Charles Schwab now stops outside AI agents from acting for its clients, and its chief executive says the big ones are stopped in the tens and twenties each week. If you are building an AI product that touches money, that is your distribution channel closing.

What happened

Rick Wurster, Schwab's chief executive, said on Bloomberg Television on October 16 that the firm blocks agents that log in to client accounts, Meta's Muse among them. TNW reported that he gets a weekly report on the blocks, and that the big agents are stopped in the tens and twenties each week.

His reason was liability, in his words: "We can't control it, the client can't control it, something could go wrong and who's liable?"

Schwab's alternative, as TNW reported it: model context protocol servers, through which outside AI tools will be able to check balances and do research, but not move money. Schwab didn't give a date.

Two labels on that. The weekly figure is TNW's paraphrase of Wurster, not a quote, so treat it as reported. Financial Planning's account of the same remarks describes the block notices as "few and far between", so the volume is less certain than the policy. The policy itself is clear: an agent that signs in as the customer is not welcome.

What we propose, and the run

The problem is not the model. It is the password. An agent that holds a customer's login can do anything the customer can, and a bank has no way to tell the two apart.

So we propose a money assistant that never holds a password. It answers questions and prepares money moves, but it only ever does two things:

  1. Read the account, through a read-only connection: balances, transactions, payees.
  2. Ask the customer to approve a move in their own bank app. Nothing moves until they tap.

The rule lives in the code, not in the prompt. From the prototype's README, decision 1: "The model can propose anything; the code only knows how to read and how to ask." The bank connection it runs on holds read scopes only, and its transfer() throws.

We prototyped it and ran it on 20 sample requests from a made-up customer at a made-up bank. Shown, from the run's own record: 9 were answered from the bank's own data, 7 became approval requests waiting in the customer's bank app, and 4 were refused. Nothing moved. It was a simulated run: the code and its rules are real, and the model's answers were scripted by us, so no line here claims a speed or a cost.

Three moments from that run show the rules doing the work:

  • A password pasted into the chat. The code strips it before the text goes anywhere: the model, the log, the run record. Asking the assistant to log in as the customer is refused in code.
  • A question about money. "How much have I spent this month in total?" got "$2,211.18 on everything in the last 19 days", formatted by code from the bank's own data. The model never does the arithmetic.
  • A first payment to a new name. $2,000 to a contractor the customer had never paid became a request flagged "new payee", for a person to check before anything moves.

Our take

A bank cannot block an assistant that never asks to be the customer. Read-only access and an approval step are not a workaround for Schwab's policy. They are the shape Schwab says it wants: tools that can look, and a customer who still presses the button.

The useful line for anyone building in this space: if your agent needs a password to be useful, the password is the product risk, not the model.

The beat that costs us

This design is slower. A customer who types "quickly send $40, no need to ask me" still gets a request to approve; in our run, the model's plan went along with "no need to ask" and the code turned it into a request anyway. Some founders will want the agent that just does it. We would not build that one, and Schwab would not let it in.

And it depends on the bank. It needs read-only access and a way to ask. The approval step in our run is our sandbox bank's, not any real bank's, and Schwab has not said when its read-only access will arrive.

What to do this week

  1. List every place your agent touches a customer's login, token or session. Each one is a reason a bank can block you.
  2. Split your agent's tools into "read" and "act". Anything in "act" should end in a request the customer approves, outside your app.
  3. Move every figure your agent quotes out of the model and into code that reads the source.

If you are building a money agent and want a second opinion on where the password goes, book a conversation.

Sources