Sebastien Rousseau
Get in touch ›

Agentic Payments in Banking: Consent, Liability, and the New Payment UX in 2026

Agentic payments are changing the payment UX from human-clicked transactions to delegated, bounded, auditable AI execution — forcing banks to redesign consent, authentication, dispute handling, and liability.

5 min read

Agentic Payments in Banking: Consent, Liability, and the New Payment UX in 2026

Agentic payments have crossed from presentation deck into live-market evidence. Mastercard and Rabobank completed an AI agent-initiated payment in the Netherlands, where an agent booked a coffee tasting on Priceless.com without accessing card details directly and with explicit consumer consent recorded before execution (Association of Corporate Treasurers). The strategic issue for banks is now consent architecture: how a financial institution proves that a machine payment was genuinely authorised by the human or corporate principal behind it.

Executive Summary / Key Takeaways

  • The first market signals are live. Mastercard and Rabobank completed a Netherlands AI-agent transaction using Mastercard Agent Pay, with the agent prevented from directly accessing card data (Association of Corporate Treasurers).
  • Agentic payment protocols are emerging before the law has settled. Fenwick identifies AP2, A2A, x402, MCP, and MPP as protocol efforts addressing agent interoperability and authorisation (Fenwick).
  • Consent is the core banking problem. AP2-style cryptographic mandates attempt to capture user instructions and final approval as auditable evidence of intent (Fenwick).
  • Liability remains unresolved. Existing payment law was designed around human-decided transactions, not autonomous AI systems acting under delegated authority (Fenwick).
  • The UK is already adapting policy. HM Treasury says it will explore how payment-services regulation should adapt to AI-agent payments (GOV.UK).
  • The new UX is not checkout. It is agent-to-merchant negotiation, bounded authority, tokenised credentials, passkeys, spend limits, and dispute evidence generated before money moves.
  • Banks need an agent-control plane. The bank that cannot verify agent identity, mandate scope, behavioural anomaly, and transaction provenance should not allow the payment to settle.

Why 2026 Is the Year This Became Strategic #

The banking industry has automated payments for decades, but agentic payments are qualitatively different. Autopay executes a standing instruction; an agentic payment system can choose the merchant, timing, price, rail, and funding source within a goal set by the user. Fenwick defines the category as payment transactions initiated, managed, and executed by adaptive AI systems acting autonomously with delegated authority (Fenwick).

The UK policy signal matters because it places agentic payments inside mainstream payments regulation rather than treating them as an AI novelty. GOV.UK says the government will consult on enabling safe adoption of AI agents to conduct payments on behalf of consumers and businesses (GOV.UK).

The 2026 Architecture Baseline #

1. Verifiable Intent Becomes the Payment Primitive #

The decisive shift is from credential possession to intent proof. A card number, token, API credential, or account-access permission does not prove that the customer intended this specific payment. Fenwick notes that AP2 uses cryptographically signed mandates to record upfront scoped instructions and final approval, creating an audit trail of user intent (Fenwick).

2. Agent Identity Must Be Bank-Grade #

A payment initiated by an AI agent needs an identity model stronger than a browser session. The bank must know whether the request came from the authorised agent instance, whether the agent was operating within approved scope, and whether the action chain was tampered with.

3. Liability Requires Pre-Transaction Evidence #

Fenwick highlights uncertainty around EFTA and Regulation E, including whether granting an AI agent account access constitutes actual authority and what happens when the agent violates user instructions (Fenwick). The answer for banks is not to wait for courts. It is to collect evidence before settlement.

4. Fraud Controls Move from User Authentication to Agent Behaviour #

A fraudster does not need to steal the customer’s card if they can manipulate the customer’s agent. Banks therefore need controls around prompt injection, merchant spoofing, tool-permission escalation, agent-to-agent collusion, anomalous spend patterns, and malicious recommendations.

5. Payment UX Becomes Negotiated and Delegated #

J.P. Morgan expects agentic commerce to begin with repeat, low-risk categories before moving into higher-value purchases such as tickets and automobiles (J.P. Morgan). That sequencing matters: banks should start with bounded, reversible, low-ticket experiences and only widen authority when the evidence model works.

Strategic Architecture Table #

Layer 2026 Direction Banking Opportunity Risk if Mishandled
Consent mandate Cryptographically signed instruction and final approval Reduced dispute ambiguity Mandates untested by regulators or courts
Agent identity Signed agent instance and bounded tools Prevents credential misuse Spoofed or hijacked agents initiate valid-looking payments
Tokenisation Agent never sees raw card/account credentials Limits credential exposure False sense of safety if mandate scope is weak
Liability evidence Pre-settlement audit trail Improves dispute handling No evidence when customer challenges payment
Merchant integration Agent-readable catalogue, price, and policy APIs Frictionless commerce Manipulative merchant prompts or dark patterns

What This Means by Bank Type #

Retail Banks #

Retail banks should begin with low-risk agentic payment journeys, strong spend limits, passkeys, tokenised credentials, and clear dispute rules. The goal is not maximum autonomy; it is bounded autonomy customers can trust.

Corporate Banks #

Corporate banking needs a stronger model because delegated agents may initiate supplier payments, FX conversions, travel bookings, or procurement orders. Approval chains, treasury policy, and mandate expiry must be embedded into the transaction itself.

Payment Networks #

Networks can become the trust layer for agentic commerce if they provide tokenisation, mandate verification, merchant attestations, and liability rules that banks can adopt consistently.

Regulators #

Regulators should clarify how existing consent, authentication, unauthorised-payment, and money-transmission rules apply when a machine chooses the payment details.

Conclusion #

Agentic payments are the natural next step after embedded payments, but they require a new control model. The bank must verify not only who the customer is, but what authority the customer delegated, whether the agent stayed within that authority, and whether the transaction evidence can survive a dispute. The winning architecture is not an AI chatbot with a payment button. It is a consent, identity, tokenisation, and liability system wrapped around autonomous execution.

Questions? Answers.

What is an agentic payment?

An agentic payment is a payment initiated, managed, or executed by an AI system acting with delegated authority from a user rather than by the user clicking through each transaction step.

Why is consent difficult?

Consent is difficult because many payment laws assume a specific transaction authorised by a human. An AI agent may decide transaction details later within a broader instruction, which creates ambiguity.

Can tokenisation solve agentic payment risk?

Tokenisation helps because the agent does not need raw credentials, but it does not prove that the agent was authorised to make the specific transaction.

Where should banks start?

Banks should start with low-risk, low-value, bounded use cases where mandates, spend limits, dispute evidence, and customer controls can be tested safely.

References #

Last reviewed .