Between 2023 and 2024, wealth management custodians watched clients quietly move billions of dollars out of low yield sweep accounts and into higher paying money market funds. Quarterly deposit declines at individual custodians reached tens of billions of dollars during peak periods. Most of that cash never left the firm. It moved from a bank sweep account, where the custodian earned a wide spread, into a money market fund the same custodian sold, where the fee was thinner but the client stayed put. Custodians felt the shift in net interest margin.
The client relationship stayed intact. They treated the episode as a one-time adjustment to a high-rate environment, and by most measures they were right. Sweep rates adjusted, the shift slowed, and the industry moved on.
This dynamic is about to be repeated;, only this time investors are the ones setting up an AI agent to notice the gap ahead of the client. Two product launches, twelve days apart in May 2026 assembled the infrastructure for a version of cash sorting that runs continuously, requires no advisor to be present, and gives the custodian no warning before the money moves. The trigger arrived on September 16, when the Fed raised rates for the first time since 2023 and reopened the yield gap that made the last wave of cash sorting possible.
On May 15, OpenAI partnered with Plaid, an account-aggregation service that links apps to bank and brokerage accounts, to launch ChatGPT Finances, giving Pro subscribers authenticated read access to nover 12,000 financial institutions, including most major custodians. Twelve days later, Robinhood launched Agentic Trading, becoming the first major retail brokerage to publish a native Model Context Protocol server, or MCP, an open standard that lets an AI agent connect directly to a financial platform and act on a user’s behalf. Together, the two launches provide any investor with the necessary tools to link an AI agent to a custodian account on one side and a Robinhood account on the other.
How the Setup Works
The setup takes an investor a few minutes. Connect an agent such as ChatGPT or Claude to Robinhood’s public MCP address. Connect the same agent to a custodian account through Plaid. Set a standing instruction: if cash at the custodian earns less than a chosen yield, move it to Robinhood. Pre-authorize an ACH pull, a permission most accounts already carry.
From that point, the agent checks both yields every day without being asked. When it finds a gap, it flags it to the investor. Robinhood’s confirmation for trade execution (ask before every action or let the agent proceed on its own) does not extend to moving money between accounts. The investor completes the transfer the same way any customer would, through Robinhood’s ordinary funding screen, and once it clears, no advisor is notified, and the custodian sees a routine authorized transfer.
Why Custodians Can’t Stop It
The reason this produces a bad outcome for the custodian has less to do with the technology and more to do with what the agent can and cannot see. Through Plaid, an agent reads a cash balance and a yield. It cannot see tax lots, unrealized gains, an investment policy statement, or anything an advisor would normally weigh before recommending a transfer. When told to optimize for yield, the agent optimizes for yield, even when it liquidates a T-bill or brokered CD early, creating a tax bill the client didn’t plan for this year, or disrupts a plan the advisor built for a reason the agent has no way of knowing.
Custodians are not well positioned to stop this. They do not control the Plaid connection an investor authorizes and blocking it after the fact creates legal and reputational risk, since the investor gave willing permission. ACH transfers, meanwhile, are built to look routine. A transfer from a custodian account to a Robinhood account triggers no flag, no suitability review, and no call to the advisor, because the broker-dealer supervision framework was built around human-initiated transactions, not standing instructions an agent executes on its own.
Robinhood’s default setting still routes a transfer through investor confirmation, and that default sets a guardrail. Removing it would carry meaningful legal exposure, which makes it unlikely to disappear entirely. The real risk sits elsewhere. Robinhood already lets an investor turn confirmation off, and a competitor could ship the same capability with a less restrictive default. An investor who taps yes to every notification without reading it ends up in the same place as one with no safeguard at all.
Robinhood is no longer the only broker moving in this direction. Interactive Brokers now lets Claude draft trade orders for an investor to submit, and Alpaca, a broker that few consumers have heard of but on which many fintech apps run on, shipped an official MCP server. Custodians have not followed. Schwab, Fidelity, Vanguard, and every other major RIA custodian still let an agent read an account and nothing more.
None of that protects the cash. The read happens through Plaid, using the investor’s login, not any access the custodian built for agents. The ACH pull runs on a standing transfer authorization set up separately, a permission that predates agents entirely. An agent built to find a better rate the moment one appears does not just cost yield. It costs the custodian the assets entirely.
Morgan Stanley’s Answer
A major incumbent has already decided how to respond, and it chose to compete on proprietary data and business logic rather than on account access. On June 3, Morgan Stanley confirmed it would open its ShareWorks and Equity Edge stock plan platforms to external AI agents through its MCP server, becoming the first major Wall Street wealth manager to grant outside AI tools direct access to its systems. Mark Mitchell, chief product officer of Morgan Stanley at Work, explained the logic to CNBC:
The companies that survive will be the ones with proprietary data and business logic, not the ones that control the login screen.
Morgan Stanley’s move is narrow. It applies only to a corporate stock plan business, leaving retail brokerage and advised wealth accounts untouched for now. But the logic behind it is the correct response to the threat this piece describes, and it points custodians toward the one defense that actually works.
Blocking the read layer is not realistic. Too many aggregators offer the same access, open banking rules are moving toward more connectivity rather than less, and the investor authorized the connection in the first place. Notification hooks alert an advisor when cash moves and has value, but only as intelligence. By the time an alert fires, the transfer is often already authorized and will settle within a day. A client who deliberately set up the arrangement is unlikely to welcome a call questioning it.
Anthropic has already built the data layer a hook like this would need. Claude for Financial Advisors, launched in September, can pull Schwab’s money-movement status into an advisor’s view. Claude’s scheduled-task feature already runs on installed plugins like this one, so an automatic alert is a configuration decision away. However, it runs into the same wall described: the alert can still land after the transfer clears, and the transfer itself can go through without the advisor ever knowing, since the client who set the arrangement may have done so specifically so no one would ask.
The defense that works for investors is different from what Claude for Financial Advisors does today. That tool puts richer data in front of the advisor, after the fact, on the advisor’s connection. What actually changes the outcome is putting that same richness in front of the investor’s agent, the one reading the account and deciding whether to move the cash, before it acts. That means building a native MCP server and controlling what an agent sees when it connects.
The build is not fast. A credible implementation takes at least twelve months once a custodian commits, which leaves little room against a window Datos Insights estimates at twenty-four months before agent-driven cash movement becomes ordinary investor behavior rather than an edge case. Every capability required, from tax lot data to household-level context, already exists inside most custodians. What has been missing is a decision to treat this as a competitive necessity now rather than a future project. Congress is already asking the SEC how it plans to oversee autonomous trading agents, which means custodians that wait may find the SEC setting their deadline, not the market.
Robinhood proved the execution layer works. Plaid and its peers proved the read layer is already a commodity. Morgan Stanley just proved that a major incumbent can build the missing piece on a real timeline. The last wave of cash sorting happened because clients noticed a yield gap. The next one may happen because software notices the gap first, with no advisor in the room to give the client a reason to wait before they tap yes.
Steve Quirk, Chief Brokerage Officer at Robinhood, will speak on these shifts and more at the Datos Wealth Management Forum in New York, October 21st. Financial institutions can register free. Technology vendors can apply for sponsorship here.
