US Banks Block Third-Party AI Agents, Open Read-Only Access via Model Context Protocol
Major US financial institutions like Charles Schwab and JPMorgan have blocked direct access for third-party AI agents such as Meta Muse due to liability concerns. However, they are not cutting ties entirely; instead, they are using the Model Context Protocol (MCP) to provide read-only access to account balances and research data, establishing a new compliance paradigm that isolates write operations while allowing controlled data retrieval.
ImportanceMaterialEvidenceE3 inspectableWrite-upStandard
As autonomous AI agents become more capable, US financial infrastructure is redrawing the boundaries of interaction with external models. According to reports from IT Home, leading institutions including Charles Schwab, JPMorgan Chase, and Bank of America have recently tightened restrictions on third-party AI agents. Rick Wurster, CEO of Charles Schwab, told Bloomberg that they block various AI agents weekly and receive regular reports on these attempts. Jamie Dimon, CEO of JPMorgan, stated during an earnings call that no third-party agent is allowed unrestricted access to their systems, with a spokesperson adding that any agent attempting to log in with bank credentials would be rejected.
This blockade stems not from a rejection of AI technology, but from ambiguous liability. Wurster noted that neither banks nor customers can control these third-party agents, leaving no clear answer on who bears responsibility if something goes wrong. Consequently, financial institutions have adopted a more nuanced strategy: completely prohibiting agents from executing "write operations" like fund transfers or placing orders, while allowing information queries through dedicated interfaces.
In this context, the Model Context Protocol (MCP) has emerged as a key compromise. MCP is an open protocol designed to standardize connections between AI models and external data sources. Charles Schwab indicated that external models can query account balances and research materials via dedicated MCP servers but cannot execute any asset-moving operations. This architecture limits AI capabilities to a "read-only" scope, preserving the ability of agents to assist with analysis and information organization while severing the risk path of direct financial transaction intervention.