Update: Banks’ answer to AI agents is a read-only MCP server
The agent-blocking wave hits finance: Schwab and JPMorgan bar credential logins and money moves, steering agents to scoped connections and their own assistants.
Copy markdown
The new line: no credential logins, no money moves
Schwab blocks any outside agent that logs in with a client’s password or drives the browser — CEO Rick Wurster says it stops these “in the tens and twenties” every week — and JPMorgan’s Jamie Dimon says no third-party agent gets to act inside its systems. Meta’s Muse is the named target. If your agent authenticates as the user to move money, expect it to fail at both banks.
The sanctioned path is a bank-run MCP server
Schwab is standing up Model Context Protocol servers so a client’s chosen model connects under Schwab’s rules: check balances, do research, run sanctioned trades — but never move money. That’s the pattern to design for now, scoped bank-hosted MCP access, not credential replay or browser automation.
Plan for your agent to hand off, not finish
Both banks are steering users to their own agents — Schwab to Charley, its in-house assistant, with Claude for Advisors offered to RIAs via Schwab Advisor Services. Money movement stays with the bank. Build financial agents that read, research and prepare, then hand the final transaction to the bank’s own flow.
Watch the MCP attack surface
As banks converge on MCP, the server becomes the target. American Banker reports Google and JPMorgan just patched an SSRF flaw in MCP. If you build or host MCP servers for financial data, audit for SSRF and lock down outbound requests before you ship.