Agentic Commerce in Banking: Who Pays, Who Is Liable and Who Speaks for the Customer

When an AI agent in agentic commerce in banking rebooks a flight, settles a supplier invoice or switches a household subscription on a customer’s behalf, the foundational assumption of digital payments changes: the transaction is no longer triggered by a human clicking a checkout button, but by a software agent invoking a prior delegation. For the card-issuing bank, this shift raises three operational questions that directly govern interchange revenue, fraud losses and client retention: who actually speaks for the customer at the merchant’s checkout, how is payment approval cryptographically enforced, and who bears liability when an agent acts outside its mandate? We analyzed why six global banks published joint principles and why major retail platforms block unverified bots in When the Agent Does the Shopping: Six Banks, Five Principles and Amazon's Closed Door; early production pilots and agent identity verification are covered in Agentic Commerce Goes Live: What Autonomous Payment Agents Mean for Banks and Know Your Agent: The New Verification Step Between Customer, AI Agent and Bank. This article examines the architecture from the issuing bank’s perspective: how Visa and Mastercard payment approval protocols work under the hood, how liability is allocated under PSD2, and how agentic commerce reshapes card lifecycle management and fraud prevention.

The Bank as Mandate Grantor: Why Payment Approval Is More Than Storing a Card on File

In agentic commerce in banking, an AI agent must never shop with a raw 16-digit card number; the issuing bank evolves from a passive payment processor into the grantor of cryptographically scoped customer mandates.

If a cardholder types a static Primary Account Number (PAN) directly into an external AI assistant, the issuing bank loses visibility into whether a subsequent charge was initiated by the human cardholder, by an authorized shopping agent or by a compromised script. At the same time, Article 64(1) and (2) of the Revised Payment Services Directive (Directive (EU) 2015/2366, PSD2) stipulates that a payment transaction is considered authorized only if the payer has given consent to execute the payment transaction in the form agreed with the payment service provider; under Article 97 PSD2, remote electronic payment transactions generally require Strong Customer Authentication (SCA) that dynamically links the transaction to a specific amount and payee.

This regulatory requirement defines the bank’s new role as mandate grantor. Instead of exposing a static card number, the bank translates the client’s instruction (“Book a direct return flight to Zurich up to EUR 320 within the next 48 hours”) into a machine-readable, cryptographically signed payment mandate. For a broader look at how autonomy levels are governed across banking use cases, see Agentic Banking Explained: What AI Agents in Banks Can Already Do.

How Visa, Mastercard and Six Global Banks Secure Agent-Initiated Payments

Visa Intelligent Commerce, Mastercard Agent Pay and the Six-Bank Principles Paper converge on three technical building blocks: RFC 9421 cryptographic HTTP signatures, scoped network tokens and biometric Payment Passkeys.

A close look at the technical specifications published by the global card networks shows how payment approval in agentic commerce is structured in 2026:

1. Cryptographic Agent Recognition at the Edge (IETF RFC 9421): Both the Visa Trusted Agent Protocol (TAP) and the Mastercard Agent Pay Acceptance Framework with Web Bot Auth build on IETF RFC 9421 (HTTP Message Signatures). Every certified agent signs its HTTP requests using a private key registered in the payment network’s directory. Merchants and Content Delivery Networks (CDNs) verify this signature during browsing and checkout before payment credentials are ever exchanged.

2. Scoped Network Tokens and Signed Payment Containers: Under Visa Intelligent Commerce (VIC) and the Mastercard Agentic Commerce Guide (Levels 1 to 3), certified agents never handle raw card numbers. Instead, they receive agent-bound network tokens scoped to a single purchase, a specific merchant category or a spending cap. At Levels 2 and 3, the agent submits a cryptographically signed Agentic Payment Container (Visa) or Payment Data Object with a DSRP cryptogram (Mastercard) bound via the exact same nonce to the HTTP message signature — preventing credential extraction or replay attacks.

3. Verifiable Intent and the Five Principles of the Six Banks: In the Mastercard Agent Pay Trust Framework Whitepaper (2026), tokenization is paired with Verifiable Intent: an open cryptographic framework combined with Payment Passkeys that produces tamper-resistant proof of the exact item, budget and timing approved by the consumer, sharing only the required fields with each party via selective disclosure. This technical foundation aligns directly with the joint paper Building Trust in Agentic Commerce, published on 22 September 2026 by ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia, ING Group and NatWest Group (NatWest Group Press Release, ING Announcement), which establishes five shared pillars: Transparency, Safety, Privacy and Data Protection, Customer Choice and Interoperability.

Practical template for your team: Download our Executive Guide: PFM, Transaction Data & Visa/Mastercard Mandate 2026 (PDF) and the Banking CDP & AI RFP & Architecture Checklist 2026 (Excel) — or explore our Banking Whitepaper Hub.

Who Pays and Who Is Liable: Four Verification Scenarios Across PSD2, Merchant and Issuer

Whether an agent-initiated payment counts as authorized by the payer or triggers a mandatory refund under Article 73 PSD2 depends on whether the payment protocol proves both the agent’s identity and the cardholder’s scoped mandate.

For card risk teams and dispute operations at an issuing bank, agentic commerce in banking breaks down into four distinct verification scenarios:

• Scenario 1 – Purchase within the signed client mandate: The registered agent authenticates via an RFC 9421 signature, presents a valid agent-bound token and stays within the budget, merchant category and time window confirmed via a Payment Passkey. The transaction is authorized under Article 64 PSD2; Visa and Mastercard tag the authorization with a dedicated Agentic Transaction Identifier so issuer fraud models can distinguish legitimate agent purchases from malicious bot traffic (Visa Perspectives).

• Scenario 2 – Agent exceeds price, merchant category or time limit: If the agent finds a flight or hotel that exceeds the approved mandate by EUR 40, the token-scope check flags the discrepancy prior to settlement. Instead of declining the card outright and triggering fraud friction, the bank sends a real-time step-up prompt to the banking app via Payment Passkey, letting the customer approve the difference with a single biometric tap or reject it.

• Scenario 3 – Unregistered or compromised bot: If the RFC 9421 signature is missing, the nonce between header and payment container mismatches or the agent ID is revoked, the merchant CDN and issuer fraud engine block the transaction immediately. If an unauthorized debit were ever posted without valid payer consent, the payment service provider’s refund obligation under Article 73(1) PSD2 applies (no later than the end of the following business day).

• Scenario 4 – Client revokes the mandate: Under Article 64(3) PSD2 and the Customer Choice principle of the six global banks, cardholders must be able to view and revoke any active agent delegation inside their banking app at any time. Because the agent holds only an isolated agent-bound token, the bank invalidates that token instantly without re-issuing the physical plastic card or disrupting the customer’s other recurring subscriptions.

Impact on Card Lifecycle Management, Top-of-Wallet Status and Fraud Prevention

Once AI agents execute routine purchases, top-of-wallet status is no longer won by card artwork at checkout, but by the bank whose card can be provisioned, governed and adjusted most seamlessly as an agent mandate.

For card portfolio and Customer Value Management (CVM) teams, agentic commerce reshapes every stage of the card lifecycle:

Illustration: AI-generated, hypothetical example

Hypothetical example: A frequent traveler wants her personal travel agent to book rail tickets and hotels autonomously up to EUR 400 per trip without exposing her primary credit card number. Inside her mobile banking app, she sets up a “Travel Mandate” in thirty seconds: through the network token service, the bank provisions an agent-bound token restricted to travel merchant category codes (MCCs) and a EUR 400 single-transaction limit, confirmed with her biometric Payment Passkey. Two weeks later, when the agent attempts to book a hotel in Zurich for EUR 445, the bank does not silently decline the card. Instead, it surfaces a real-time card on her banking app home screen: “Your travel agent wants to book Hotel Zurich for EUR 445 (mandate limit: EUR 400). Approve one-time increase?” One biometric tap completes the purchase — preserving interchange revenue, avoiding a false-positive card block and keeping the bank’s card at the top of the agentic wallet.

ACCELERAID enables banks and card issuers to process these transaction, token and mandate signals in real time across its Customer Data Platform, Context Layer, Personalization Engine and AI Assistant for card lifecycle orchestration, real-time alerts and customer service; specialized Domain Agents, Orchestration and Control Plane capabilities are currently in development. The platform is SOC 2 Type I certified (independently audited against SOC 2 Type I), follows GDPR by design, is built for DORA-regulated institutions, provides audit-proof logging and is hosted in an ISO 27001-certified data center in Frankfurt (or on-premise) (ACCELERAID).

Five takeaways

1. In agentic commerce in banking, the issuing bank shifts from a passive payment processor to a mandate grantor that provisions cryptographically scoped network tokens instead of exposing raw 16-digit card numbers (Visa Intelligent Commerce, Mastercard Agent Pay).

2. Both the Visa Trusted Agent Protocol (TAP) and Mastercard Web Bot Auth rely on IETF RFC 9421 HTTP message signatures and nonce-bound payment containers so merchants and issuers can separate certified shopping agents from malicious bots.

3. Verifiable Intent paired with biometric Payment Passkeys creates tamper-resistant cryptographic proof of the exact item, budget and time window approved by the cardholder (Mastercard Trust Whitepaper 2026).

4. The September 2026 joint principles paper from ASB, Bank of America, Capital One, CBA, ING and NatWest (NatWest Press Release) alongside Articles 64 and 73 PSD2 requires visible, revocable customer mandates and authentication governed by the risk-bearing bank.

5. In card lifecycle management, top-of-wallet status goes to the issuer that resolves mandate overruns via real-time in-app step-up prompts and revokes individual agent tokens without canceling the physical card.

Next Step for Your Banking Architecture (3 Ways to Explore)

• 1. Self-Service Assessment (Ungated): Download the Executive Guide: PFM, Transaction Data & Visa/Mastercard Mandate 2026 (PDF), the RFP & Architecture Template (Excel, DE/EN) and the 3-Year TCO & ROI Calculator (Excel). Explore all 12 guides in our Banking Whitepaper Hub.

• 2. Asynchronous Deep Dive: Watch our On-Demand Webinars or review Platform & Packages to see how banks deploy card lifecycle, context and decisioning within 90 days.

• 3. Joint Architecture Review: Book a 30-Minute Architecture & Use-Case Check tailored to your card portfolio or agentic payments roadmap.

Illustration: AI-generated. AI-assisted content: We use AI technologies and automated agents in the creation of our articles, including from Microsoft, Google, OpenAI, Anthropic and other providers. Topics, editorial direction and final approval remain with our team.