Agentic AI & the Payments Stack: Are industry initiatives enough? 

The diagram illustrates an example agentic commerce workflow in which an AI agent is tasked with purchasing a laptop on a user's behalf. It shows how different protocols may be invoked at various stages of the transaction: MCP to access relevant data and tools, A2A to coordinate with specialist agents, ACP or UCP to support interaction with merchant systems and complete the purchase, and x402 where a machine-initiated payment is required. The protocols listed are non-exhaustive and may be used in different combinations depending on the tasks and systems involved.

The agentic commerce stack: authority, technology and liability

Understanding how these protocols fit together is important as technical architecture increasingly determines how an agent can act and, in turn, raises questions about consent, authorisation and liability.

This architecture will vary depending on the agentic commerce model deployed, but it can broadly be understood through the various interconnected layers of software including APIs together with technical standards. These components are interconnected rather than necessarily forming a fixed, sequential stack. They may also be combined within a single platform or provided by different commercial operators.

Therefore, responsibility cannot be considered solely at the level of the underlying AI model. Different participants may control different parts of the transaction and have different contractual obligations. Ultimately, responsibility will depend on each participant's role and conduct, contractual commitments and applicable law.

Machine-driven, machine-speed commerce – KYC to KYA

As well as developing tools for identifying human authorisation as a means of fraud detection the reality is that machines may be driving purchasing themselves. This is particularly the case in low-value, high-volume automated payments such as retail transactions and automated subscriptions. Reducing exposure to liability across the value chain is no longer just a matter of verifying human identity and focus needs to expand from "know your customer" (KYC) to "know your agent" (KYA). KYA means being able to establish that an agent is genuine, on whose behalf it acts and the scope of the authority it has been given. Card schemes are developing mechanisms to support this: Mastercard's agentic commerce framework, for example, provides for agent registration and verification, tokenised credentials and the exchange of information about consumer intent. 

UK policymakers are also considering how agent identity and authority should be established and evidenced. The Financial Services AI Adoption Plan published by HM Treasury has identified standardised KYA protocols and machine-to-machine authentication as areas for further development. The Monetary Authority of Singapore has proposed safeguards for agentic finance that contemplate recognising agents and establishing their mandates and authority. Taken together, these developments suggest that KYA will be a core building block for trusted agentic commerce and not an optional add-on to the tech stack.

Authentication without a human – the SCA brick wall

To date, regulatory approaches to tackling payment fraud have mainly focused on verifying that an individual customer or user providing a payment instruction is who they purport to be. The central pillar of this in the UK and EU is the application of "strong customer authentication" or "SCA", a detailed set of technical regulatory standards for a particularly robust, albeit prescriptive, form of multi-factor authentication. These requirements are triggered when the user of a payment service (e.g. a cardholder or account holder) initiates a transaction, accesses the account online, or takes actions remotely that could create a risk of fraud (e.g. updating personal details or account settings). These derive from aspects of EU law which have been retained by the UK, with only relatively minor changes to date. 

SCA is one of the most significant regulatory hurdles for agentic payments in Europe, as it is premised on a human's possession (e.g. a device), knowledge (e.g. a passcode) and/or inherence (e.g. facial recognition). While there are exemptions from SCA, such as for low-value transactions, safe-listed payees, and secure corporate processes for corporate customers of a payment services provider, there is no general exclusion or exemption for customers using an AI agent to initiate a payment instruction. 

Until the regulatory framework provides a clear route for authenticating agent-initiated payments, European agentic commerce is likely to remain "human in the loop" – with customers stepping in to authenticate transactions rather than agents operating fully autonomously across the payments value chain.

For this reason, SCA is perhaps the most important area of payments regulation to be reviewed as the UK charts a course toward leadership in agentic commerce. It is helpful that HM Treasury has identified authentication standards specifically as an area on which it welcomes views for unlocking agentic payments in the UK.

The links between authorisation, liability and legal personality

How does a merchant, a payment services provider or an AI provider demonstrate that a human user gave the proper authority to an AI agent to conclude a purchase or provide a payment instruction on their behalf? What happens if the user claims that the agent misunderstood a command, made a mistake or took an unauthorised step? Where does loss fall and liability strike?

An agent's authority – its scope and extent, and how to evidence it - is a long-running question. Generally, under English law, a principal will be liable for the actions of its agent for so long as the agent is acting within the scope of the authority given to it. If that agent exceeds its authority, the principal may not be bound unless the agent had apparent authority. However, this rule depends on the agent having legal personality, which AI models currently lack. The Mills Review urged a review of the regulatory perimeter to address this liability issue. Further, the Law Commission has floated the "radical" option of granting AI systems some form of legal personality, similar to an incorporated company in which shareholders can be held accountable. 

The distinction between technical capability and authority is critical here when considering our technology stack of agentic AI. A protocol may enable an agent to invoke a payment capability, but that does not establish that the agent is authorised to do so. The customer's mandate should define the authority granted, while permission controls should determine the exercise of that scope. The effectiveness of those controls will depend on how they are designed and enforced. If an unauthorised purchase occurs, identifying where the failure arose may require tracing how the mandated authority was communicated, implemented and acted upon across the different components of the payments value chain.

In the absence of fraud, the argument is distilled to one of disputed liability. Risk can be allocated at a contractual level through supply chain rigour and critical third-party regimes, but a default solution for error and unintended purchases is still to be solved for. Fraud is a different matter altogether and the courts have held a firm line that contracting parties cannot exclude or restrict liability for their own fraud, regardless of the strength of their bargaining power or how explicit they make their documents. 

The payments sector is on the threshold of transformation and agentic AI is pulling it forward at breakneck speed. 

However, the current fragmented architecture for agentic commerce does not map neatly onto existing payment rules and frameworks in the UK or more broadly in the EU. Whilst card schemes and Big Tech are beginning to address some of these challenges through standards for agentic payments, their frameworks primarily address card-based payments and cannot resolve every issue across the merchant ecosystem.

We have seen that technical protocols can evidence a mandate, verify an agent and facilitate payment, but they cannot determine how liability itself should be allocated when an agent misinterprets an instruction or acts beyond its authority, nor can they resolve for SCA requirements built for a human payor. Contracts may allocate some of that risk within, but not consistently across, the value chain and would be subject to lengthy and costly enforcement processes.

UK policymakers and regulators have listened and identified as high priority the need for resolution - for clear mandates, defined transaction parameters, robust audit trails and an appropriate allocation of liability across the value chain. 

The task now is for those same UK regulators and policymakers to translate these principles into a framework that reflects the realities of agentic commerce. As broader issues of AI liability loom large, the time has now come for the UK to confront the challenge head-on and write a definitive answer at speed.

Authors: Fiona Ghosh, Partner; Max Savoie, Partner; Patricia Wade, Expertise Counsel; Nilesh Ray, Associate.

The information provided is not intended to be a comprehensive review of all developments in the law and practice, or to cover all aspects of those referred to.
Readers should take legal advice before applying it to specific issues or transactions.