Schwab Is Blocking AI Agents That Move Money Without Permission
Charles Schwab is actively blocking unauthorized AI agents that try to move money for customers. President and CEO Richard A. Wurster said so on Oct. 16, 2026. The line is between automation a client approves and a third party starting transfers on its own. Bloomberg
Wurster, whose full name is Richard A. Wurster, has been President and CEO of The Charles Schwab Corporation and a member of its Board of Directors since January 1, 2025. About Schwab
Wurster said an AI agent should only trade for an investor if the investor gives it the "rules of the road." He said it in a discussion of agentic trading and the rise of AI-driven trading on platforms such as Robinhood and Coinbase. Permission comes first. Discretion comes second. Yahoo Finance
Earlier, Wurster joined Bloomberg TV to discuss how AI is helping Schwab. That appearance was posted on Feb. 20, 2026.
The broader context here is how brokerage systems handle delegated instructions, or orders passed along by another party. Unauthorized likely means agents working outside a credentialed, scoped authorization: no OAuth grant, which is a formal digital permission, no API key with defined entitlements, which is a coded pass with set powers, and no auditable delegation record you can review later. Blocking by default is the conservative posture. It preserves custody controls, authentication boundaries, and exception handling for failed or disputed transfers.
In my view, the operating question for custodians and brokers is allowlisting, or keeping an approved list of who gets in. Which agents get access, under what token scope, with what pre-trade limits, kill switches, and attribution in the order audit trail. The "rules of the road" idea maps to tools already in use: account-level permissions, symbol or asset-class restrictions, size and frequency limits, cash-movement destinations, and session controls. Enforcement has to sit server-side, on the broker's systems. Client-side prompts will not suffice.
Looking at what this means for platform strategy, expect friction around screen-scraped credentials and browser automation that mimics a logged-in user. Screen scraping means copying your login to act as you. For engineers and operations teams, that model breaks surveillance, breaks best-execution documentation, which is proof customers got a fair price, and complicates error resolution. A durable agentic model needs machine identity, delegated authority revocable by the principal, and machine-readable disclosure of when an agent acted. Until those primitives are standardized, default-deny for unauthenticated money movement is the predictable institutional response.
