What happened
In its October 15, 2026 Fall Business Update, Schwab President and CEO Rick Wurster described the company’s approach to AI in retail investing and advisory services. The transcript says Schwab is blocking unauthorized agents that attempt to log in for clients, calling that an unsafe way to access the firm. Wurster framed the policy as protection for both clients and Schwab. The statement establishes the company’s position, but does not by itself specify the technical detection method or the scope of blocked attempts.
Schwab is also building approved ways to use AI. Wurster said the company’s Charley assistant combines third-party large language models with Schwab data and security. It uses a “constellation” of underlying models and is designed to select one suited to the task. At the time of the call, Charley was primarily an information and synthesis tool, with the ability to perform some administrative actions for clients, including changing an address or naming a trusted contact. Schwab said the assistant would become available to all clients in the coming months and described a longer-term ambition for it to become an important front door to the firm.
A second approved route is for clients to connect their own LLMs to Schwab’s MCP servers. Wurster cited Claude for Financial Advisors as an example, and said Schwab was also using MCP for retail trading clients. He said the firm can secure authentication and control or limit access to higher-risk actions such as moving money. The transcript describes a pilot in which traders connect to the MCP layer through their LLM of choice; it began with Claude, with expansion to additional clients and LLMs planned in the coming months. Schwab also said it had introduced Charley and was rolling out an AI-powered thinkorswim assistant.
Internally, Schwab said its use of AI had increased developer productivity by about 25%. The transcript does not attribute that figure to a particular tool or describe the measurement method. Wurster also said that some active traders were already connecting LLMs to Schwab through APIs and MCP, but did not describe the scale of that group.
What the archive adds
New Runtime’s earlier coverage on October 24, 2026 said Citi, Wells Fargo, Bank of America and JPMorgan Chase had taken steps to limit third-party agents’ access to customer platforms: US banks move to restrict third-party AI agents from accessing customer accounts. Schwab adds a new company statement and a clearer contrast between blocking unauthorized login attempts and permitting integrations whose authentication and action permissions Schwab controls. This is a new fact in a known story.
Trend signal
This supports New Runtime’s assumption that banks can reliably detect agent logins today and that blocking credential-based agents can be effective: the bank AI-agent alarm and shared passwords. Schwab says it is actively blocking unauthorized attempts, but the transcript does not provide detection accuracy, false-positive rates or evidence that every credential-based agent can be recognized. The operational claim is relevant; the effectiveness remains unmeasured here.
Connections to other events
On September 23, 2026, New Runtime’s earlier coverage described Anthropic’s Claude for Financial Advisors as a set of connectors and skills for research, meeting preparation and documentation, including connections to custodian data and CRM systems. Schwab now identifies itself as the first RIA custodian included in that product and says it is using MCP for approved client access. The connection brings together an existing financial-advisor workflow and a new account-access control question.
Why it matters
For a team building an agent that interacts with a financial service, “the user gave the agent their password” is not the same as a safe delegation model. Schwab’s stated approach points toward a more durable interface: the provider authenticates the connection, scopes what the agent can do, and places tighter controls around actions with direct financial consequences. That design can preserve useful tasks—information retrieval, synthesis and selected administration—without treating money movement as an ordinary tool call.
The practical implication is that agent integrations need explicit capability boundaries. A builder should distinguish reading and summarizing from making changes, and distinguish low-impact changes from transactions. Schwab’s transcript does not publish the protocol or policy implementation, so it is not a recipe to copy. But its product distinction is concrete: an unauthorized agent login is blocked, while a provider-controlled MCP path can expose a limited set of actions with authentication and risk controls. Other account-based services will face the same architectural choice as customers expect agents to act across their systems.
Limits and uncertainty
The transcript is Schwab’s account of its policy and plans, not an independent technical audit. It does not give the method used to identify unauthorized agents, the number of attempts blocked, how often legitimate activity is rejected, or whether blocking is consistent across every Schwab service. It also does not detail MCP authentication, permission granularity, approval steps, logging or rollback. Charley’s stated capabilities and the planned expansion of the trader pilot may change as deployment proceeds. Schwab’s approximately 25% developer-productivity increase is a company figure without a stated baseline or measurement method in the discussed remarks.
Reader takeaway
Schwab’s message is not that financial firms will reject all agents. It is drawing a line between agents that log in as clients and integrations operating through firm-controlled authentication and permissions. For builders, the central design question is how to make delegation auditable and action-specific—especially before an agent can move money.