Ruthless deep-dive · passive recon only · unlisted
How Chase actually works online, and the two seams where a proof-verified protocol makes the bank feel more efficient before it changes a thing.
This goes past a website teardown. It reads Chase / JPMorganChase the way an agent, a partner, and a diligence desk read it: the four consumer stacks, the vendor mesh behind them, the developer rails the bank already exposes, and the $2.5 trillion sustainable-finance machinery, all from public record, nothing probed. Then it shows, concretely, the efficiency and confidence EcoWealth's Ecological Work Protocol produces: one legible layer that answers correctly across every stack, and a proof rail that turns a reported dollar into a settled, citable outcome, both built on primitives (llms.txt, the file AI assistants read first, Base settlement) JPMorgan's own teams have already validated.
First, the baseline, credited generously
A deep audit earns the right to point at seams by naming what is genuinely strong. Chase's is a clean, secure, well-run estate.
What Chase already does well
Observed passively across eight public pages, 2026-07-10.
- Zero page errors / no JS crashes on all eight rendered pages (home, cards, checking, mortgage, corporate, sustainability, the Payments developer portal, and jpmorgan.com). The console/failed-request noise in our raw logs is our own webfont blocking during screenshotting: the meaningful signal,
pageerror = 0, is clean everywhere. - Solid security posture: HSTS with
includeSubDomains; preloadon personal.chase.com, CSPframe-ancestorslocked on every stack,X-Frame-Options: SAMEORIGIN, and a card-pagePermissions-Policythat disablescamera,microphone,payment, andinterest-cohort. - Modern discovery where it counts: a 1.4 MB
www.chase.com/sitemap.xmland a 305 KBjpmorganchase.com/sitemap.xml, both live (200). - Substantive, externally-recognized climate commitments: a $2.5T sustainable-development target, the Carbon Compass® methodology, and named sector 2030 pathways (detail in finding 6).
developer.payments.jpmorgan.com/llms.txt is live (200), 198 KB, 1,212 lines, with a companion API that serves an LLM-optimized markdown copy of every doc, and a "Build with AI" program on the portal. The pattern EcoWealth proposes is already validated inside your own house. It just hasn't reached the consumer product, corporate, or sustainability surfaces, or gained a proof-of-outcome layer. See finding 4.The bottom line, in plain English
Make the products machine-legible → you win the AI's first pass at “which Chase card fits me?” instead of losing the shopper
The pages that sell your cards carry heavy human-tracking but nothing an assistant can read, so a rising share of “which card,” “help me open an account” questions get answered by an AI working from guesswork — one legible layer (the pattern your Payments org already runs) means the customer already asking gets an accurate answer and reaches you.
A verifiable receipt under the $2.5T commitment → a claim an AI or a court can check, not a PDF it can't
Your climate substance is real but delivered as reports nothing can independently verify, and the pressure has shifted from mandate to litigation — a settled, proof-backed outcome receipt turns the headline into citable ground truth, worth far more to a skeptical regulator, customer, or their AI than a figure taken on faith.
Prune the legacy crawl rules → the first thing an AI indexer reads on your consumer domain is clean
The consumer crawl file still layers modern sitemaps over a decade of BlackBerry-era, Flash-era sediment; a quick cleanup is cheap discovery hygiene that shapes how every machine — search or AI — first sees Chase.
The findings: seven, each with the exact public proof
What a visitor / agent / partner sees today · why it's an opportunity · the citable evidence (href, HTTP status, CSP domain, rendered-DOM check).
1The card-acquisition funnel is run by two outside vendors, live-balanced at the edgeedge cookie + CSP
The first pass noted "four stacks." Deeper: the credit-card funnel alone is split across two external operators, chosen by an Akamai load-balancer on each request. The akaalb_chase_creditcards_com cookie resolves to creditcards_capgemini_com on one hit and creditcards_redventures_com_gcp on another, and the live CSP allowlists both a Capgemini analytics origin and Red Ventures infrastructure (cohesionapps.com is Red Ventures' customer-data platform; make.rvapps.io is its app host).
# Set-Cookie on two passive GETs of the same brand surface (Akamai ALB) akaalb_chase_creditcards_com = …op=chase_creditcards_com:creditcards_capgemini_com|… akaalb_chase_creditcards_com = …op=…redventure…:creditcards_redventures_com_gcp|… # creditcards.chase.com Content-Security-Policy names both vendors script-src … https://*.capgemini.com connect-src … https://capgeminijpmc.tt.omtrdc.net … https://cdn.cohesionapps.com … https://ingest.make.rvapps.io
creditcards.chase.com renders as its own branded property: a distinct "CHASE CREDIT CARDS" masthead, its own nav and brighter blue, even personalized card art, confirming a separate build from chase.com.The opportunity: a customer (or their AI) crossing from "cards" to "checking" traverses independently-operated vendor systems, so brand voice, product facts, and machine-legibility all fragment at the seam. One thin agent-legibility layer gives the same correct, cited answer no matter which vendor build the request lands on. This is exactly the seam a single legibility layer is for.
2The card page carries a ~50-origin martech mesh: heavy human-tracking, zero machine-readingCSP inventory
The creditcards.chase.com CSP allowlists roughly fifty third-party origins for ads/analytics; the rendered page pulled 17 of them on a single visit. It's a sophisticated human-attribution stack (data brokers, DSPs, social pixels) and it even encodes the co-brand card partners. What it does not contain is a single machine-readable statement of what the products are.
# creditcards.chase.com CSP img-src / connect-src — selected origins data brokers / identity : tags.bluekai.com (Oracle) · t.acxiom-online.com · rc.rlcdn.com (LiveRamp) · pixel.tapad.com demand-side / social : demdex.net (Adobe) · doubleclick · insight.adsrvr.org (Trade Desk) · facebook · tr.snapchat.com · pinterest · alb.reddit.com · flask.nextdoor.com co-brand partners baked in: smetrics.marriott.com · southwestairlines.tt.omtrdc.net · smetrics.southwest.com # rendered visit: 17 distinct third-party hosts loaded · 0 product-schema entities
The opportunity: the contrast is the point: enormous, well-tuned investment in reading humans, and nothing that lets a machine read the product. As the first pass of "which card fits me" moves to assistants, the martech mesh is invisible to them; a small, structured product layer is what actually gets read. (Normal for a card funnel; we flag the asymmetry, not a defect.)
3No structured product data on the pages that sell the productsrendered-DOM check
We checked the fully-rendered DOM (post-JavaScript, the honest check) for schema.org / JSON-LD and OpenGraph. The consumer money pages expose none: the home page, the 938 KB credit-cards page, and personal-checking all return zero ld+json and zero og: entities. This is the decade-old, universally-supported legibility layer, not new AI plumbing, and it is simply absent where the offers live.
# Playwright chrome, 2× DPI, structured-data count in the rendered DOM www.chase.com/ ld+json=0 og=0 creditcards.chase.com/ (938 KB) ld+json=0 og=0 personal.chase.com/personal/checking ld+json=0 og=0 www.chase.com/personal/mortgage ld+json=1 og=0 # the one page with any schema — honest note jpmorganchase.com/impact/…sustainability ld+json=0 og=3
The opportunity: even a classic FinancialProduct/Offer graph would let every search and answer engine describe Chase's cards accurately. It's absent today, so the machine layer is a clean install, not a rebuild: the Agent Kit supplies it without touching Chase's page code.
4Your Payments org already shipped agent-legibility: the consumer, corporate & ESG surfaces haven't caught up200 vs 404
This is the sharpest and most useful finding, and a direct upgrade to the earlier "nothing is built for AI." It's half true: nothing is built on the consumer/corporate/sustainability surfaces, but JPMorgan Payments runs a production-grade one. developer.payments.jpmorgan.com/llms.txt is a live, 198 KB, 1,212-line map of the whole API catalog, backed by an /api/llm-content?path=…md endpoint that serves an LLM-optimized markdown copy of every page, and the portal fronts a "Build with AI" program. Meanwhile every consumer and corporate agent-discovery path 404s.
# agent-discovery probes (public well-knowns), 2026-07-10 developer.payments.jpmorgan.com/llms.txt 200 # 198 KB · 1,212 lines · + /api/llm-content?path=…md www.chase.com/llms.txt 404 www.jpmorganchase.com/llms.txt 404 www.jpmorgan.com/llms.txt 404 {chase,jpmorganchase}.com/.well-known/agent-card.json 404 # and the Payments llms.txt mentions of sustainability / carbon / ESG / climate: 0
Why this is the confidence unlock: EcoWealth isn't asking JPMorganChase to bet on an unproven idea. It's proposing to extend a pattern the firm already productionized to the two surfaces it skipped, consumer product and sustainability, plus the piece even the Payments layer lacks: a proof-of-outcome receipt (its own llms.txt has zero ESG mentions). The risk conversation is already won.
5The consumer discovery layer is a palimpsest: modern sitemaps over decade-old sedimentcorrection
Honest correction to the first pass, which reported "no sitemap." On www.chase.com that's not accurate today: robots.txt (200, 147 lines) publishes four Sitemap directives. What's true is that the modern block sits on top of never-pruned legacy: a BlackBerry-phone article, /ccpmweb/… trees, and trailing-dot .htm. typos. (The earlier read likely hit bare chase.com, which 301-redirects.) Ruthless means correcting ourselves in public.
# www.chase.com/robots.txt (HTTP 200) — the modern part Sitemap: https://www.chase.com/sitemap.xml Sitemap: https://www.chase.com/locator/sitemap.xml (+ video + legacy-locator) # …and, still, the sediment Disallow: /online/services/article/blackberry-phone.htm. # trailing-dot typo, BlackBerry era Disallow: /ccpmweb/chase_canada/ … # dozens of legacy paths
The opportunity: the file that shapes how every crawler and AI indexer first meets Chase is half-museum. Pruning it is a one-afternoon hygiene win; it's called out here because a deep audit names the small true things, not just the big ones.
6The $2.5T sustainability engine is real, PDF-bound, and unverifiable, and the pressure has shifted from mandate to litigationfetch + regulatory
The sustainability page renders a clean "Our Impact" hub, but the substance lives in PDFs: the $2.5T sustainable-development target ($1T green), the Carbon Compass® methodology (a May-2021 PDF), the Center for Carbon Transition, and sector 2030 intensity targets. The rendered DOM exposes 0 JSON-LD: no structured, project-level, or proof-verified, on-chain outcome data beneath the number. And the reason this now matters more, not less: the SEC climate-disclosure rule is being rescinded (proposed May 2026 → voluntary regime), so the value driver is no longer a regulator's stick, it's greenwashing litigation (up ~12× against banks in three years), CSRD for large multinationals, and investor/PCAF demand for ISO 14064-3 "investment-grade," third-party-verified data.
# jpmorganchase.com/impact/environmental-sustainability (HTTP 200, rendered) commitments present : $2.5T sustainable-dev · $1T green · Carbon Compass® · net-zero-2050 delivery format : annual-report + methodology PDFs, no API, no project-level data structured data : ld+json = 0 # the number is not machine-readable at all outcome proof : none verifiable, a financing figure, not a ground-truth outcome
Where EcoWealth plugs in: a voluntary claim without proof is precisely what gets litigated as greenwashing. EcoWealth's Work Protocol is the missing last mile: funded ecological/community packets, each settled with photo + GPS + method proof and an on-chain tCO2e receipt a machine can cite. It converts the litigation-and-credibility exposure into an asset.
7The integration substrate already overlaps: JPMorgan's own blockchain runs on Base, so does EcoWealthpublic record
The "how would this ever touch our rails" objection is pre-answered. JPMorgan's blockchain unit Kinexys (formerly Onyx), $3T+ cumulative, ~$5–7B/day, deployed its JPM Coin / Kinexys Digital Payments on Base in 2025 and is executing cross-chain tokenized settlement. EcoWealth's Ecological Work Protocol (fund → claim → proof → on-chain settlement → tCO2e receipt) is live on Base mainnet today. The settlement substrate EcoWealth already uses is one JPMorgan's own team independently chose and productionized.
# public record — shared settlement substrate JPMorgan Kinexys (fmr. Onyx) → JPM Coin deployed on Base (2025); cross-chain tokenized settlement EcoWealth Work Protocol → live on Base mainnet; funded + proof-verified + tCO2e-receipted packets
Why it lands: confidence in a big institution is mostly de-risking. Two of the three primitives EcoWealth relies on, llms.txt legibility and Base settlement, have already been validated by JPMorgan's own teams. The third, proof-of-outcome, is the net-new value EcoWealth brings.
Evidence log: method, dates, and the exact checks
Recon window 2026-07-10. Every row is normal browser navigation or a standard public HTTP GET: no authentication, no parameter fuzzing, no endpoint probing, no wall routed around.
| Check | Method (passive) | Result |
|---|---|---|
| card-funnel vendors | curl -IL creditcards.chase.com (Set-Cookie + CSP) | Akamai ALB balances Capgemini ↔ Red Ventures; CSP names both |
| martech density | CSP inventory + rendered request hosts | ~50 CSP ad/broker origins; 17 loaded; Marriott/Southwest co-brand baked in |
| structured data | Playwright chrome, rendered-DOM ld+json/og count | home/cards/checking = 0/0; mortgage = 1 ld+json; ESG = 0 ld+json |
| Payments AI layer | GET developer.payments.jpmorgan.com/llms.txt | 200 · 198 KB · 1,212 lines · + /api/llm-content markdown API |
| consumer AI layer | GET /llms.txt + /.well-known/agent-card.json | 404 on chase.com, jpmorganchase.com, jpmorgan.com |
| robots / sitemap | GET www.chase.com/robots.txt | 200 · 147 lines · 4 sitemaps + BlackBerry/ccpmweb sediment |
| ESG substance | GET + render /impact/environmental-sustainability | 200 · $2.5T/$1T/Carbon Compass®, PDF-only, 0 ld+json |
| render + errors | Playwright chrome, 2× DPI, 8 pages | all 200, 0 page errors (console noise = our own webfont blocking) |
| shared substrate | public record (Kinexys / Base) | JPM Coin on Base 2025; EcoWealth EWP live on Base mainnet |
Market intelligence: how JPMorganChase actually works, and where EcoWealth integrates
A teardown says what's broken. This says how the institution is shaped, how it buys, what it could fund, and the exact door to walk through, so the conversation starts from the bank's real machinery, not a wishlist.
The org explains the four stacks
JPMorganChase & Co. (NYSE: JPM) runs two customer-facing brands. Chase = Consumer & Community Banking (cards, checking, home & auto, small business) → chase.com + its vendor sub-stacks. J.P. Morgan = the Commercial & Investment Bank + Asset & Wealth Management (Payments, Markets, Securities Services) → jpmorgan.com. Corporate + Impact/ESG → jpmorganchase.com. The four stacks aren't an accident: they're org boundaries rendered as domains. Any layer that wants to serve "Chase" has to speak across all of them.
What makes proof valuable right now
The regulatory stick is weakening: the SEC climate rule is being rescinded toward a voluntary regime. But the exposure moved, it didn't vanish:
- Greenwashing litigation up ~12× against banks in three years: voluntary claims without evidence are the target.
- CSRD still binds large multinationals operating in the EU.
- Investors + PCAF now want ISO 14064-3 "investment-grade," third-party-verified emissions data, not self-reported figures.
Proof-verified outcomes are worth more in a voluntary regime, because credibility is now the whole game.
How a bank this size adopts something new: three doors
llms.txt and a "Build with AI" track. An integration that speaks these patterns lands here with the least ceremony.
The line items that could fund proof-verified work packets
These are real budgets whose credibility currently rests on a reported dollar, not a verified, on-chain outcome: exactly what a proof rail upgrades:
- $2.5T sustainable-development target ($1T green) through 2030: green-bond proceeds + project finance lines.
- $30B Racial Equity Commitment (2020): with CDFI partnerships, NMTC (~$100M/yr committed), and LIHTC deployment through Community Development Banking.
- Community development financing: routinely $1B+/yr into affordable housing and small business.
- Center for Carbon Transition: client advisory that could attach verified ground-truth to its sector work.
The concrete integration path: starting from a customer conversation
llms.txt + agent card + MCP tools) over Chase's public product + ESG data on EcoWealth infrastructure, and funds one small proof-verified packet: photo + GPS + method, settled on Base, tCO2e-receipted. Nothing touches Chase's systems. This is the demo, already built alongside this audit.llms.txt, the legibility layer slots into a familiar pattern; the proof rail rides an In-Residence-style sponsor. One public product page + one ESG line, cited and verifiable.The efficiency you feel on day one
Before EcoWealth changes anything inside Chase, this is the difference a customer's AI, and a diligence desk, experience immediately.
Today
"Which Chase card fits me, and is the climate claim real?" → an assistant crawls four vendor-built stacks with zero product schema, hits a ~50-origin martech mesh it can't read, and lands on a $2.5T number in a PDF it can't verify.
Result: it guesses a rate (risk), or declines to answer (a lost first pass). The bank's real strength is invisible to the machine making the first cut.
With the Kit + Protocol
The same question returns a cited product answer (linking Chase's own current terms, never an invented rate) and a sustainability answer backed by settled, on-chain, photo+GPS+method-verified tCO2e receipts. The $2.5T figure stops being a PDF and becomes a stream of citable outcomes.
Result: consistent, correct, verifiable answers across every stack, built on llms.txt and Base settlement, both already validated by JPMorgan's own teams. Zero Chase system changes to see it work.
The hand-off: warm, operator-driven
A conversation the operator can start himself, not a request for an introduction.
Brandon is a Chase customer. This whole package is a leave-behind for a fifteen-minute conversation he can open directly: the demo runs in Chase's own brand, on EcoWealth infrastructure, asking nothing of Chase's systems up front.
