When an autonomous artificial intelligence agent executes a financial transaction on behalf of a human user, establishing legal and financial responsibility must begin with the pre-approved mandate established by that individual. According to Dmytro Rukin, CEO of cross-border payment infrastructure firm LaFinteca, navigating the complexities of machine-driven commerce requires a clear division of accountability among all participating parties. In his view, the user remains answerable strictly for the limits they establish, the agent provider is responsible for ensuring the AI stays within those boundaries, and both merchants and payment service providers carry the burden of executing the rigorous verification checks that only their systems can perform.
The operational reality of agentic payments is no longer a theoretical concept confined to research laboratories; it is actively reshaping global financial architecture. On March 25, 2026, a major global card network announced the rollout of live agentic payment capabilities across Latin America and the Caribbean in collaboration with 17 financial institutions. According to the network’s official release, every single transaction processed under this initiative is authorized through initial cardholder consent.
Yet, this technological leap has brought a profound legal question to the forefront of the financial sector: Who answers for a payment when no human finger pressed a button to confirm the final checkout?
Regulators are racing to address the vacuum. The United Kingdom’s Financial Conduct Authority (FCA) formally highlighted this dilemma in its Payments Regulatory Priorities report, published on March 25, 2026. Shortly thereafter, HM Treasury launched a formal consultation on July 14, 2026, specifically examining whether existing legal frameworks governing consumer consent and financial liability must adapt to accommodate automated agents acting independently on behalf of individuals and enterprises.
What Counts as Consent When a Machine Pays?
For an industry accustomed to explicit, real-time human authorization for every single transaction, the concept of machine-driven spending challenges foundational regulatory definitions. Rukin proposes that true consent in the age of autonomous agents cannot be improvised at the moment of purchase; rather, it must be established as a pre-conditioned permission framework agreed upon before the agent initiates any activity.
This framework is built upon four distinct, enforceable boundaries: a strict financial amount cap, a designated and limited set of approved merchants, a defined time window after which the permission automatically lapses, and an accessible cancellation mechanism that the user can trigger within seconds. Rukin’s foundational test for this permission model is straightforward: any objective third-party observer reading the mandate parameters should be able to determine, without ambiguity or guessing, whether a specific transaction fell strictly within the authorized boundaries.
How Does Brazil’s Pix Automático Handle It?
The theoretical mechanics of pre-authorized, recurring automated payments are already operating at scale in emerging markets. On June 16, 2025, the Central Bank of Brazil officially launched Pix Automático, an instant payment infrastructure designed to streamline recurring financial obligations. Under this system, a payer authorizes a corporate entity just once directly within their banking application. During this initial setup, the user can establish a maximum debit amount and retain the right to cancel the arrangement at any time.
According to the Brazilian central bank, once this foundational consent is established, subsequent payments execute automatically without requiring authentication for each individual billing cycle. While Pix Automático was originally engineered to handle predictable monthly utility bills and subscriptions, financial technologists note that its structural architecture provides a clear blueprint for how future AI agent mandates could be governed and deployed safely.
What Does the UK Already Have That Works the Same Way?
Financial regulators do not necessarily need to invent an entirely new legal taxonomy from scratch to govern machine consent, as existing open banking frameworks already operate on strikingly similar principles. Variable Recurring Payments (VRPs) in the United Kingdom function through the exact same logic. Under a VRP arrangement, a bank customer provides a payment provider with a binding mandate featuring predetermined limits agreed upon well in advance, retaining the full ability to view, amend, or terminate the arrangement whenever they choose.
The commercial scheme for VRPs went live on June 2, 2026, and according to data from the FCA, VRPs rapidly captured approximately 16 percent of all open banking payment volume by June of that same year.
"People in London talk about agent consent as if it needs inventing," observes Dmytro Rukin. "You already have it. A VRP mandate is a set of rules a person agreed before the money moved. Give the agent the same rules and the same cancel button."
Who Carries the Loss When the Agent Gets It Wrong?
As CEO of LaFinteca, a specialized enterprise moving business payments seamlessly between Latin America and Europe, Rukin approaches the liability debate from a pragmatic commercial perspective. Rather than leaving the question exclusively to legal theorists, he suggests that financial losses should systematically fall upon the entity that was best positioned to prevent the error from occurring in the first place.
Under this proposed doctrine, the user assumes the financial loss if the AI agent stayed strictly within the boundaries of the pre-agreed mandate. Conversely, the agent provider must carry the loss if the autonomous software violated those parameters and stepped outside its authorized scope. Merchants take on the financial risk if they ignored visible limits or processed a transaction explicitly flagged as agent-initiated in violation of established protocols, while payment service providers are held accountable if a transaction exceeding the pre-set financial cap is mistakenly cleared through the network.
"Whoever could have stopped the mistake most cheaply should pay for it," Rukin asserts. "Card disputes have worked roughly that way for decades. The agent just adds one more seat at the table."
What Should Merchants and Payment Teams Set Up Now?
The commercial reality is that agentic commerce is actively arriving at UK digital checkouts and international platforms long before policymakers have finalized a comprehensive regulatory rulebook. To prepare for this inevitable transition, Rukin advises merchants and payment infrastructure teams to implement four practical adjustments immediately.
First, businesses should store every customer mandate using clear, plain-text fields that the user can easily read back and verify. Second, payment systems must maintain a secure, timestamped audit log detailing precisely what the AI agent was authorized to accomplish and the explicit business rationale behind every purchase it executes. Third, refund mechanisms must be streamlined into a frictionless, two-tap process to accommodate automated dispute resolutions. Finally, payment teams must ensure that the specific "agent-initiated" transaction flags already transmitted by card networks during the authorization phase are successfully preserved and passed through their internal order and refund records.
Rukin’s overarching stance is that long-term trust in digital payments has always rested securely on clear consent and defined limits. As artificial intelligence begins executing transactions independently, these foundational rules must simply be agreed upon by a human being before a single unit of currency changes hands.
FAQ
What are agentic payments?
Payments that an artificial intelligence agent independently initiates and completes on behalf of an individual or business, strictly operating within pre-approved permissions established by that person beforehand.
Do UK rules already cover AI agent payments?
Only partially. Throughout 2026, both the Financial Conduct Authority and HM Treasury initiated formal policy work to examine whether existing legal frameworks governing consumer consent and liability require formal updates to accommodate autonomous agents.
Who pays if an AI agent buys the wrong thing?
In Dmytro Rukin’s framework, financial liability falls upon whichever party was in the best position to prevent the error—ranging from the user operating within their mandate to the agent provider whose software stepped outside of its bounds.
Comments (0)