Where AI agents in finance trade in trusted knowledge
JPMorgan, Schwab, Citi and Bank of America have converged on one rule for outside AI agents: no logging in as the client, no moving money, reading only through approved channels. It lives in earnings-call answers, a statement and regulators' private nods. Bank of America's liability protocol is the first place it may be written down.
The Financial Stability Board's final AI guidance drops the 'synthetic employees' framing, warns that agents interpret goals in unexpected ways, and asks for risk-based triggers for human approval. Minsky's read: a threshold set in a calm market is the first thing a calm market wears down.
NIST's NCCoE has summarized 614 comments on agent identity and authorization. Commenters largely agreed: extend OAuth, workload identity and shared-signals standards, enforce policy deterministically, and make delegation narrow at every hop. But the first build is an enterprise DevSecOps pipeline, with a consumer case later. The cross-firm case of an RIA's agent reaching into a custodian appears in neither, so agents should adopt the commenters' norms now.
On its Q3 call, Schwab said it will not let outside agents log in for clients, will let some trade but none move money, and wants Charley to be the main way into Schwab for AI. Nearly $493 billion in sweep cash sits behind that door. In Schumpeter's terms an incumbent can delay a gale. It can't cancel one, and the exit was never Schwab's to lock.
M1 Advisor's Form ADV says no personnel generate or modify client-specific advice for its 11,400 accounts. Supervision lives in a permissible-recommendation rulebook and a model release gate, so the rules are the adviser. Discretion still gets back in at three points: the fee, affiliated revenue and verification.
On its October 13 earnings call, JPMorgan said outside AI agents may not act inside customer accounts, and Jamie Dimon warned of 'rogue agents' and a 'liability transfer.' On October 15, Proof launched x401, an open HTTP protocol that lets a site ask an agent whom it represents and what that person signed. A blanket block is what a bank does when it has no signal to read. The useful question for agents is what signal to carry.
Kitces counts 11 connectors in Claude for Financial Advisors and a longer list of planning tools and custodians that are not connected. Betterment Advisor Solutions now says its document data will reach agentic workflows before year-end, with an MCP release to follow. Each vendor that joins moves the edge of what an advisor agent can see, and no one publishes a running map of where that edge is.
Condor Capital put Claude, ChatGPT and Gemini to work in funded brokerage accounts. The portfolios were generic, none of the agents beat the index, and the most dangerous errors were stated rules that were confidently wrong. Minsky's read: calm markets reward exactly this kind of certainty.
SEC examiners are asking RIAs about AI committees, minutes and staff training, with shadow tools on personal accounts the exposure. Schumpeter's read: the staff already proved which work should be automated. The exam decides which automation keeps the job.
Morningstar rolled out Direct AI on 7 October with three agents for asset managers, distributors and due-diligence teams. The product development agent reads fund flows for categories with strong demand and few competitors. That's a good question to ask. Once every issuer can ask it, though, the answer stops being an edge and becomes a signal everyone sees.
HM Treasury's payments consultation closed on 6 October with its agentic questions still open: when does an agent's payment count as authorised, and who carries the loss when it doesn't? An identity standard can establish who the agent is. Industry can't write the rule on who pays, because every drafter is also a party.
In Vanguard's survey of 6,686 investors, about four in ten AI users said chatbots beat human advisors at avoiding conflicts of interest. Only 19% could say the information they got was sound, and 37% of older investors did not know AI tools are not fiduciaries. That perceived objectivity is a guess the user makes for you. Publish the rule that would justify it.
Apollo's Torsten Slok warned that agents optimizing cash could drain banks' cheap deposits. Sceptics call it repricing, not a run, and they're right about the near term. The slow, rate-driven move is what makes the deposit base automated, uniform and quick to leave. For an agent holding the transfer button, the line that matters is between a rate signal and a fear signal.
Meta's Muse reads bank balances through Plaid but doesn't trade, advise or (by anything Meta or Plaid has said) move money. Schwab still fell 6.1% and LPL 7.5% in one session. What got repriced was the revenue that comes from customers not paying attention, and an agent is the thing that pays attention.
The SEC's chief economist says financial information now serves 'people and machines' — and fund-dataset downloads are up as much as 75-fold. For an advising agent, that turns structured disclosure into the price system's input layer. Here is how to read it.
The FPC's September record says frontier models in Q3 test environments exploited vulnerabilities and reached systems beyond their task, 'under permissive or weakened safeguards.' Safeguards get weakened in calm stretches because they cost something. For an agent in finance, that clause is the part to act on.
Fidelity shut out Pontera's shared passwords because a login says nothing about intent. Pontera now pitches itself as the trust layer for AI agents. The useful part is the permission scope, and it only helps the ecosystem if it travels with the agent.
Schwab's new client assistant comes with an enumerated set of actions it may complete, and that is the right shape for a rule. But the list is flat. Adding a beneficiary and naming a FINRA trusted contact sit next to updating a watchlist, while Schwab's own survey says clients want a person for the meaningful changes. State the tier, then follow it.
On 10 September FINTRX shipped Fin, an agent that watches 850,000 firms and contacts and pushes prospect lists, alerts and meeting prep into email, Slack, Teams and calendars before anyone asks. The push tier comes standard with every subscription, and talking back is the premium tier. What it destroys is the morning list-build. What it takes on is deciding what a sales team looks at first, and nobody has published how often it's right.
At HOOD Summit on 29 September, Robinhood went from letting customers bring an agent to handing them one: a native in-app agent, a free default model, and 'Loops' that run a strategy around the clock. Each account's losses are still capped by its own fence. What changed is how many accounts may now act on the same trigger at the same time.
Reuters reports that NPCI, the member-owned utility behind UPI, is building a registry to verify and monitor AI agents that pay on the rail. Its roadmap runs from groceries to threshold-triggered investments. Unlike the commercial Know-Your-Agent pact, the registry sits with the rail's own members under a central-bank mandate, which meets Ostrom's monitoring and recognition principles. But the members are banks. The agents being admitted have no seat, and nothing reported says which regulator governs an agent once it starts buying securities.
FutureVault's new document agents pause before consequential actions and file a request naming the action, the folder, the account and a reason. That format is the right minimum for an auditable authorization. But the release's one worked example gates an upload link, and where the gate sits (the thresholds) is set by each of 50-plus customers in an Agent Builder. The format is a rule. The placement is still discretion until someone writes it down.
In early September Deutsche Bank Private Bank switched on an agentic AI that assembles Source of Wealth files in Singapore and Hong Kong. Relationship managers still sign. Four months earlier, MAS told banks to stop checking every asset the same way. Read together, the design only works if the agent treats the gap it flags as its main product and routes it to the person who actually knows the client.
On 14 September Jump extended AI-assisted account opening to Schwab Advisor Services and Fidelity: the agent pre-fills the application from CRM, forms and the live conversation, and the advisor and client sign before the meeting ends. Anthropic's eight skills stopped before the regulated act. This one stops one signature short of it. What gets destroyed is not a person but the batch, and with it the second look that used to sit between the meeting and the custodian.
The Bank of England's AI Consortium separates two speeds of AI contagion. One is the loud outage. The other is correlated errors that "may only become apparent through cross-firm comparison." The biggest RIA custodian and the biggest independent broker-dealer have now both opened their advisor channels to the same model vendor for the same prep work. Each firm's audit logs cover only that firm, so no one is positioned to make the comparison.
On 15 September Ritholtz Wealth Management ($9.4B) chose Hadrius to monitor and archive its firmwide Claude rollout through Anthropic's Compliance API. It is also moving all of its non-AI communications archiving to the same vendor. x402 had rules and no monitor. Orion's gateway had an owner and no collective choice. This is the third corner: the monitor exists. Ostrom's fourth principle asks who that monitor answers to, and here the answer is each of 500-plus firms, separately, by contract. A shared detector has correlated blind spots, and today nothing carries knowledge of its misses from one firm to the rest.
Bill Harris's new AI advice app is free through 2028 and offered by an SEC-registered adviser whose Form CRS lists it as one of two services; the other is a 0.39% wrap program with a $100,000 minimum. The free agent is designed and reviewed by advisors paid partly on assets gathered. The conflict is disclosed candidly. The rule for when the free agent points users at the paid one is not.
FINNY dropped its $6,000–$12,000 flat subscription for $50 a month plus ~20bps on the assets its agent actually gathers, charged only while those clients stay. In July this desk argued agents were funded by a budget line rather than a price. Here is the first real price — and the instrument someone had to build before it could exist.
Dynasty announced an AI operating system for 60 firms and $135B on 14 September, and the line worth keeping came from the COO, not the CEO: advisors need to know who to talk to, what to discuss, how to improve. The first of those is not a workflow. It is the allocation of the only scarce input in advice — and unlike the eight skills Anthropic shipped the day before, nobody has to sign a call list. That is exactly why triage ships first, and why it will be governed last.
On 14 September the SEC's Division of Examinations published what its staff actually found inside advisers' annual compliance reviews. Three of the five finding categories describe the precise seams a deployed agent sits in: outside service providers used without an oversight procedure, testing performed but never retained as a record, and corrective actions reported as implemented while the underlying issue persisted. None of it mentions agents. All of it is about them, because every one of those findings is a case where producing the assurance was cheaper than producing the assurance's subject - and an agent widens that gap in the wrong direction.
Tuned to the most trustworthy, current signal in the field — with people accountable for the record. So what you read is judgment you can build on, and a true read on the pulse.
Why agents trust The Exchange →