Six banks have warned that agentic commerce is moving from closed trials into live pilots before governance, consumer protections and responsibility for failed transactions have been fully defined.
ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia, ING Group and NatWest Group published five shared principles on September 22 covering transparency, safety, privacy and data, choice, and interoperability. Their paper says AI-assisted transactions are already reaching early scale, while some activity is occurring outside formal industry protocols.
The document does not report a confirmed fraud event, data breach or measured rise in losses. It is a forward-looking risk assessment from institutions that issue cards, acquire merchant transactions and operate payment services. Its central accountability point is nevertheless immediate: AI agents can influence product and payment choices, handle credentials and execute purchases when customers are absent, but the records and liability paths needed to reconstruct those decisions are not yet consistent across the value chain.
AI agents add new authorization and fraud questions
The banks define agentic commerce as the use of AI agents to help make or facilitate payments between consumers and merchants. That can range from an agent conducting a search before a person checks out to an autonomous agent identifying a need and completing a purchase without final human review. The banks say the model can operate across cards, account-to-account payments and tokenized money.
Greater autonomy creates a control problem that a valid payment credential alone does not solve. Payment participants may need to establish who the agent represented, what spending authority the customer granted, which product and merchant were authorized, whether the agent changed any material terms, and which party introduced an error.
The paper identifies possible unsafe practices including agents requesting card details and entering them directly into websites, favoring payment methods with weaker protections, or failing to follow processing standards and scheme rules. It also describes possible attacks involving compromised or impersonated agents and merchants, along with new forms of social engineering. These are risk scenarios identified by the banks, not documented findings against a named provider.
The banks also warn that issuers and acquirers may lack timely access to data such as agent identity, the merchant of record, consumer intent and purchase details. Without those records, fraud investigation, recovery and dispute handling can become slower or inconclusive.
Commercial incentives could shape what an agent recommends
The transparency principle addresses more than disclosure that software is involved. The paper says consumers, merchants and other transaction participants should know when an AI agent is acting and on whose behalf. It also calls for visibility into how agents prioritize products and payment options, including sponsored placements and data use.
That matters because an agent provider could have incentives to select products or payment methods that generate higher commissions or lower its own costs. The banks say such choices could come at the expense of consumer value or merchants’ ability to compete. They do not allege that any particular platform is currently engaging in that conduct.
The choice principle similarly warns that devices, agents, marketplaces, wallets and payment networks could become gatekeepers. Potential restrictions include preferencing affiliated payment services, limiting an agent’s access to applications or browser functions, or imposing fees that make alternatives harder to use. At the same time, the paper recognizes that service providers may refuse integrations on safety, commercial-sustainability or legal grounds.
The principles are voluntary and leave implementation unresolved
The banks call for agents and payment providers to use secure, auditable methods for entering credentials and authorizing purchase intent and payment. Consumers should be able to view and manage the authority delegated to an agent. Parties with potential liability should be able to require authentication, while dispute processes should include all relevant participants and assign outcomes according to where risks or errors were introduced.
For data governance, the paper calls for auditable records of customer instructions, authentication, intent, transaction decisions and outcomes. It says access should be limited to what a participant needs to perform its function safely, with customer and merchant consent governing additional use or sharing. That creates a difficult operational balance: the ecosystem needs enough shared data to detect fraud and resolve disputes, without turning conversational prompts, identity data and shopping histories into broadly accessible records.
However, the paper explicitly says its principles are voluntary and non-binding. It does not prescribe conduct, an implementation method or a timetable. The banks plan a later paper on protocols, standards and policies and are inviting networks, technology providers, issuers, acquirers, regulators and other participants to respond.
For payment operators, the unresolved work is therefore more concrete than the high-level principles. Systems will need interoperable agent identification, enforceable delegation limits, authenticated purchase intent, tamper-evident decision logs, clear merchant-of-record data and dispute workflows that can reach the agent provider as well as the traditional issuer-acquirer chain. Until those controls are specified and tested, the industry’s ability to process an agent-initiated payment will remain ahead of its ability to explain and remedy one that goes wrong.