make an agent useful, as CNBC noted. There is no timeline for when the bank would have safeguards in place to allow direct interaction.
Other institutions followed:
- Schwab: CEO Rick Wurster confirmed the firm is blocking unauthorized AI agents – including Meta’s Muse – from moving client money. Wurster said he receives a weekly report showing big agents blocked “in the tens and twenties” each week. “We can’t control it, the client can’t control it, something could go wrong and who’s liable?” Schwab plans controlled MCP read-only connections so outside tools can view balances and conduct research but cannot move money.
- Bank of America: CEO Brian Moynihan stated: “We strongly believe there should be a human in the loop to authorise money moving out of your account.” BofA is restricting agent access to consumer deposits and working with developers on liability protocols for AI-authorized payments.
- Citi: The bank does not permit “third-party AI agents or assistants to log into a customer’s account or transact directly within our digital banking platforms,” while still allowing customers to grant certain open-banking services limited, read-only access.
Wells Fargo took a different path. Its new Online Access Agreement, effective November 24, 2026, does not implement an outright block. Instead, it introduces a full contract framework – Section 15, “Third-Party Artificial Intelligence Agents or Agentic AI” – that defines an AI Agent as any software that takes autonomous, semi-autonomous, or non-autonomous action on behalf of any person or entity, and places the burden squarely on the user: “Your use of any AI Agent is AT YOUR OWN RISK.” Under this agreement, all transactions initiated by an agent are deemed authorized by the customer. Wells Fargo disclaims responsibility for monitoring or reviewing agent activities and reserves the right to limit, restrict, or terminate access at any time.
The contrast is structural. Four banks said no. Wells Fargo said yes – and signed you to a contract that makes every mistake your own.
The Economics of Exclusion
The motivation for these moves runs deeper than security theatre. JPMorgan, Bank of America, and Wells Fargo hold approximately $1.6 trillion in non-interest-bearing deposits, about 16 percent of their combined liabilities. Paying even 3 percent on that base would cost roughly $47 billion annually – nearly half the trio’s combined yearly earnings, according to the Financial Times. In September, bank stocks fell when Meta’s Muse agent topped app download charts, sparking fears that consumers would use agents to move funds from low-yielding accounts to higher-yielding ones.
The banks are responding with defensive products of their own. JPMorgan is piloting Smart Cash, an internal AI tool to forecast cash flow and move funds to maximize yield. Schwab is promoting Charley, its own assistant. The pattern is familiar: block the outside agent, build the inside one.
The Liability Nobody Answers
The unresolved question is who pays when the agent gets it wrong. Dimon called it a “liability transfer” to the customer. Wurster asked “who’s liable?” Moynihan is developing protocols with agent developers to find out. Fed officials have privately welcomed the banks’ moves and said legal clarification may be needed, the FT reported.
Two pending federal bills – the Hawley-Murphy AI Agent Accountability Act, which would hold AI agent operators and developers liable under the Computer Fraud and Abuse Act for hacking incidents, and Warner’s AI AGENT Act (S.5051), which would create a framework for consumer-facing AI agent platform access – remain stalled at introduction stage. No banking-specific statute exists.
For now, read-only access is the ceiling. Agents can see your balance but cannot pay your bills. The door to the financial core is closed – and the liability for what happens on either side of it remains unassigned.