Yassineh PourebrahimSenior Technology Executive
ENفا
All articles
Agentic PaymentsBankingAI AgentsPayments Security

Agentic payments in 2026: how banks and card networks are learning to trust AI agents

Within a few days in October 2026, American Express, Mastercard, FIS, HSBC and Ant Digital each addressed the same question: when an AI agent pays, who authorized it, and to do what? How agent identity, signed purchase intent and scoped credentials are reshaping payment authorization, and what bank and fintech leaders should do now.

By Yassineh Pourebrahim · · 9 min read

For decades, card payments have rested on a simple assumption: a person is on the other side of the screen, pressing "buy". Agentic payments break that assumption. When an AI agent searches, chooses and pays on a customer's behalf, a valid card number no longer answers the questions that matter: which agent made this purchase, what was it allowed to do, and does the transaction match what the customer actually asked for?

In little more than a week of October 2026, several of the largest players in payments published their answers. On 8 October, Mastercard described new identity and fraud signals for its Agent Pay platform. On 9 October, Ant Digital Technologies and HSBC announced a test of AI-agent micropayments settled in tokenised bank deposits. On 13 October, American Express published its Intent Intelligence framework for capturing and authenticating purchase intent before an agent transacts. And on 16 October, the payments processor FIS argued that banks must now verify not only the credential but the agent behind it.

This article explains the trust stack that is forming around agentic commerce, separates live capability from published frameworks, and offers a practical playbook for banks and fintech teams.

Why agentic payments break the old authorization model

When Google announced the open Agent Payments Protocol (AP2) in September 2025, it framed the problem clearly: today's payment systems generally assume a human is directly clicking "buy" on a trusted surface, and autonomous agents break that assumption. AP2 sets out three questions every agent-initiated payment must answer: authorization (did the user give this agent authority for this particular purchase?), authenticity (does the request reflect the user's true intent?) and accountability (who is responsible if the transaction is fraudulent or wrong?).

FIS put the same problem in banking terms. In an interview published by PYMNTS on 16 October, Troy Mann, senior vice president of product management at FIS, said agent-driven volume is still small, but that "intent has to be expressed and captured". Banks will need to know which agent is using a credential, what it was authorized to do and whether the transaction matches the original mandate. The difficulty is that the evidence is fragmented: merchants know what the customer requested, AI platforms know the instructions given to the agent, and banks know the account, credential and transaction history. These signals do not yet travel together.

The emerging trust stack: four layers

Read side by side, the October announcements describe four layers that agentic payments need. No single company provides all of them yet.

1. Agent identity: "know your agent"

Before a merchant or bank can trust a transaction, it needs to recognise the agent. Visa's Trusted Agent Protocol, released in October 2025 and developed with Cloudflare, uses agent-specific cryptographic signatures built on the HTTP Message Signature standard. An approved agent can pass three kinds of information to a merchant: an indication that it is a trusted agent with intent to browse or buy, signals about whether the consumer already has a relationship with the merchant, and optionally payment data. Visa's stated goal is to help merchants distinguish legitimate agents from malicious bots without overhauling their sites.

Mastercard is taking a similar direction. Its October story on agent identity says the company is adding identity, fraud and behavioural insights to Agent Pay, including a probability score that helps judge whether a legitimate AI agent is on a site. It calls the broader foundation the Mastercard Agent Pay Trust Framework, combining identity with proof of intent, controls that define an agent's authority and secure transaction execution. Skyfire, a startup working with Mastercard, issues a know your agent (KYA) token that verifies who the agent is and who it is acting for.

2. Purchase intent as signed evidence

The second layer turns the customer's instruction into something that can be verified later. AP2 does this with mandates: tamper-proof, cryptographically signed records of the user's instructions. In a real-time purchase, the user's request is captured in an Intent Mandate and their approval of the final cart signs a Cart Mandate. For delegated tasks, such as buying tickets the moment they go on sale, the user signs a detailed Intent Mandate upfront with price limits and timing, and the agent can generate the Cart Mandate when the conditions are met. Google describes the result as a non-repudiable audit trail from intent to cart to payment.

American Express's Intent Intelligence framework, published on 13 October, pushes intent even earlier. Its Create Intent API captures the customer's instructions and constraints, such as merchant, maximum budget and preferences; the customer authenticates and signs off; and the system issues an Intent ID plus a Proof of Intent Token. That token is used to obtain a payment credential scoped to what the customer approved, which the agent uses instead of the real card number. Amex's argument is that making intent available to the issuer before the agent executes lets the issuer act as a control throughout the transaction. In an example Amex gave TechCrunch, if a customer asks for white Nike sneakers in size 9 and the agent tries to buy Adidas shoes, the transaction can be stopped.

3. Scoped credentials and programmable limits

Tokenisation already hides the real card number, but FIS's Mann calls it only a "major layer" of the answer. His proposal sounds counter-intuitive for an industry that has spent years removing friction: "a little bit of friction isn't a bad thing". One option is virtual cards designated for agentic commerce, restricted by amount, merchant, time window or other parameters, so the credential's permissions mirror the authority granted to the agent. Mastercard's Agent Pay for Machines, launched in June 2026, builds the same idea into the network: organisations set authorisation rules and spending limits that are programmatically enforced.

4. Settlement at machine speed

The last layer is money movement itself. Mastercard designed Agent Pay for Machines for high-frequency, low-value payments between agents and services, some of them fractions of a cent, with settlement across cards, accounts and stablecoins and more than 30 initial participants and supporters. The HSBC and Ant Digital test explored a bank-native alternative: an AI agent discovered a digital service, used it and paid a micropayment, often defined as less than $2, with real-time settlement in HSBC's Tokenised Deposit Service on Ant Digital's Jovay testnet, a Layer 2 blockchain environment. HSBC provided real-time risk checks through its MCP interface. AP2 also has an x402 extension, built with Coinbase and others, for agent-based stablecoin and crypto payments.

What is live and what is still a framework

As a technology executive, I find the direction convincing, but the maturity needs to be read carefully:

  • Volumes are small. FIS says agent-driven payment volume is still small, even though customers with stored credentials are already entering this ecosystem.
  • Frameworks are not integrations. American Express confirmed to Digital Commerce 360 that Intent Intelligence has no live integrations yet, and that its planned Agent Purchase Protection is not yet available.
  • Tests are not launches. HSBC and Ant Digital state that their test was a technical exploration, not a commercial launch or live customer proposition, and the announcement does not disclose transaction counts or values.
  • Standards are still competing. AP2, the Agentic Commerce Protocol co-developed by OpenAI and Stripe, Visa's Trusted Agent Protocol, Google's Universal Commerce Protocol and x402 all address overlapping parts of the flow. Amex says it is engaging with EMVCo and supporting the x402 Foundation; Visa says it is aligning with IETF, the OpenID Foundation and EMVCo.
  • The identity questions are open. NIST's National Cybersecurity Center of Excellence published a concept paper in February 2026 on software and AI agent identity and authorization. It asks how agents should be identified and authenticated, how to apply least privilege when an agent's actions are not fully predictable, how to delegate authority in "on behalf of" scenarios, how to log agent actions and intent in a tamper-proof way, and how to prevent prompt injection.
  • Customers are cautious. In an NMI survey of 1,000 US adults cited by Digital Commerce 360, 58% worried an AI shopping agent could buy the wrong item and 60% that it could spend more than intended.

A playbook for banks and fintech leaders

  1. Make agentic transactions visible. Flag agent-initiated payments and segment them in fraud scoring and reporting, which is what FIS says it is doing with financial institutions. You cannot manage a risk you cannot see.
  2. Treat intent as data. Store the mandate, Intent ID or equivalent evidence alongside the transaction record and make it available to disputes and chargeback teams. The dispute of the future is "the agent bought the wrong thing", and the evidence must exist before it happens.
  3. Issue scoped credentials, not master keys. Agent-specific tokens or virtual cards with amount caps, merchant locks and expiry dates contain the damage when an agent misbehaves.
  4. Bind the agent to the customer, and make revocation instant. Every agent credential should be traceable to a customer's authenticated consent, with least privilege by default and a one-click way to revoke it.
  5. Assume the agent can be manipulated. A language-model agent can be steered by prompt injection, which NIST lists among its core questions. Controls must sit outside the model: an issuer-side check that compares the purchase with the signed intent does not depend on the agent behaving well. The same principle applies to the guardrails described in my article on AI agents in production.
  6. Stay protocol-agnostic. With several protocols competing, put an abstraction layer between your core systems and agent protocols so you can support more than one without rewriting authorization logic.
  7. Crawl, walk, run. Keep humans involved in establishing intent and authorization at first, as FIS recommends, then extend autonomy only to low-risk categories where the metrics support it.
  8. Invest in real-time risk features. Agent identity scores, mandate matches and spending velocity are new signals for fraud models, and they need to be fresh at decision time. A feature store for real-time analytics is the kind of infrastructure that makes this practical.

Closing thought

Agentic payments will not scale because agents become smarter; they will scale when the financial system can prove what each agent was allowed to do. Identity, signed intent, scoped credentials and auditable settlement are becoming as important as the card number once was. Banks that start treating machine authority as a first-class part of their payment architecture now will be ready when today's small volumes become tomorrow's normal traffic.

References

Talk to me

Related articles

AI AgentsLLMGuardrailsEvaluation

AI agents in production: tool use, memory, guardrails and evaluation

What separates a reliable AI agent from an impressive demo: well-designed tools, deliberate memory, layered guardrails and an evaluation harness that tests behaviour, not just answers.

· 5 min read

Machine LearningMLOpsStreamingTrading

Feature stores and ML pipelines for real-time trading analytics

How to compute features once and serve them consistently for training and live inference, with point-in-time correctness, streaming aggregation and the latency budgets trading use cases demand.

· 5 min read

Physical AIRoboticsVision-Language-ActionHumanoid Robots

Physical AI in 2026: what vision-language-action models mean for robots at work

In mid-October 2026, Google, NEURA Robotics and Galaxea each showed a piece of the same picture: robot foundation models that see, reason and act. What has really changed, what is still vendor-reported, and how a technology leader should evaluate physical AI.

· 7 min read