Executive Summary

Key Figures

Sources: Schwab's third-quarter results release, and reporting by American Banker and Oninvest.

Charles Schwab is a large U.S. brokerage. It holds tens of millions of accounts in which ordinary people buy and sell stocks and keep retirement money, and at the end of September the cash sitting in those accounts waiting to be invested came to $492.8 billion. On October 15, on the call for its third-quarter results, chief executive Rick Wurster set out one rule about those accounts.

His sentence carried a clear condition. Schwab wants to deliver AI to clients in a safe and secure way, he said, and there is one way he does not think is safe: "just an agent coming to our site and trying to log in on behalf of a client. We are not going to allow that." That is where the line falls: on the way in, not on AI itself. The route Schwab closes is the one where a client hands an ID and a password to an outside program and that program works the screen as though it were a person.

The next day, in a Bloomberg Television interview, Wurster added the size of it. He gets a weekly report on the blocks, and the big agents are stopped in the tens and twenties each week. Not hundreds, not thousands. He read the number this way: people like AI, but they are not yet ready to hand over a financial account whole.

The case for blocking is all in one example Wurster reached for: Muse, Meta's personal AI assistant. He described a client giving Muse a password and letting it act on their behalf, and then asked what follows: "We can't control it, the client can't control it, something could go wrong and who's liable?" Schwab will not allow it, he said, to protect the client and to protect Schwab.

The decision was not Schwab's alone. Over the four days from October 13 to 16, when the third-quarter results of the large U.S. financial firms were stacked together, five of them said in turn how they would treat outside AI agents. They answered the same question, and the answers did not come out the same shape.

Read the table down the page and the differences in temperature show. Citi closes both logging in and transacting. JPMorgan says it will not take outside agents into its own systems while account data is already open to third-party tools. Bank of America sets a condition, a person in the loop, rather than a block. Wells Fargo left the door alone and changed the sentences around it. One Bogleheads forum member compared the two versions and counted the word "AI" 44 times in the agreement that takes effect on November 24. The May 21 version had it once.

There is an earlier event behind the cluster. Meta released Muse, its personal AI assistant, on September 8. Tell it what you want in conversation and it sorts mail, books appointments and orders things; within a week of launch it was the top free app in the U.S. App Store, and on the night of September 20 Amazon blocked it from buying, citing a breach of its conditions of use. Pebblous covered that block once already, in an article that read it as a question of contract. This is the second front to branch from the same trigger, and the weight is different, because what sits behind the door is not an order button but an account with money in it.

The reason the five gave in public is broadly the same: security and liability. If an outside program comes in on a client's credentials and moves money, and the instruction turns out not to be what the client meant, who covers the loss? U.S. law as it stands gives no clear answer. According to the reporting, people at the Federal Reserve privately support what the banks have done while holding that the law needs to settle how a customer authorizes an autonomous system and where liability falls when something goes wrong. That legislation does not exist yet.

A different number runs alongside the same reporting. A bank that takes in outside agents stands to lose more than legal costs. JPMorgan, Bank of America and Wells Fargo hold $1.6 trillion in deposits that pay no interest, which is 16% of their combined liabilities. It is money customers leave in checking accounts earning next to nothing, and for the banks it is the cheapest funding they have.

That money earns close to nothing right now. The average U.S. checking account pays 0.1% a year. Move it into an account that pays interest and it earns 3.3% to 5.0%. Those are the two numbers the reporting sets side by side. The gap is not new, and customers were not unaware of it. Moving simply meant a person opening another account and setting up a transfer.

It is not hard to picture what an AI assistant could do with that money. Reading a balance and walking it over to a better rate is the kind of errand an agent is good at, and the kind a person keeps putting off. Torsten Slok, chief economist at Apollo, assumed 3% a year on that $1.6 trillion and put the extra annual cost to the three banks at $47 billion.

There are two reasons not to read that $47 billion straight. One is that it is a ceiling. It assumes every dollar of those deposits moves, and it is not a forecast of how much actually will. The other is scope. Schwab is not in the total. The figure that sits in the same place on Schwab's side is $492.8 billion in client cash balances, and most of the quarter's $3.5 billion in net interest revenue came from there. The rate assumption leans the other way: the 3% Slok used is lower than the 3.3% to 5.0% quoted above. The size of the move is assumed to be everything while the rate is held low.

Something remains after both caveats. The company deciding to keep outside agents out is the same company whose funding cost that decision protects. That does not make the security argument false. The liability problem is real, and there are grounds for judging that handing a password to an outside program is precarious. But here the safe choice and the profitable choice point the same way, and from outside there is no instrument for telling which one drove the decision.

Wurster raised that reading himself and denied it. He said he knows one of the fears in the market about Schwab is that as AI takes off it will affect cash levels, and then said Schwab is seeing the opposite: "the more people use AI, the more cash they hold because they're more active in buying stocks." Whether that holds cannot be checked from outside Schwab. Still, it is worth recording that in the same setting where he announced the block, the party concerned named the deposit-flight motive first and denied it.

Among the five, Schwab's response is worth a closer look because it did not stop at blocking. In the same breath as closing outside logins, Wurster named two alternatives. One is Charley, the AI assistant Schwab built for itself. The other is a separate channel that lets outside AI models reach Schwab data.

Charley was introduced on September 30. It is an assistant built on an outside large language model with Schwab's own data laid on top, and what it can do today is narrow. Administrative tasks "like changing an address or naming a trusted contact," plus finding and organizing information, is the whole of it. It does not trade. Wurster said Charley will eventually "give you the full range of things you can do on schwab.com and be able to do anything through a conversation via either text or voice," and that over time he expects it to be the primary way to connect to AI at Schwab. The rollout started in October, in stages, with eligible U.S. retail clients. The blocking already runs; the thing clients are pointed to instead is still opening.

The second alternative matters more. Schwab is preparing an MCP server. MCP is the common specification AI models use when they connect to outside data and tools. Instead of imitating a person and working the screen, the model sends requests in a set form to a set window and takes answers back. Through that window Schwab says it will open balances and research. Moving money is not on the list.

The difference between the two routes is less about technology than about who holds the design. An agent handed a password can do everything the client can do, because it inherits the client's authority whole. The MCP window does not work that way. Whoever opened the window sets in advance what may be asked and what may not. Saying Schwab opened balances and closed transfers means that line now lives in Schwab's configuration rather than in the client's resolve.

Nor is that line drawn between reading and writing. According to American Banker, Schwab already lets certain large language models connect and execute trades, and ChatGPT is among them. Wurster said more clients and more models will be given the ability to trade, and that what stays out is the ability to "move money, because we think there's too much risk there to the client and to the firm." The writing that buys and sells stock is open. Only the writing that sends money out of the account is shut.

Schwab's third-quarter release carries two AI items. One is Charley. The other is a partnership with Anthropic to bring Claude for Financial Advisors to the independent advisory firms Schwab serves. In the very document that says outside agents may not log in, Schwab is placing models of its own choosing in front of clients and advisers. What is blocked is not AI. It is the AI Schwab did not pick.

What we take from this episode is not a forecast about financial regulation. When the right to hand my data to an agent I chose runs into a window the platform controls, these four days showed fairly clearly which side wins.

An account balance is my data. The decision to let my AI assistant read it is, in principle, mine. Whether that is actually possible is Schwab's to decide. The boundary that lets the MCP window reach balances and no further, the distinction that allows Charley and refuses Muse, even the specification of the channel that gets opened, are all designed by Schwab. A customer can say the data is theirs to hand over, and with no channel to hand it through the sentence does not hold.

Amazon showed the same structure a month earlier. What Amazon reached for then was not the law on computer intrusion but the terms its customers had already accepted. This time too, the firm that went furthest is not one of the banks that announced a block but Wells Fargo, which rewrote its agreement. A sentence that handles a request arriving through a third-party AI tool as the customer's own, and puts the duty of managing that tool on the customer, does not lock the door. It hands the customer the consequences of everything that passes through it. The boundary of access is being drawn in contracts rather than in code.

Looked at from the side that handles data, the next problem comes into view. Five firms gave five answers. One opens read access, one sets a human approval, one shifts the liability by contract. A customer's agent meets a different rule depending on who is on the other side. This is not going to stay in finance. Medical records, telecom usage history, internal work systems: the same questions come up in the same order. Who is coming in, what are they allowed to do, and who answers when it goes wrong.

Three things are worth checking inside your own organization.

• • How many routes do outside agents have to our data — counting the official integrations is not enough. The paths where customers or employees hand over credentials usually never reach a tally. That Schwab counts those blocks in a weekly report is the most practical detail in this episode
• • Can the record tell a person from an agent — start by checking whether the access log even has a field for that distinction. If there is no field, there is nothing to settle the question with later, and access you cannot count is access you cannot govern by policy
• • Who wrote the boundary down, and where — Schwab wrote its boundary into the specification of an MCP window, and that line does not sit between reading and writing. Stock orders are open and only money leaving the account is shut. A boundary that lives in a policy document and not in the system does not hold in front of an agent

One more thing is worth adding. It is hard to say the banks took a right away from their customers. Handing a password to an outside program really is precarious, and there are grounds for closing that route. The fact remains that in closing it, the same side also took the authority to set the width of the new one. The seat where data access gets designed in the age of agents is not sitting empty. The party holding the data is already in it, and its own interests are sitting there too.

Thank you for reading this far. The facts here were checked against Schwab's third-quarter results release and reporting including American Banker, and the internal standards each bank has not published are not covered here. If you have an example of granting an outside agent access to your data and writing down where the boundary sits, we would be glad to hear it.

Pebblous Data Communication Team
October 18, 2026

Schwab's Announcements and the Reporting

• 1.American Banker. (2026). "Schwab blocks unauthorized AI agents, points clients to Charley." (Primary source for sections 1 and 4: Wurster's remarks, Charley's range, trades already open to some LLMs)
• 2.The Next Web. (2026). "Schwab and JPMorgan are blocking AI agents from moving customer money." (Sections 1 and 4: the weekly block count, what the MCP server opens and closes, Meta's Muse named)
• 3.The Charles Schwab Corporation. (2026). "Schwab delivers record net new assets & earnings (third-quarter 2026 results)." (Sections 1, 3 and 4: $492.8 billion in client cash balances, net interest revenue, the two AI items listed together)
• 4.The Charles Schwab Corporation. (2026). "Meet Charley, Schwab's New AI-Powered Assistant Designed to Help Clients Get Answers and Take Action." (Section 4: introduced September 30, 2026, rolling out from October to eligible U.S. retail clients)

Bank Responses and the Deposit Estimate

• 5.Oninvest. (2026). "Citigroup and BofA are the latest U.S. banks to restrict AI agents from accessing client accounts." (Primary source for sections 2 and 3: the Citi and BofA positions, $1.6 trillion and the $47 billion estimate, the regulators' private view)
• 6.TheStreet. (2026). "JPMorgan stock: Dimon warns on AI bank access." (Section 2: Dimon's remarks and what JPMorgan currently leaves open)
• 7.Cellcog. (2026). "US banks vs AI agents: who blocks what, bank by bank." (Section 2: cross-checking the dates of the five announcements. An industry roundup, not a primary source)

Terms of Service and What Came Before

• 8.Wells Fargo. (2026). "We are updating our Online Access Agreement." (Sections 2 and 5: the revision effective November 24 and its third-party AI tool clauses)
• 9.Bogleheads forum. (2026). "Wells Fargo Bank updates its Online Access Agreement for AI." (Section 2: the count of "AI" mentions in the new agreement against the old one. A forum member's tally, not the bank's)
• 10.Pebblous Blog. (2026). "Can a Store Block the AI That Shops for You?." (Sections 2 and 5: Amazon's block on Muse a month earlier, from the same trigger)