## Agentic AI and Payment Systems

## Source details

**Canonical URL:** [Agentic AI and Payment Systems](https://www.imf.org/-/media/files/publications/imf-notes/2026/english/insea2026004.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/imf-notes/2026/english/insea2026004.pdf.md)
- [Structured JSON version](/-/media/files/publications/imf-notes/2026/english/insea2026004.pdf.json)

---

### Executive Summary
- Agentic AI systems can interpret objectives, plan multistep actions, and interact with digital services with limited human intervention.
- In payments, this shift could move transaction initiation from explicitly human instructions toward agent‑mediated decision making.
- Adoption is at an early stage; experimentation by technology firms, payment networks, and financial institutions indicates agentic models will become increasingly relevant over time.
- The note frames design questions, architectural tensions, and risk channels that may warrant attention as adoption evolves.

### Three‑Layer Conceptual Framework
- Purpose: separate payment functionality into layers to clarify where agentic operation is productive and where rule‑based safeguards remain essential.
- Layers:
  - Layer (1) — intent formation and orchestration (probabilistic, upstream).
  - Layer (2) — authorization and control (deterministic policy boundary).
  - Layer (3) — settlement (deterministic legal finality).
- Central challenge: reconcile probabilistic, adaptive decision making with deterministic requirements of payment infrastructures.

### Emerging Standards and Market Signals
- Technical standards and frameworks cited as emerging to enable interoperability among autonomous agents and payment infrastructures:
  - Universal Commerce Protocol (UCP)
  - Agent Payments Protocol (AP2)
  - Agent-to-Agent (A2A) communication frameworks
  - Model Context Protocol (MCP)

### Agentic AI Capabilities and Use Cases in Payments
- Agentic systems increasingly able to recommend, initiate, coordinate, and manage financial operations under delegated authority.
- Potential capabilities and evolutions:
  - Evolution of e‑commerce toward agent‑mediated commerce.
  - Automated cross‑border payment flows and liquidity management.
  - Agentic compliance solutions enacting multistep compliance workflows.
- Operational expectations and metrics:
  - Gartner (2025) estimates AI agents can autonomously resolve up to 80 percent of common customer service issues by 2029.
  - LLM‑based agents shorten consumer interaction times in digital marketplaces (Yan and others 2025).

### Three‑Layer Model — Functional Roles and Standards
- Layer 1 — Intent and Orchestration
  - Functions: translate high‑level user objectives into structured instructions; reasoning, planning, search, negotiation, multi‑agent coordination without authorization or execution.
  - Standards/protocols mentioned: MCP, A2A Protocol, x402, Google’s UCP.
  - Industry pilots: Visa’s Intelligent Commerce; Mastercard’s Agent Pay.
- Layer 2 — Control and Authorization
  - Functions: enforce deterministic constraints; accept structured intent from Layer 1 only if verifiable mandates, policy constraints, and regulatory checks are satisfied.
  - Core mechanisms and standards:
    - AP2 (Agent Payments Protocol) with cryptographically verifiable mandates; x402 for stablecoin integration.
    - OAuth 2.0 and OpenID Connect for Know Your Agent verification.
    - Verifiable claim mechanisms: ERC‑1812.
    - Programmable wallet/account‑abstraction: ERC‑6900.
    - Agent identity/reputation: ERC‑8004.
  - Operational example: tokenized authorization allowing agents to initiate transactions using preapproved payment methods without accessing credentials (Stripe 2026).
- Layer 3 — Settlement
  - Functions: deterministic settlement infrastructures (RTGS, instant networks, card clearing engines, CBDC platforms, distributed ledger settlement rails) executing payment instructions with irrevocable legal finality.
  - Standards and technologies: ERC 4337 (launched in 2023) for smart contract wallet execution; subject to BIS CPMI‑IOSCO Principles for Financial Market Infrastructures when applicable.
  - Role: final non‑probabilistic endpoint — executes only instructions that passed Layer 2 controls, without modification.

### Mapping Payment Journey (selected mappings)
- Intent and context management: LLMs; MCP; ACP — Layer L1.
- Agent coordination: A2A Protocol — Layer L1.
- Commerce workflow orchestration: Universal Commerce Protocol — Layers L1 + L2.
- Delegation and authorization: AP2; OAuth 2.0; OpenID Connect — Layer L2.
- Agent identity (know your agent): ERC 780; ERC‑8004; AP2 verifiable agent credentials — Layer L2.
- Programmable settlement controls: ERC 4337; ERC 6900; ERC 1812 — Layer L2.
- Programmable money and digital asset rails: DLT; smart contract layers; regulated token frameworks — Layer L3.
- Traditional payment rails: RTGS, credit card platforms — Layer L3.

### Risks, Gaps, and Key Risk Channels
- Delegating payment initiation to autonomous agents introduces operational, legal, and systemic risks, including:
  - Misaligned incentives.
  - Model errors (hallucinations, nondeterminism).
  - Highly correlated automated behaviors across markets (algorithmic herding).
  - Authorization traceability challenges.
  - Opacity in agent decision processes.
  - Cybersecurity vulnerabilities.
  - Unresolved legal and liability questions.
- Specific risk observations:
  - Nondeterminism: identical prompts can yield different outputs; successive model generations reduce but do not eliminate hallucinations (Omar and others 2025).
  - Data concentration: agents require sensitive user data creating concentrated points of vulnerability (Aldasoro and others 2024).
  - Market structure: agents sweeping funds to high‑yield accounts may eliminate the “inertia dividend” and intensify bank competition (McKinsey & Company 2025c).
  - DLT settlement without statutory recognition risks loss of legal finality.

### Risk Classification (selected entries from Table 3)
- Instruction gap (structural vs transactional authorization)
  - Primary source: Account holders delegating broad mandates; AI agents executing payments without transaction‑level instructions.
  - Who bears cost: Account holders; PSPs; payment systems.
  - Market failure? Yes.
- Opacity of agent decision making
  - Primary source: Non‑interpretable models; platforms integrating agents.
  - Who bears cost: Users; PSPs; supervisors.
  - Market failure? Yes.
- Highspeed, machine‑time payment execution
  - Primary source: AI agents and platforms optimizing execution speed; inadequate throttling.
  - Who bears cost: PSPs; payment systems; end users.
  - Market failure? Yes.
- Correlated agent behavior (herding)
  - Primary source: Homogeneous models and shared optimization objectives.
  - Who bears cost: Payment systems; PSPs; end users.
  - Market failure? Yes.
- Cybersecurity and attack surface expansion
  - Primary source: Platforms integrating agents with multiple tools/APIs; weak access controls.
  - Who bears cost: Users; PSPs; payment systems.
  - Market failure? Yes.
- DLT settlement without legal finality
  - Primary source: Deploying DLT without statutory settlement recognition.
  - Who bears cost: Users and intermediaries; legal system.
  - Market failure? Yes.
- Regulatory blind spots (KYA, supervision, monitoring)
  - Primary source: Regulators lagging technological change; cross‑border platform operations.
  - Who bears cost: Financial system at large; regulators.
  - Market failure? Yes.

### Mitigation Strategies
- Governance and architectural safeguards
  - Formal AI governance: accountability, risk controls, lifecycle monitoring, transparency, board‑level oversight (NIST 2023).
  - Architectural separation: agents propose actions; deterministic execution layer performs compliance checks and executes final transactions (Acharya 2025).
  - Lifecycle measures: internal AI risk committees; model risk management adapted for agentic systems.
- Systemic measures
  - Human‑in‑the‑loop supervision for high‑risk/high‑value transactions; transaction thresholds requiring human approval and manual override mechanisms (Chiris and Mishra 2025).
  - Ex‑ante interruption and containment mechanisms (“kill switches”) embedded as layered, distributed controls with graduated responses and auditability (Qin and others 2024; Russu 2025).
  - Caution: human approval can introduce delays that increase liquidity risks; human‑in‑the‑loop is not sufficient alone under time‑compressed scenarios.
- Private sector measures
  - Payment networks: agent‑ready card products with embedded spending controls; global agent registries with identity verification and reputation scoring; dispute resolution frameworks; open protocol standards (Singh 2025).
  - Digital wallet providers: “agent‑ready” capabilities, passkey/biometric authentication in conversational interfaces, preserve merchant relationships (Singh 2025).
  - Financial institutions: real‑time access to clean data; holistic function mapping for AI integration; invest in AI‑capable teams (RegTechLab 2025; Uppuduri 2025).
  - Cybersecurity: strong authentication, scoped authorization, secure API governance (Errico, Ngiam, and Sojan 2025).
- Public sector measures
  - Shift from Know‑Your‑Customer to Know‑Your‑Agent frameworks linking verifiable identities for financial bots to legal entities (WEF 2026).
  - Develop authentication frameworks verifying both AI agent identity and delegated user authority; leverage auditability, logging, and explainability.
  - Treat agentic AI as part of critical digital infrastructure: real‑time monitoring, AI activity logs, automated alerts, incident reporting, and AI‑related supervisory skills (FSB 2025; Schmitz, Rystrøm, and Batzner 2025).
  - Allow supervised testing (regulatory sandboxes) before full market deployment.
  - Encourage regulatory coordination and harmonization; reference Singapore’s model governance framework for agentic AI (IMDA 2026).
  - Consider AI‑related regulation such as the EU’s AI Act (European Union Artificial Intelligence Act 2024).

### BOX 1 — Illustrative Market Experimentation with Agentic Payment Workflows
- Market experimentation highlights:
  - OpenAI/Stripe: OpenAI’s “Instant Checkout” in ChatGPT enables in‑conversation purchases; introduced a new economic model in early 2026 charging a 4 percent transaction fee for autonomous agent‑led conversions (Stripe 2025).
  - Amazon: “Buy for Me” enables the Rufus assistant to navigate external websites and complete transactions on behalf of the customer.
  - Google: Launched Universal Commerce Protocol in January 2026 enabling “Native Checkout” within Google Search’s AI Mode and Gemini.
  - Visa and Mastercard: Visa’s “Intelligent Commerce” and Mastercard’s “Agent Suite” launched in the second quarter of 2026 with Know Your Agent frameworks.
  - PayPal: 2026 acquisition of Cymbio positions PayPal as a “trust layer” for the agentic web.
- Automated cross‑border and liquidity use cases:
  - Agents orchestrate multistep workflows across distributed financial networks: initiation, routing optimization, compliance checks, and exception monitoring (Convera 2025; Capco 2025).
  - BIS pilots: generative AI systems can perform cash management functions without specialized training (BIS 2025).
  - FX management: agents continuously monitor rates and optimize timing and rails (Uppuduri 2025).
  - Stablecoin rails and DLT may be leveraged; AP2 enables stablecoin integration (Desai 2025).
- Agentic compliance and operational experimentation:
  - Embedded regulatory logic across workflows; real‑time monitoring, explainability, and audit trails.
  - Industry examples: Mastercard’s “Decision Intelligence” (Mastercard 2024); Visa’s real‑time risk‑scoring for account‑to‑account payments (Visa 2026).
- Risks observed in experimentation:
  - Consumer autonomy risks, model herding, generative errors and opacity, data security and concentration, infrastructure incompatibility, crypto/stablecoin volatility, skills and legal gaps.

### Policy and Governance Implications
- Impact depends on technology and institutional design choices as experimentation continues.
- Key policy considerations:
  - Preserve deterministic authorization and settlement to maintain legal finality and systemic stability.
  - Develop interoperable identity, authorization, and audit frameworks (Know‑Your‑Agent).
  - Strengthen supervisory capabilities: monitoring frameworks, testing environments, and AI governance standards.
  - Legal frameworks should explicitly recognize and safeguard settlement finality for new technologies at the settlement layer, including DLT.

### Conclusion — Final Assessment
- Agentic AI could structurally shift financial system architecture by enabling machine‑speed, delegated payment initiation and management.
- Potential positive outcomes if safeguards are implemented:
  - enhance efficiency,
  - reduce friction in cross‑border payments,
  - expand financial access.
- Potential negative outcomes without safeguards:
  - introduce new operational and systemic risks (misinterpreted intent, market volatility amplification, cybersecurity and liability challenges).
- Central challenge: integrate agentic technologies into payment systems while preserving trust, legal certainty, and financial stability.

*Source: IMF Note (insea2026004).*

### Executive Summary ......................................................................................................

### Executive Summary

### Overview
- Agentic AI systems can interpret objectives, plan multistep actions, and interact with digital services with limited human intervention.
- In payments, this shift could move transaction initiation from explicitly human instructions toward agent‑mediated decision making.
- Adoption remains at an early stage, but experimentation by technology firms, payment networks, and financial institutions shows that agentic models will become increasingly relevant over time.
- The note frames design questions, architectural tensions, and risk channels that may warrant attention as adoption evolves.

### Three‑Layer Conceptual Framework
- A normative analytical lens separates payment functionality into three layers to clarify productive agentic operation versus where rule‑based safeguards remain essential:
  - Layer (1) — intent formation and orchestration.
  - Layer (2) — authorization and control.
  - Layer (3) — settlement.
- The framework highlights the central challenge of reconciling probabilistic, adaptive decision making with the deterministic requirements of payment infrastructures.

### Emerging Standards and Market Signals
- Recent technical standards and frameworks cited as emerging to enable interoperability among autonomous agents and payment infrastructures:
  - Universal Commerce Protocol (UCP)
  - Agent Payments Protocol (AP2)
  - Agent-to-Agent (A2A) communication frameworks
  - Model Context Protocol (MCP)

### Agentic AI Capabilities and Use Cases in Payments
- Agentic systems are increasingly able not only to recommend transactions but also to initiate, coordinate, and manage financial operations under delegated authority.
- Potential capabilities and evolutions discussed include:
  - Evolution of e‑commerce toward agent‑mediated commerce.
  - Automated cross‑border payment flows and liquidity management.
  - Agentic compliance solutions that can enact multistep compliance workflows.

### Risks, Gaps, and Key Risk Channels
- Delegating payment initiation to autonomous agents could introduce new operational, legal, and systemic risks, including:
  - Misaligned incentives.
  - Model errors.
  - Highly correlated automated behaviors across markets.
  - Authorization traceability challenges.
  - Opacity in agent decision processes.
  - Cybersecurity vulnerabilities.
  - Unresolved legal and liability questions.
- The note emphasizes tension between adaptive, probabilistic agent behavior and deterministic payment rails that rely on predictable rules, legal certainty, and clear accountability.

### Risk Classification and Systemic Considerations
- The note reviews risks and classifies them (Table 3 referenced in source) to inform mitigation priorities.
- It highlights potential systemic implications from correlated agent behavior and the speed at which agentic systems can act.

### Mitigation Strategies
- Emerging mitigation approaches discussed include:
  - Mandate‑based authorization.
  - Architectural separation of decision making and execution.
  - Agent identity frameworks.
  - Programmable payment controls.
  - Audit trails.
  - Tiered human‑in‑the‑loop models.
- Mitigation strategies span:
  - Systemic measures.
  - Private sector measures.
  - Public sector measures.

### Policy and Governance Implications
- The impact of agentic AI on payments will depend not only on technology but also on institutional design and governance choices as experimentation continues.
- The note does not propose prescriptive measures but aims to frame the key design questions and risk channels for policymakers, infrastructure operators, and private actors.

### Conclusion
- Agentic AI represents a possible structural shift in financial system architecture by enabling machine‑speed, delegated payment initiation and management.
- Over time, agentic models are likely to become more relevant in payments, requiring careful design of safeguards to maintain trust, legal certainty, and financial stability.

*Prepared by Sonja Davidovic and Hervé Tourpe; April 2026.*

### conclusions or propose prescriptive policy measures. Instead, it takes stock of emerging developments and

### Agentic AI and Payment Systems

### Background — Motivation and Scope
- Emerging agent-mediated payment use cases shift from explicitly human-initiated transactions (“click-to-pay”) toward agent-mediated decision processes (“decide-to-pay”), in which execution increasingly occurs at machine speed and across multiple layers of the payment value chain.
- Industry actors involved in experimentation include payment networks, technology platforms (for example, open-source software such as Ethereum), and AI model providers; experimentation is expanding across use cases from fraud detection and compliance monitoring to treasury optimization and cross‑border payment orchestration (Boston Consulting Group 2025).
- Innovation velocity: developments that once required years can now materialize within months, indicating more rapid and substantive change could be imminent.
- Central architectural challenge: core payment infrastructures are built on deterministic logic (predictability, auditability, legal enforceability) while agentic AI systems rely on probabilistic reasoning and adaptive decision making that can yield different outcomes under similar conditions.
- The paper introduces a three‑layer model to assess appropriate scope for integrating agentic AI into payment workflows.

### What Is Agentic AI?
- Definition: autonomous systems that sense their environment, set goals, and perform multistep tasks with little human input.
- Examples:
  - Household: track gas tank levels, identify cost‑effective supplier, arrange automatic refill.
  - Warehouse: detect incoming deliveries, retrieve billing information, initiate payment instructions per predefined protocols.
  - BIS note: AI agents can independently manage liquidity and prioritize payments within real‑time gross settlement systems (BIS 2025).
- Distinguishing capabilities: planning, dynamic adaptation, tool orchestration; operate as self‑directed agents (FinRegLab 2025).
- Technology protocols and standards are evolving rapidly to enable AI agents to interact with any payment actor and data source.

### Brief History of AI in Payments (periodized findings)
- 1980s: Expert systems (e.g., American Express’ Authorizer’s Assistant) — rules‑based credit authorization and fraud detection using “if–then” logic.
- 1990s: Machine learning, early neural networks (e.g., Falcon Fraud Manager) — probabilistic fraud scoring and pattern recognition.
- 2000s: Graph analysis, anomaly detection (e.g., PayPal Igor and Ilya) — network based fraud and risk analysis.
- 2010s: Deep learning, biometrics (e.g., Apple Pay, Stripe radar) — biometric authentication, tokenization, AI-assisted KYC.
- 2020s: Foundation models, conversational AI (e.g., “Hello UPI” voice‑based UPI payments, India) — AI‑mediated payment initiation, customer interaction, and workflow automation; execution remains deterministic.
- New generation: Large Language Models (LLMs) power nondeterministic AI agents that sample from probability distributions; identical prompts can yield different outputs, raising implications for authorization, execution, and settlement.
- Nondeterminism risks include hallucinations; successive model generations show reduced hallucination rates but the risk remains (Omar and others 2025).

### Trustworthy Agents — Key Tensions
- Deterministic infrastructures (RTGS, card networks, instant platforms, distributed ledgers) vs. probabilistic agentic AI systems.
- Main risk: allowing adaptive systems to make irreversible payments without proper controls, checks, or accountability.
- Central issue: keep uncertain, probabilistic decision making separate from automatic payment execution.
- Control lever: concentrate probabilistic reasoning upstream and preserve deterministic authorization and settlement where legal finality and systemic stability are required.

### AI‑Payment Layered Model (three layers)
- Purpose: normative conceptual framework to separate probabilistic intent formation from deterministic authorization and settlement.

Layer 1 — Intent and Orchestration Layer
- Functions: translate high‑level user objectives (“intent”) into structured, machine‑readable instructions; reasoning, planning, search, negotiation, multi‑agent coordination without authorization or execution.
- Standards and protocols mentioned: MCP (Model Context Protocol), A2A Protocol, x402 (builds on HTTP 402), Google’s UCP (Google 2026).
- Industry pilots: Visa’s Intelligent Commerce, Mastercard’s Agent Pay — agents autonomously construct purchase intent under predefined limits.
- Classification: L1 in Table 2 for intent/context management, agent coordination, commerce workflow orchestration.

Layer 2 — Control and Authorization Layer
- Functions: enforce deterministic constraints so actions proposed by agents may proceed toward execution; ensure authorization decisions are governed by deterministic policy rules even when informed by upstream probabilistic systems.
- Core mechanisms and standards:
  - AP2 (Agent Payments Protocol): binds agent‑initiated actions to cryptographically verifiable mandates specifying scope, limits, actor identity, and permitted conditions; supports extension x402 enabling stablecoin integration.
  - OAuth 2.0 and OpenID Connect: used for Know Your Agent verification through attested agent identities (World Economic Forum 2026).
  - Verifiable claim mechanisms: ERC‑1812 for off‑chain signed attestations.
  - Programmable wallet/account‑abstraction: ERC‑6900 for spend limits, velocity controls, counterparty restrictions.
  - Agent identity and reputation: ERC‑8004 proposed for on‑chain agent registries.
- Operational examples: tokenized authorization mechanisms allowing AI agents to initiate transactions using a user’s preapproved payment methods without accessing credentials (Stripe 2026).
- Layer role: strictly rules‑based authorization boundary — accepts structured intent from Layer 1 only if verifiable mandates, policy constraints, and regulatory checks are satisfied; otherwise rejects or routes back to the agent.

Layer 3 — Settlement Layer
- Functions: deterministic settlement infrastructures (RTGS systems, instant payment networks, card clearing engines, central bank digital currency platforms, distributed ledger settlement rails) that execute payment instructions with irrevocable legal finality.
- Standards and technologies:
  - Settlement‑native technologies and standards: ERC 4337 (launched in 2023) for smart contract wallet execution; programmable wallets and token standards.
  - When corresponding to a financial market infrastructure, subject to BIS CPMI‑IOSCO Principles for Financial Market Infrastructures.
- Layer role: final non‑probabilistic endpoint — executes only instructions that passed deterministic controls in Layer 2, without modification, optimization, or reinterpretation; typically agentic algorithms do not operate here.
- Trade‑offs: constrained agentic functions at settlement layer introduce trade‑offs between efficiency and legal certainty.

### Mapping Payment Journey with the Three‑Layer Model (selected mappings from Table 2)
- Intent and context management: LLMs; MCP for contextual tool access; ACP connects buyer, their agent, and business — Layer L1.
- Agent coordination: A2A Protocol; multi‑agent orchestration frameworks — Layer L1.
- Commerce workflow orchestration: Universal Commerce Protocol — Layers L1 + L2.
- Delegation and authorization: AP2 (digitally signed mandates and proof of intent); OAuth 2.0; OpenID Connect — Layer L2.
- Agent identity (know your agent): ERC 780 claims registry; ERC‑8004 for identity and reputation registries; AP2 verifiable agent credentials — Layer L2.
- Programmable settlement controls: ERC 4337 smart contract wallets; ERC 6900 modular smart accounts; ERC 1812 off‑chain authorizations — Layer L2.
- Programmable money and digital asset rails: DLT; smart contract layers; regulated token frameworks — Layer L3.
- Traditional payment rails: Platforms for RTGS, credit cards — Layer L3.

### Implications of Functional Separation
- Near‑term value from agentic AI is concentrated upstream of settlement, where probabilistic reasoning supports optimization and orchestration.
- Settlement systems are unlikely to become “intelligent” in the agent sense; their core function remains deterministic finality, even when supporting conditional execution (e.g., smart contracts).
- Risk shift: from individual transaction correctness toward system‑level behavior.
- Layer 3 is treated as non‑probabilistic by design to preserve accountability and finality at system scale.

### Agentic AI Capabilities and Use Cases in Payments
- Agentic AI described as “digital factories” of AI agents handling entire tasks, with humans needed for exceptions and oversight (McKinsey & Company 2025b).
- Potential benefits:
  - Lower transaction and operational costs.
  - Improved liquidity and liquidity optimization.
  - Enhanced compliance processes and reduced fraud.
  - Removal of human latency and administrative friction, increasing money velocity and boosting productivity.
- E‑commerce evolution:
  - Agents replace simple automation with autonomous reasoning, accelerating transactions and possibly shifting consumption trends.
  - Potential to enhance financial inclusion by reducing search costs and information asymmetries (Cao 2026).
  - Agentic AI could increase money velocity by prioritizing low‑latency payment solutions and removing inefficiencies.
- Operational metrics and expectations:
  - Gartner (2025) estimates AI agents can autonomously resolve up to 80 percent of common customer service issues by 2029.
  - Evidence suggests LLM‑based agents significantly shorten consumer interaction times in digital marketplaces (Yan and others 2025).
- Post‑purchase agent functions: delivery coordination and returns management; automated returns processing and adaptive pricing mechanisms can reduce service costs and improve dispute resolution.
- Workforce considerations: agents could replace or augment operational roles (merchandising, supply chain management, product optimization), reducing operating costs and boosting productivity (Brynjolfsson, Li, and Raymond 2023).

*Source: IMF Note (insea2026004).*

### BOX 1. Illustrative Market Experimentation with Agentic Payment Workflows

### BOX 1. Illustrative Market Experimentation with Agentic Payment Workflows

### Market experimentation and emerging designs
- OpenAI/Stripe (Agentic Commerce Protocol)
  - OpenAI’s “Instant Checkout” in ChatGPT enables in-conversation purchases using standard merchant acquiring infrastructure.
  - Introduced a new economic model in early 2026, charging a 4 percent transaction fee for autonomous agent-led conversions (Stripe 2025).
- Amazon (Rufus and “Buy for Me”)
  - “Buy for Me” enables the Rufus assistant to navigate external websites and complete transactions on behalf of the customer, positioning the shopping agent as a primary interaction surface.
- Google (Universal Commerce Protocol)
  - Launched in January 2026; standardizes how businesses connect with AI agents across the shopping journey.
  - Enables “Native Checkout” within Google Search’s AI Mode and Gemini for purchases from retailers like Etsy and Wayfair without leaving the AI surface.
- Visa and Mastercard (Network-Level Control)
  - Visa’s “Intelligent Commerce” and Mastercard’s “Agent Suite” launched in the second quarter of 2026.
  - Focus on “Know Your Agent” frameworks providing registration, cryptographic signatures, and network tokens to distinguish legitimate agents from malicious bots.
- PayPal (Cymbio Infrastructure)
  - Through its 2026 acquisition of Cymbio, PayPal positions itself as the “trust layer” for the agentic web, allowing independent agents to use PayPal’s transaction graph and secure vaults while maintaining merchant-of-record status for the retailer.

### Automated cross-border payment flows and liquidity management
- Agentic AI capabilities observed:
  - Orchestrate multistep workflows across distributed financial networks: payment initiation, routing optimization (correspondent banks, local partners, tokenized rails), compliance checks, and monitoring settlement/post-settlement exceptions.
  - Dynamically select payment paths and adjust to context (costs, fees, channel performance) using real-time transaction data and past experiences (Convera 2025; Capco 2025).
  - Autonomously manage liquidity: reallocating funds based on predefined parameters and real-time market conditions.
- BIS findings and pilots
  - BIS: generative AI systems can fulfill cash management functions such as maintaining precautionary liquidity buffers, prioritizing urgent payments, and balancing liquidity costs vs settlement delays without specialized training (BIS 2025).
  - Citi and Ant International piloted an AI-powered tool aimed at reducing FX-hedging costs (Reuters 2025).
- FX management and forecasting
  - Agentic AI can continuously monitor real-time exchange rates, analyze spreads across banking rails, optimize timing for conversion, and choose cost-effective multi-currency transfer paths (Uppuduri 2025).
  - LLMs can extract signals from unstructured data to enhance predictive analytics for liquidity planning and foreign-exchange management.
- Infrastructure convergence and stablecoins
  - Network initiatives (SWIFT Global Payments Innovation, Visa B2B Connect) set the stage for agents to leverage various rails across jurisdictions (Scalefocus 2025).
  - Stablecoin rails and DLT functionalities may be leveraged by agents; protocols such as AP2 enable stablecoin integration (Desai 2025).
  - Potential to power a more inclusive and efficient “internet financial system” (WEF 2025).

### Agentic compliance solutions
- Capabilities
  - Embed regulatory logic directly into operational workflows: interpret objectives, monitor activity in real time, and autonomously act within predefined guardrails (flagging, escalation, adjusting controls).
  - Continuous monitoring, explainability, and audit trails enable compliance at the speed and scale of modern digital systems.
- Industry examples
  - Mastercard’s “Decision Intelligence” evaluates transactions in milliseconds for fraud risk allowing real-time compliance screening at transaction speed (Mastercard 2024).
  - Visa’s real-time risk-scoring solution for account-to-account payments scores transactions in milliseconds to automatically approve, decline, or flag transactions (Visa 2026).
- Architectural approaches
  - Academic prototype: reference architecture for agentic AI handling AML and KYC with integrated explainability and traceability (Axelsen, Licht, and Damsgaard 2025).
  - Identity safeguards such as provenance verification and policy-based access control embedded into code (Preis 2026).
- Multi-agent and federated coordination
  - Specialized agents can distribute compliance tasks (regulatory change scanning, risk scoring, control mapping, remediation) coordinated by an orchestrator handling delegation, conflict resolution, fallback, and prioritization (Onyekaonwu, Igba, and PeterAnyebe 2024).
  - Proposed three-layer framework: intent/orchestration layer, control layer, settlement layer with agents initiating checks, scanning requirements, and issuing validations respectively.

### Risks and gaps
- Consumer autonomy and behavioral risks
  - Agentic systems may misinterpret user intent, optimize provider incentives over user welfare, drift from objectives, or engage in behavioral nudging at scale (Aldasoro and others 2024).
  - Personal finance apps have been criticized for recommending cash advance offers or promoting borrowing when user balances dip (Aldasoro and others 2024).
- Model behavior and systemic market risks
  - Algorithmic herding: dominant models identify identical market signals, synchronized execution could trigger flash crashes bypassing circuit breakers (Ogbuonyalu and others 2024).
  - High correlation in agents’ behavior poses systemic risks; synchronized liquidity demand can amplify procyclicality and congest payment rails (BIS 2024).
- Generative model errors and opacity
  - Hallucinations and black-box behavior complicate accountability and redress; opacity reduces supervisors’ capacity to detect systemic risks in time (Aldasoro and others 2024).
- Data security, privacy, and concentration risks
  - Agents require sensitive user data (bank credentials, credit card numbers, crypto wallet keys), creating concentrated points of vulnerability (Aldasoro and others 2024).
  - AI supply chains show high concentration from data centers to cloud computing and AI applications, raising innovation and stability concerns (Korinek and Vipra 2025; BIS 2025).
- Market structure and bank competition
  - Agents continuously sweeping funds to high-yield accounts can eliminate the “inertia dividend,” forcing banks to compete on value instantly (McKinsey & Company 2025c).
- Integration and infrastructure challenges
  - Legacy banking infrastructure incompatibility requires substantial investments in upgrades and data migration (Scalefocus 2025).
  - High-speed FX execution at scale may worsen liquidity and intraday volatility, per high-frequency trading evidence (IMF 2025).
- Crypto and stablecoin-specific risks
  - Crypto asset volatility and custodial risks when converting to cryptocurrencies for settlement; stablecoins have experienced peg instability and reserve-related counterparty risk under stress (FSB 2023; Financial Stability Board 2022; IMF 2025).
- Skills, authentication, and legal gaps
  - Growing skills gap in financial sector for professionals combining financial expertise and advanced AI knowledge (Uppuduri 2025; FinRegLab 2025).
  - Authentication/KYC frameworks designed for human users are challenged by autonomous agents; verifying agent identity and user intent is complex (Acharya 2025).
  - Ambiguity on legal liability for autonomous agents and difficulty distinguishing “unauthorized use” from “user negligence” if an agent hallucinates (Shukanayev 2025; Aldasoro and others 2024).

### Risk classification (selected entries from Table 3)
- Instruction gap (structural versus transactional authorization)
  - Primary source: Account holders delegating broad mandates; AI agents executing payments without transaction-level instructions.
  - Who bears cost: Account holders; PSPs; payment systems.
  - Market failure? Yes. Information and control asymmetry; misalignment between legal authorization models and agentic execution.
- Opacity of agent decision making
  - Primary source: AI developers and deployers designing non-interpretable models; platforms integrating agents into payment flows.
  - Who bears cost: Users; PSPs; supervisors.
  - Market failure? Yes. Information asymmetry and unverifiable decision processes.
- Highspeed, machine-time payment execution
  - Primary source: AI agents and platforms optimizing execution speed; inadequate throttling by PSPs.
  - Who bears cost: PSPs and payment systems; end users.
  - Market failure? Yes. Externalities from speed amplification and coordination effects.
- Correlated agent behavior (herding)
  - Primary source: Homogeneous models and shared optimization objectives across agents.
  - Who bears cost: Payment systems; PSPs; end users.
  - Market failure? Yes. Coordination externalities and systemic risk.
- Cybersecurity and attack surface expansion
  - Primary source: Platforms integrating agents with multiple tools/APIs; weak access controls.
  - Who bears cost: Users; PSPs; payment systems.
  - Market failure? Yes. Security externalities and under-investment in resilience.
- DLT settlement without legal finality
  - Primary source: System designers deploying DLT without statutory settlement recognition.
  - Who bears cost: Users and intermediaries; legal system.
  - Market failure? Yes. Legal infrastructure gap and jurisdictional fragmentation.
- Regulatory blind spots (KYA, supervision, monitoring)
  - Primary source: Regulators lagging technological change; platforms operating across borders.
  - Who bears cost: Financial system at large; regulators.
  - Market failure? Yes. Public good nature of supervision and cross-border coordination problems.

### Mitigation strategies
- Governance and architectural safeguards
  - Implement formal AI governance structures: accountability, risk controls, lifecycle monitoring, transparency, and board-level oversight (NIST 2023).
  - Architectural separation of decision-making and execution layers: agents propose actions; deterministic execution layer performs compliance checks and executes final transactions (Acharya 2025).
  - Lifecycle measures: internal AI risk committees, model risk management adapted for agentic systems.
- Systemic measures
  - Human-in-the-loop supervision for high-risk or high-value transactions; transaction thresholds requiring human approval, supervisory dashboards, and manual override mechanisms (Chiris and Mishra 2025).
  - Ex-ante interruption and containment mechanisms (“kill switches”) embedded as layered, distributed controls with graduated responses, clear authority, auditability, and containment strategies to localize impact (Qin and others 2024; Russu 2025).
  - Caution: human approval may introduce delays that increase liquidity risks; human-in-the-loop is not sufficient alone, especially under time-compressed scenarios.
- Private sector measures
  - Payment networks: agent-ready card products with embedded spending controls and real-time budget management; global agent registries with identity verification, reputation scoring, and fraud monitoring; dispute resolution frameworks for AI-initiated transactions; open protocol standards for interoperability (Singh 2025).
  - Digital wallet providers: deploy “agent-ready” capabilities, agent-friendly authentication using passkeys and biometric verification in conversational interfaces, preserve merchant relationships so merchants remain merchant of record (Singh 2025).
  - Financial institutions: enable real-time access to clean, consistent data; map functions holistically for AI integration; invest in training and recruitment to build AI-capable teams (RegTechLab 2025; Uppuduri 2025).
  - Cybersecurity: strong authentication, scoped authorization, and secure API governance to mitigate expanded attack surfaces (Errico, Ngiam, and Sojan 2025).
- Public sector measures
  - Shift from Know-Your-Customer to Know-Your-Agent frameworks linking verifiable identities for financial bots to legal entities (WEF 2026).
  - Develop authentication frameworks verifying both AI agent identity and delegated user authority; leverage technologies enabling auditability, logging, and explainability for payment agents.
  - Treat agentic AI as part of critical digital infrastructure: real-time monitoring systems for anomalies, AI activity logs and audit trails, automated alerts for abnormal behaviors, incident reporting and disclosure policies, and AI-related supervisory skills (FSB 2025; Schmitz, Rystrøm, and Batzner 2025).
  - Allow supervised testing (regulatory sandboxes) of agentic payment systems before full market deployment.
  - Encourage regulatory coordination and harmonization to preempt spillovers and fragmentation; note Singapore’s model governance framework for agentic AI providing guidance on ex-ante risk assessment, limits on agent powers, human accountability checkpoints, technical controls across the agent lifecycle, and end-user transparency (IMDA 2026).
  - Consider AI-related regulation such as the EU’s AI Act as a key mitigation strategy (European Union Artificial Intelligence Act 2024).

*Source: IMF Note — BOX 1. Illustrative Market Experimentation with Agentic Payment Workflows.*

### Conclusion

### Conclusion

### Transformative potential of agentic AI in payments
- Agentic AI represents a potentially transformative development for payment systems.
- Software agents that interpret objectives, coordinate transactions, and interact autonomously across digital services can significantly expand the automation of financial activity.
- Early experimentation shows that agentic systems can:
  - improve the efficiency of e-commerce transactions,
  - optimize cross-border payment routing,
  - enhance liquidity management,
  - support real-time compliance monitoring.

### Core design tensions
- Payment systems are built on deterministic infrastructures that guarantee predictability, accountability, and legal settlement finality. 10
- Agentic AI systems rely on probabilistic reasoning and adaptive decision making.
- Integrating agentic technologies requires careful architectural design to ensure automation does not undermine the core reliability of payment infrastructures.
- The three-layer framework proposed in this note reconciles these differences by separating probabilistic decision making from deterministic authorization and settlement:
  - Upstream: agentic interpretation of intent and coordination of actions (innovation concentrated here).
  - Downstream: rules-based authorization and legally final settlement (preserve execution safeguards).

### Salient risks
- Autonomous agents could:
  - misinterpret user intent,
  - amplify market volatility through highly correlated actions,
  - create new vulnerabilities in cybersecurity, identity management, and liability frameworks.
- Machine-initiated transactions challenge regulatory constructs built around human users, raising questions around authentication, accountability, and dispute resolution.
- The preservation of legal finality at the settlement layer, including for emerging technologies such as DLT, depends on explicit legal recognition and appropriate statutory safeguards. 10

### Mitigation measures and policy recommendations
- Coordinated action from private and public stakeholders is required.
- Financial institutions should:
  - invest in governance structures,
  - implement cybersecurity safeguards,
  - design technical architectures that separate agentic reasoning from payment execution.
- Payment networks and technology providers should:
  - develop trusted identity frameworks,
  - create interoperable standards for Know-Your-Agent verification and delegated authority.
- Regulators may need to adapt supervisory approaches, including:
  - monitoring frameworks,
  - testing environments,
  - governance standards for AI-mediated financial activity.
- Legal frameworks should explicitly recognize and safeguard settlement finality for new technologies at the settlement layer, including DLT. 10

### Final assessment
- The trajectory of agentic AI in payments will depend on technological capability and institutional design and governance choices.
- Potential positive outcomes if safeguards are implemented:
  - enhance efficiency,
  - reduce friction in cross-border payments,
  - expand financial access.
- Potential negative outcomes without safeguards:
  - introduce new operational and systemic risks.
- The central challenge for policymakers and industry participants is how to integrate agentic technologies into payment systems in a way that preserves trust, stability, and accountability in an increasingly automated financial ecosystem.

*IMF Note | Conclusion*

---


_Source: https://www.imf.org/-/media/files/publications/imf-notes/2026/english/insea2026004.pdf_