An AI assistant that recommends a payment is a useful tool. An AI agent that can initiate, authorise and complete one is something different: it is an actor inside the financial system. The question is no longer only whether it can move money. It is who gave it authority, what limits constrain it, and who answers when it gets something wrong.
Executive summary
Artificial intelligence is moving from conversation to execution. Agentic systems can interpret a goal, plan multiple tasks and interact with digital services with limited human intervention. In commerce, that can mean searching for a product, comparing offers, booking a service or paying for data and computing resources. In corporate finance, the same pattern could eventually support invoice workflows, treasury operations and supplier payments.
The financial implications are substantial, but the hype needs discipline. The Bank of England's 2026 survey (opens in a new tab) of UK financial firms found that 80% of respondents had AI agents in production, yet most were used for decision support. Only 2% reported agents with broad autonomy. Even including planned deployment, no more than 9% expected agents to approve or decline customer outcomes, execute trades or place orders, initiate, execute or block payments, or change limits and thresholds. Adoption is real; unrestricted financial autonomy is not yet the norm.
View the image full size
The IMF's April 2026 note, How Agentic AI Will Reshape Payments (opens in a new tab), offers a useful framework: separate intent, authorisation and settlement. AI can help interpret intent and coordinate actions. Permission to spend, however, should be governed by explicit, enforceable rules, while settlement must remain predictable and legally clear.
Payments companies are building the connective tissue. Google's Agent Payments Protocol (AP2) (opens in a new tab), Visa's Trusted Agent Protocol (opens in a new tab) and its directory of verified agents (opens in a new tab), Mastercard's Agent Pay for Machines (opens in a new tab), and the HTTP-native x402 (opens in a new tab) payment standard illustrate different approaches to identifying agents, representing user intent, constraining credentials and enabling machine-to-machine payments. These are infrastructure initiatives, not proof that a mature autonomous-agent economy has arrived.
The central thesis is simple: autonomy should be separated from authority. An agent may find, recommend, prepare and route a transaction without being allowed to approve an unlimited transfer. A safer architecture combines scoped delegation, strong identity, transaction-level policy checks, spending caps, human escalation, tamper-evident records, monitoring and recovery.
1. From chatbot to economic actor
Traditional software generally follows instructions written in advance. A conventional assistant might explain how to pay an invoice or draft a payment instruction. An agentic system goes further: it can break a goal into steps, select tools, interact with external services and adapt when conditions change.
Consider: “Reorder office supplies when stock falls below the agreed level, but do not spend more than RM3,000 and use an approved supplier.” A basic workflow alerts a staff member. A more capable agent checks inventory, compares approved suppliers, requests a quote, prepares a purchase order and submits a payment request. The design question is where its authority stops. Can it merely prepare the transaction, approve it, or release funds? Can it add a beneficiary or exceed the budget?
These capabilities are not interchangeable. Reading account information is different from creating beneficiaries, changing payment limits or moving funds irreversibly.
An AI agent is goal-directed, uses tools, executes multi-step plans, adapts to new information and acts under delegated authority. It does not become a legal person simply because it can act. Its behaviour still occurs through systems, accounts, credentials and organisations with owners and operators.
2. The three layers of agentic payments
The IMF's 2026 analysis (opens in a new tab) separates agentic payments into three layers. This boundary prevents a probabilistic model from silently becoming the final authority over money.
Layer 1 — Intent and orchestration
The user expresses a goal: “Pay the lowest-priced approved supplier for 500 units, delivered by Friday.” The agent interprets the request, searches options, checks data and turns the goal into a structured proposed transaction. Language models can handle ambiguity and coordinate services, but their interpretation must be reviewable. “Lowest cost” does not mean choosing an unverified supplier with hidden delivery charges.
Layer 2 — Authorisation and control
A separate policy engine decides whether the proposed action is permitted. It checks the principal, agent identity, delegated scope, counterparty, amount, currency, purpose, time window, risk signals and approval evidence.
The principle: the model proposes; the policy layer disposes. The agent should not rewrite the rules constraining it. New beneficiaries, unusual counterparties, material changes and transactions above thresholds should trigger stronger approval or human review.
Layer 3 — Settlement
The payment is executed through a bank, card network, payment service provider, tokenised deposit or blockchain-based asset. Settlement systems need clear rules for finality, reversals, disputes, liquidity and reconciliation.
A model's confidence score is not a settlement guarantee. Nor does an on-chain confirmation by itself resolve whether the underlying purchase was valid, whether refund rights exist or who authorised the agent.
Keep flexible reasoning upstream; preserve deterministic controls where authority and value transfer occur.
View the image full size
3. The infrastructure race is under way
| Initiative | Focus | Why it matters |
|---|---|---|
| Google's Agent Payments Protocol (AP2) | Open framework for agent-led payments and evidence of user intent | Helps agents, merchants and payment providers coordinate |
| Visa Trusted Agent Protocol | Merchant ability to distinguish legitimate agents from malicious bots | Agent identity becomes part of checkout security |
| Mastercard Agent Pay for Machines | Agent credentialing, permissioning and machine-driven transactions | Supports a vision of machine-to-machine commerce |
| x402 | HTTP-native payment convention for APIs and web services | Makes programmatic payments for data, compute and digital services easier to express |
| MAS SAFR | Runtime governance for agentic finance | Focuses on who an agent may act for, what it may do and what is recorded |
These initiatives are not interchangeable. Some focus on merchant-agent trust; others on credentials, intent, interoperability or settlement. A future transaction might discover a service through one protocol, prove delegated authority through another, obtain a scoped credential from a provider and settle through a bank or stablecoin rail.
A protocol announcement, pilot or white paper is evidence of development, not proof of broad adoption, interoperability at scale or proven consumer protection. Production deployment requires testing, dispute processes, fraud controls and legal analysis.
4. Why stablecoins may matter — but are not the whole answer
AI agents may pay for digital services consumed in small increments: model inference, data access, cloud compute, API calls, storage or specialised software. Traditional card and bank rails are well established, but their workflows are not always optimised for machine-to-machine micropayments or continuous programmatic settlement.
Stablecoins could be useful in some settings because supported blockchain networks can operate continuously and programmable contracts can automate conditional transfers. The x402 (opens in a new tab) ecosystem, for example, explores HTTP-native payments, including stablecoin settlement, for machine-accessible services.
But “stablecoin” does not mean risk-free money. A payment token carries issuer, reserve, redemption, custody, blockchain, compliance and jurisdictional risks. Both sides still need suitable wallets, liquidity, conversion routes and error-handling processes. A fast on-chain transfer does not automatically create a legally reversible consumer payment.
Nor should every agent payment be forced on-chain. Domestic payroll may be better served by regulated bank rails; a software agent buying a small amount of global data may find a stablecoin rail practical. The right rail depends on the obligation, counterparties, jurisdiction, value, reversibility and total cost.
5. The economics: what changes when software becomes a customer?
Lower search and coordination costs. Agents can compare offers, check availability and prepare routine purchases faster. Benefits are greatest where tasks are repetitive, rules are clear and data is structured.
New demand for machine-readable services. Providers may package data, compute, APIs and digital tools so agents can discover, evaluate and purchase them without a human navigating checkout.
Higher transaction frequency. A monthly purchase may become many usage-based micro-payments. This can align cost with consumption, but increases monitoring, reconciliation and dispute events.
New control costs. Identity verification, registries, delegated credentials, fraud analytics, policy engines, audit trails, key management and incident response are not free.
A hypothetical example illustrates the trade-off. If a company makes 10,000 small service purchases monthly and automation saves 90 seconds of staff time per purchase, it saves 250 hours. If each transaction requires 20 seconds of exception review, that adds about 56 hours. These are illustrative assumptions, not observed industry averages. The real business case depends on exception rates, integration costs, fraud losses, payment fees and the value of staff time.
The prize is not simply cheaper payments. It is lower coordination friction, with risk and control costs kept below the value created.
6. The failure modes
Prompt injection. An agent may read emails, websites, invoices or documents containing instructions designed to manipulate it. External content must be treated as untrusted data, not as authority to override the user's policy.
Credential theft. If an agent's API key or wallet credential is compromised, an attacker may inherit its permissions. Prefer short-lived, scoped credentials, transaction-specific authorisation and secure key custody.
Model error. An agent can misunderstand a request, select the wrong currency, confuse similarly named beneficiaries or optimise the wrong objective. Confidence expressed in natural language is not proof of correctness.
Automation bias. Human approval is not meaningful if staff routinely approve recommendations without inspection. Interfaces should show the payee, amount, purpose, instruction source, policy checks and deviations from the original request.
Correlated behaviour. If institutions use similar models or data providers, a shared defect or manipulated signal could cause similar actions at the same time. Monitoring must consider concentration, common dependencies and feedback loops.
Irreversibility. Some payment methods are difficult to reverse. Systems need pre-execution checks, limits, emergency suspension, evidence preservation, refund arrangements and escalation routes. “The blockchain confirmed it” is not an adequate customer-service policy.
View the image full size
7. Who is accountable?
There is no universal rule that makes the AI model itself responsible for a financial loss. Accountability depends on the legal relationship, jurisdiction, contract, applicable regulation, consumer-protection rules, negligence, security obligations and incident facts.
Relevant roles include the principal/customer on whose behalf the agent acts; the deployer that configures it and grants access; the model or platform provider; the tool and integration provider connecting it to accounts or wallets; the bank or payment service provider executing the payment; and the merchant or recipient.
These roles can overlap, and contracts and laws may allocate duties differently. A customer may be responsible for a properly authorised payment, while a provider may be liable for failures in its own security or execution obligations. A deployer may face exposure if it grants excessive permissions or fails to supervise. A model provider is not automatically liable for every downstream action merely because its model generated text.
The practical questions are: Who controlled the relevant decision? Who had a duty to prevent the failure? What evidence exists? Which legal obligation was breached?
8. Regulation: governance becomes operational
Regulators increasingly focus on AI governance, operational resilience, accountability, data protection, consumer outcomes and financial crime. Existing rules may apply even where no AI-specific financial rule exists.
Singapore. MAS's July 2026 paper, Safeguards for Agentic Finance at Runtime (SAFR) (opens in a new tab), proposes a framework for governing agent actions in financial services, including authorisation, human oversight and records at the point of decision. Governance must operate when the agent acts, not only in a policy document written before deployment.
United Kingdom. The Bank of England's 2026 survey (opens in a new tab) is a reality check: agent deployment was widespread among respondents, but broad autonomy remained uncommon. High-impact functions such as payments, trading and customer outcomes remain areas of caution.
Global policy. The Financial Stability Board's 2026 consultation (opens in a new tab) on responsible AI adoption highlights governance across the AI lifecycle and financial-stability risks. The IMF (opens in a new tab) also points to traceability, opacity, cybersecurity, legal uncertainty and correlated behaviour.
Businesses must map the actual activity. Payment initiation, e-money, custody, remittance, securities dealing, consumer credit, data processing and outsourcing may each trigger different obligations. Using an AI agent does not remove the obligations that apply to the underlying service.
9. A safer architecture for autonomous payments
- Identify the principal. Establish whose account, wallet, budget or process the agent represents.
- Register and authenticate the agent. Bind it to a known deployer, version, environment and accountable owner.
- Issue scoped delegation. Specify permitted actions, approved counterparties, currencies, maximum values, time windows and prohibitions.
- Separate reasoning from approval. The agent prepares a structured payment intent; a deterministic policy service checks it.
- Require step-up approval. New beneficiaries, unusual patterns, policy exceptions and high-value transactions require human approval or stronger authentication.
- Use limited credentials. Prefer short-lived, revocable, least-privilege credentials.
- Record evidence. Preserve the instruction, agent version, tool calls, policy decision, approver, transaction details and settlement result.
- Monitor and stop. Detect anomalies, rate spikes and unusual counterparties; provide a kill switch and credential revocation.
- Reconcile and remediate. Match instructions to settlement records and maintain a refund, dispute and incident process.
Non-negotiable: an agent must never be able to expand its own authority. Changes to limits, beneficiaries or credential scope must use a separate authenticated control path.
View the image full size
10. What businesses should do now
Banks and payment providers: develop agent identity and delegation models, define customer consent and make transaction evidence accessible to fraud and dispute teams.
Enterprises: begin with read-only analysis, reconciliation and payment preparation. Move to low-value execution only after testing policy enforcement, exception handling and recovery.
Fintechs and wallet providers: design scoped credentials, transaction simulation, allowlists, velocity limits, monitoring and clear disclosures. A wallet designed for a human is not automatically safe for an autonomous agent.
Regulators: clarify how existing rules apply to delegated digital actions, what records must be retained, how liability is assessed and how consumers can challenge unauthorised or defective transactions.
Consumers: understand what an agent can access, what it can spend, whether it can add beneficiaries, how to revoke authority and whom to contact if a payment is wrong.
11. The next phase: an economy of agents?
Software agents may eventually buy and sell services from other agents. A procurement agent could purchase compute; a logistics agent could pay for a route update; a trading operations agent could buy market data; a business agent could settle a verified invoice.
This requires more than a model that can call a payment API. It needs interoperable identity, machine-readable commercial terms, reliable service descriptions, delegated authority, dispute mechanisms, compliance controls and settlement across providers.
AI can decide which service appears useful; policy systems can determine whether the purchase is allowed; payment infrastructure can transfer value; cryptographic records can help prove what happened. Each component has a distinct job.
But programmability is not trust. Smart contracts can enforce code, not guarantee that a real-world instruction was legitimate, the service was delivered or the legal claim is enforceable. A secure transaction is not necessarily a fair transaction.
Conclusion: trust must be engineered before autonomy is scaled
AI agents will increasingly participate in commercial workflows. Payment protocols, industry pilots, regulatory frameworks and institutional research show the direction. Yet broad financial autonomy remains limited, and the difficult questions are not solved by a more capable model.
The challenge is to let agents act without allowing them to become unaccountable authorities over money. That requires a clear principal, verifiable identity, scoped delegation, independent authorisation, deterministic limits, human escalation, traceable records and a credible process for disputes and recovery.
Stablecoins and blockchain networks may provide useful settlement options for some machine-to-machine payments. Traditional banks and payment networks remain important where legal protections, reversibility, local-currency access and established controls matter. The likely outcome is a hybrid system, not one rail replacing all others.
The future question is not whether AI can move money. It is whether we can build a financial system in which every automated payment has clear authority, an auditable reason and an accountable party.
Frequently asked questions
Can an AI agent transfer money without human approval? Technically it can be connected to payment systems. Whether it should be allowed depends on delegated authority, provider controls, law and transaction risk. Safer designs use limits and step-up approval.
Are AI agents legally responsible for payments? An AI agent is not automatically a separate legal person. Responsibility must be analysed through the people and organisations that deploy, operate, provide or execute the service, together with applicable contracts and laws.
What is agentic finance? Financial activity in which AI agents interpret objectives and carry out multi-step tasks, potentially including payment initiation, within delegated authority.
Will stablecoins become the main payment method for AI agents? Not necessarily. Stablecoins may suit some global, digital and programmable use cases, while banks, cards and tokenised deposits may be better elsewhere. Costs, regulation, liquidity and reversibility matter.
What is the biggest risk? Excessive permissions, compromised credentials, manipulated instructions, model errors, poor oversight and weak dispute processes can combine. The greatest danger is an agent able to make and execute a mistake at scale without independent controls.
How should a company introduce AI payment agents? Start with read-only or payment-preparation tasks. Then test low-value execution under allowlists, spending limits, short-lived credentials, independent policy checks, human escalation, monitoring and incident response.
Sources and Further Reading
Bank of England and Financial Conduct Authority, "Artificial intelligence in UK financial services – 2026", 26 October 2026. Survey evidence on AI agent deployment and autonomy among respondents, including the 80%, 46%, 22%, 2% and 9% figures. Read the report (opens in a new tab).
International Monetary Fund, Sonja Davidovic and Hervé Tourpe, "How Agentic AI Will Reshape Payments", IMF Note 2026/004, 24 April 2026. The intent, authorisation and settlement framework, and the risks to payment systems. Read the note (opens in a new tab).
Monetary Authority of Singapore, "Safeguards for Agentic Finance at Runtime (SAFR)", 3 July 2026. A proposed framework for authorising agent actions, human oversight and records at the point of decision. Read the paper (opens in a new tab).
Financial Stability Board, "Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report", 10 June 2026. Proposed practices for governing AI across its lifecycle; a consultation, not final rules. Read the report (opens in a new tab).
Google Cloud, "Powering AI commerce with the new Agent Payments Protocol (AP2)", 17 September 2025. The AP2 protocol and its signed mandates as evidence of user intent. Read the announcement (opens in a new tab).
Visa, "Visa Introduces Trusted Agent Protocol: An Ecosystem-Led Framework for AI Commerce", 14 October 2025. How merchants can tell legitimate AI agents from malicious bots. Read the release (opens in a new tab).
Visa, "Visa Announces New AI, Stablecoin and Token Innovations to Power Intelligent, Programmable Commerce at Visa Payments Forum", 10 June 2026. Visa's directory of verified agents and merchants. Read the release (opens in a new tab).
Mastercard, "Mastercard launches Agent Pay for Machines to unlock super-fast, always-on payments", 10 June 2026. Payments between AI agents and machine-driven services. Read the release (opens in a new tab).
x402 Foundation, "x402". The HTTP-native payment standard for internet-native payments between clients and servers. Read the documentation (opens in a new tab).
Visa and Artemis, "Agentic Payments from the Ground Up: What the Onchain Data Tells Us", last updated 14 July 2026. Further reading on on-chain agent payment activity, in research commissioned and funded by Visa. Read the research (opens in a new tab).
World Economic Forum, "AI Agents in Action: A Playbook for Trusted Adoption, Authorization and Scaling", 26 May 2026. Further reading on delegation, authorisation and oversight. Read the playbook (opens in a new tab).
Google for Developers, "Getting started with Universal Commerce Protocol on Google". Further reading on an open standard for agentic commerce. Read the documentation (opens in a new tab).
Editorial note
This article is for general information and education, not legal, investment, tax, cybersecurity or financial advice. Regulatory status and product availability vary by jurisdiction and may change. Industry announcements and proposed frameworks are not proof of universal deployment or regulatory endorsement.
The Bank of England figures describe survey respondents, not the whole UK financial sector. The cost example in section 5 uses illustrative assumptions, not industry averages.
Sources last checked on 4 November 2026.
