As AI agents begin to make payments on people’s behalf, payment providers face a question that cyber security alone cannot answer: what stops an agent from making a transaction its user never agreed to, and who carries the liability if it does?

The concern is widely shared. Some 78 per cent of financial institutions expect fraud to increase significantly as agentic commerce grows, while 85 per cent say their current systems and scaling plans are not prepared for it, figures shared by xpate, the global payments and banking platform, during Cybersecurity Awareness Month.

Sofia Khatsernova, legal function owner at xpate, argues that autonomy for AI in finance has to come with limits written in from the start.

“You can’t give AI autonomy in finance without building in constraints. Legal and compliance teams will need to define clear boundaries around what these systems can do, how decisions are documented, and where liability sits,” she said.

Consent that keeps pace

For Khatsernova, the bigger shift is in how consent works. A single agreement at sign-up is not enough when software is acting on a customer’s behalf over time.

“Consent also needs to evolve, not as a one-time agreement, but as something more dynamic and granular, with built-in safeguards that prevent autonomous systems from acting beyond the authority users have granted them,” she said.

That points to three practical tasks for payment providers: setting clear limits on what an AI agent may initiate, being able to trace and document the decisions an autonomous system makes, and settling in advance where liability falls when an agent executes a payment without proper authorisation.

As agent-initiated payments move from pilots towards everyday use, the providers that answer those questions early are likely to find it easier to win the trust of both regulators and customers.

The post Who is Accountable When an AI Agent Makes a Payment? appeared first on The Fintech Times.