AI Agents Trigger New Payments Regulatory Questions

Google’s release of its Agent Payments Protocol marks an incremental shift in how commerce will operate, and toward an automatic future when it comes to transactions.

In its announcement of Agent Payments Protocol, Google outlines a framework in which artificial intelligence (AI) agents can initiate transactions on behalf of users.

PYMNTS coverage in the wake of that September announcement explains the model as one that enables agents to compare products, act on delegated instructions and complete purchases without a human clicking to confirm.

For banks and payments providers, this introduces a payer type the system never anticipated.

The Way it Stands Now

The payments ecosystem is built on the assumption that the payer is a person. Identity verification, authentication, Reg E error-resolution rules, card network liability and fraud models all rely on human initiation.

AP2 breaks the assumption. Once a user delegates a task to an AI agent, that agent may need to complete a transaction autonomously. This raises fundamental questions about identity, liability and consent that today’s rules do not answer.

Bringing AI agents into the transaction flow raises questions that current regulations and network rules do not address. Whose know-your-customer rule governs the action when an autonomous agent triggers a payment? Under Reg E, who is liable if an agent misinterprets an instruction? Should a dispute be evaluated as user-authorized or agent-initiated? And what happens if the agent operates outside its intended scope?  As PYMNTS noted here, and citing Spreedly, businesses have similar apprehensions about AI payments. Spreedly reports that 22% of executives worry about losing control or transparency.

AP2 may expose where gaps will appear first. The ambiguity extends to fraud scoring. Risk models built around human behavior do not have a baseline for agent behavior, making it difficult to flag anomalies reliably.

Delegation Becomes a Control Issue

Banks understand human-to-human delegation in settings like business accounts and authorized spenders. Delegation to software is different. AI agents make decisions based on learned patterns that update over time, which means static authorization rules may no longer be sufficient.

Financial institutions will need explicit permission structures for agent-initiated actions. These may include spending thresholds, merchant category restrictions, white-listed providers, time-based constraints and forced human confirmation above certain levels. Without constraints, risk assessments become unreliable and disputes become difficult to resolve.

One likely response may be the creation of agent-specific accounts or sub-wallets. These would separate an agent’s activity, permissions, analytics and risk profile from the user’s main account. Agent wallets could inherit certain attributes from the user while maintaining their own boundaries and audit trails.

This separation provides risk and fraud systems with a clearer behavioral baseline. It also supplies the audit transparency regulators may require if agent decisioning leads to payments. In effect, an agent wallet allows banks to treat an AI agent as a distinct transactional entity rather than an invisible extension of the user.

Machine-Readable Checkout

Merchants will also need to adapt. Checkout flows were created for humans. AI agents do not view screens or interpret user interface cues. AP2 anticipates this by encouraging machine-readable mechanisms that agents can parse deterministically.  As PYMNTS Intelligence has noted, in the report “AI’s New Age: Building Human Intent and Trust Into Agentic AI,” nearly one-third (32%) of Gen Z consumers say they’re comfortable letting AI agents purchase on their behalf.

Regulatory considerations follow. Authorities have spent years addressing dark patterns aimed at consumers. But what constitutes a dark pattern when the consumer is an AI agent optimizing for cost or speed remains unclear. Merchants will need to understand how agents interpret purchase flows to avoid unintended compliance issues.

Because autonomous agents will act across issuers, networks, processors and merchants, the industry will examine shared standards to avoid fragmentation. AP2 marks a step toward normalizing payments for nonhuman actors. As  agent-driven commerce scales, the changes required will be foundational.