What are agentic payments? The guide to autonomous AI transactions

Key takeaways

• 42% of merchants are already testing agentic commerce, and nine in ten say they’re actively preparing for it, according to a 2026 Checkout.com survey of more than 12,000 consumers and payments leaders across six countries.¹

• Agentic payments are transactions that an AI agent initiates, evaluates, and completes on a buyer’s behalf, operating inside spending rules the buyer sets in advance, rather than a person manually approving each purchase.

• Airwallex handles the global account infrastructure and API-ready rails that settle machine-initiated payments across borders, while platforms like Stripe and Gr4vy focus on the front-end checkout experience and orchestration layer.

AI agents are already researching, comparing, and buying things on behalf of consumers and businesses. That’s a real shift: transaction initiation moves from a human click to a machine decision, what the IMF calls the move from click-to-pay to decide-to-pay. ² This guide covers how agentic payments actually work, who is building the infrastructure behind them, and what finance leaders need in place before they hand an AI agent a spending limit.

Trend of agentic payments

Software agents are moving past search and chat, and they’re starting to execute transactions directly instead of just recommending them. In a growing number of cases, the visual checkout funnel gets skipped entirely. Checkout.com’s 2026 survey of more than 12,000 consumers and payments leaders found that 70% of merchants believe agentic commerce will be the most disruptive shift their industry has faced, and 76% expect payment providers to determine how fast it scales.

Traditional search engines indexed pages for people to browse. Generative AI tools skip that step and process intent directly instead, which is a bigger shift than it sounds. Agents don’t just surface options anymore. As Stripe puts it, they don’t assist with the purchase, they are the purchaser. ³

This matters because fraud systems weren’t built for it. Agentic traffic looks like bot traffic by default, and most agent-initiated transactions get declined today because there’s no reliable way to tell a legitimate, permissioned agent from an automated attack. Managing that transition means building a payment stack that can authenticate and route non-human checkouts without adding friction for the agents that are supposed to be there.

Understanding agentic payments

What are agentic payments?

Agentic payments are transactions initiated, managed, and executed by an AI agent acting on behalf of a buyer. ⁴ Instead of a human entering card details and clicking “buy,” the agent takes a high-level goal, compares merchant catalogues, and completes the checkout itself, operating inside boundaries the user set in advance: budget, delivery preferences, approved vendors.

The buyer is still on the hook for the spend. What’s changed is that the party actually initiating the transaction is software running at machine speed, not a person. A procurement manager, for example, can tell an agent to reorder office supplies whenever stock drops below 10%, then let it find the best price, verify the vendor, and pay the invoice without anyone signing off in the moment.

How agentic payments differ from autopay and recurring billing

It’s worth separating this from automation you already know. Autopay and recurring billing are rigid and rules-based: a fixed charge fires on a fixed schedule, regardless of whether anything about your situation has changed. Automation in payments isn’t new. Fenwick’s research notes that autopay has existed for years; what’s different is that agentic AI adds actual decision-making on top of the schedule.

An agent doesn’t run off a static script. It weighs live pricing, inventory, and market conditions, then decides whether, when, and where to pay. Raise your price, and the agent can pause the order, push back on terms, or just send the sale to a cheaper competitor.

Why an AI agent is not just a smarter payment bot

Web bots have handled ticket buying and scraping for years, but they run on brittle, hardcoded scripts that break the moment a site changes its layout or moves a checkout field. Hit an unexpected error or a multi-step dialogue, and a bot has no way to reason its way through it.

AI agents built on large language models handle the open web differently. They interpret what a page actually means, work around checkout errors, and adjust course mid-flow. That’s why fraud systems flag them by default in the first place: an agent making rapid, programmatic API calls looks identical to an automated attack unless the platform can verify who it’s acting for.

How big is the agentic payments market?

Adoption is moving faster on the merchant side than most finance teams expect. In Checkout.com’s 2026 survey of more than 12,000 consumers and payments leaders across six countries, 42% of merchants said they were already testing agentic commerce capabilities, and nine in ten said they were actively preparing for it in some form. Seventy percent called it the most disruptive shift their industry has faced, and a quarter of consumers said they’d stop using an agent altogether if a purchase turned out to be hard to dispute, which tells you trust is still the binding constraint, not technology.

How payment automation has evolved

Traditional payments: manual approvals at every step

Digital payments have needed a human at every step for decades: browse, add to cart, enter card details, clear identity checks like 3-D Secure or biometrics. Every transaction demands someone’s active attention, and that’s the ceiling on how fast a business can scale procurement.

Automated payments: scheduled but rigid

The first wave of automation, recurring billing, scheduled ACH transfers, subscription tools, cut down on manual entry but stayed entirely deterministic. If a business stopped using a SaaS tool, the billing engine kept charging the card until someone noticed and cancelled it. That blind spot costs businesses real money.

Agentic payments: AI that pays on your behalf

The current wave is the “decide-to-pay” model: AI systems acting as active financial intermediaries. An agent can track software usage, adjust subscription tiers based on actual team activity, and only release payment when a service is delivering real value, combining natural language instructions with cryptographically enforced spending limits.

How agentic payments work

1. Set your spending rules and vendor policies

Setting up agentic payment starts with guardrails. A business or consumer defines what the agent can buy, which vendors are approved, and the maximum spend per transaction or billing cycle. These policies get encoded into digital mandates the agent can’t alter or bypass.

2. The agent monitors for real-time triggers

Once configured, the agent runs continuously, watching data feeds, APIs, or specific triggers. A treasury agent might track FX rates and fire a cross-border transfer automatically once the rate hits a target level.

3. It evaluates context, compliance, and cost

When a trigger fires, the agent queries merchant catalogues, checks product details, and calculates the true landed cost, shipping, local tax, import duties included, while confirming the merchant is on the approved vendor list.

4. It selects the best payment rail and settles

After finding the best offer, the agent requests a single-use, time-bound spending token from the user’s wallet or payment provider, passes it to the merchant’s checkout API, and settles the transaction. Stripe’s equivalent, the Shared Payment Token, works exactly this way: it lets an agent complete a purchase without ever touching the buyer’s actual card details.

How agentic payment systems are built

The intent layer: translating instructions into actions

This is the interface layer: it turns a natural language instruction into a structured, machine-executable plan. The IMF calls this the intent and orchestration layer in its three-layer framework for agentic payments. This is where protocols like Anthropic’s Model Context Protocol come in: they give an agent structured, machine-readable access to inventory, pricing, and checkout logic, instead of forcing it to scrape a webpage.

The control layer: enforcing spending rules and compliance

The IMF names this the control and authorization layer, and it’s the deterministic firewall in the system. The intent layer reasons probabilistically; this layer doesn’t. It enforces hardcoded, absolute limits the AI cannot override: spend caps, merchant allowlists, security protocols.

The settlement layer: routing and completing the transaction

The settlement layer is where money actually moves, plugging into banking networks, card networks, or digital asset rails to transfer funds from buyer to merchant. It handles routing, currency conversion, and finality.

How agents authenticate and stay within spending limits

Rotated identity certificates

To stop unauthorized systems from impersonating a legitimate buyer, agents use rotated identity certificates: short-lived cryptographic credentials that prove identity to a payment network for a single session, then expire automatically.

Scoped spending tokens

Instead of exposing card numbers or bank credentials to an AI system, providers issue scoped tokens bound to a single merchant, a specific amount, and a strict expiry window. Stripe’s Shared Payment Token is a working example: it’s useless to anyone who intercepts it because it can’t be reused outside its original scope.

Behavioral and velocity monitoring

Providers also apply continuous monitoring to agent transactions. Gr4vy’s vaulting approach, for instance, limits tokens by amount, frequency, and duration, and layers in multi-factor checks. If purchase frequency or spending patterns drift from the norm, the risk engine flags it and can demand step-up verification.

Will agentic payments happen on legacy rails or on-chain?

Bank rails and card networks weren’t built for high-speed, machine-to-machine transactions. ACH and SWIFT run on batch schedules, adding clearing delays of several business days and intermediary fees, and they lack the native programmability needed to embed micro-payments or execution rules directly into a transaction.

That’s pushed stablecoins and blockchains into the conversation as a more natural fit. Crypto payments are push-based, so the sender initiates the transfer, and that fits an autonomous agent well. Settlement is near-instant and runs 24/7, spending limits can be written directly into the code, and fees are small enough to make streaming micro-payments for compute or API usage practical.

What are ACP, UCP, and TAP?

A handful of protocols are trying to become the common language for agentic checkout.

ACP, built by OpenAI and Stripe, powers checkout directly inside ChatGPT and uses Stripe’s Shared Payment Tokens to move money without exposing card details. UCP, co-developed by Google and Shopify, standardizes discovery and catalogue data for agents, then hands off payment execution to Google’s Agent Payments Protocol (AP2), which uses cryptographically signed mandates to prove what a user actually authorized. 

Visa’s TAP takes a different route: rather than inventing a new token type, it extends the existing Visa Token Service with agent credentials and a signed-intent payload, so issuers can recognize an agent transaction using infrastructure they already run. Mastercard’s comparable play, Agent Pay, uses Agentic Tokens, an extension of its existing tokenization service, to bind a buyer’s intent to a specific agent, merchant, and consent policy.

Why does legacy payment infrastructure break under agentic workloads?

Legacy payment networks assumed a human was sitting behind the screen. Security gates like 3-D Secure, SMS one-time passwords, and biometric CAPTCHAs exist to catch and block exactly this kind of non-human activity. So when an autonomous agent tries to check out, those same fraud systems read its rapid, programmatic calls as a bot attack or credential stuffing, and the transaction just fails. Until agent identity and permissioning are standardized, that’s the default outcome, not the exception.

Benefits of agentic payments

For enterprises, the operational case is straightforward. In B2B payments, agents can run an entire accounts payable workflow: checking invoice accuracy, cross-referencing purchase orders, and releasing funds once contract terms are met. That kind of accounts payable automation cuts manual admin overhead and speeds up the supply chain.

It also improves cash flow and treasury management. A treasury agent can watch working capital across regional accounts and use finance automation tools to move funds into higher-yield positions or convert currencies when rates are favorable, cutting human error and protecting margins against market volatility. That level of precision helps finance leaders manage B2B payments at scale without needing to intervene manually on every transfer.

Challenges of agentic payments

The benefits come with real friction. The biggest one is a legal and regulatory vacuum: consumer protection laws, chargeback frameworks, and liability rules were all written with human-initiated commerce in mind, so there’s a grey area the moment an agent makes an unauthorized or mistaken purchase.

Merchant fraud is the other major risk. Fake storefronts optimized for machine crawlers are already showing up, and an agent, unlike a person, has no intuition to catch a deal that looks too good to be true. Until verified merchant directories and shared authentication standards mature, businesses need to be deliberate about how much spending power they hand to an autonomous system.

Who is building agentic payments infrastructure today?

Google and OpenAI: competing standards for machine checkout

OpenAI, working with Stripe, launched the open-source ACP to power checkout inside ChatGPT. Google, meanwhile, is leaning on its search and shopping footprint to push UCP, co-developed with Shopify, which links web agents directly to merchant carts through a standardized catalogue handshake and settles payment through Google’s AP2 mandates.

Visa and Mastercard: securing AI-initiated card transactions

The card networks are focused on securing these transactions at the token level. Visa’s Trusted Agent Protocol extends its existing Visa Token Service with agent-specific credentials and a signed-intent payload rather than introducing an entirely new token type. Mastercard’s Agent Pay takes a similar approach with Agentic Tokens, an extension of its own tokenization service, letting issuers authorize an agent-initiated transaction with the same underlying security as a physical card swipe.

Basis Theory, Skyfire, and Rye: the startup infrastructure layer

A wave of venture-backed startups is building the plumbing underneath all of this, and each one owns a different layer of the stack.

Trust and authorization about agentic payments

How do you authenticate a non-human?

Authenticating a non-human buyer means moving past passwords entirely. Providers rely on cryptographic handshakes, OAuth 2.0 flows, and standardized JSON documents called Agent Cards that define an agent’s identity, capabilities, and its human owner, giving merchants a way to confirm an agent is legitimate before opening up checkout APIs to it.

How do you set financial guardrails?

Guardrails run on structured, non-repudiable mandates. When a user delegates purchasing authority, their financial institution issues a cryptographically signed token specifying spend limits, permitted merchant categories, and an explicit expiry. Google’s AP2 mandates work this way, capturing exactly what a user authorized upfront. Anything that falls outside those parameters gets blocked automatically.

How do fraud models adapt to agents?

Fraud models built on mouse movement, typing speed, and browsing behavior flag every AI agent as suspicious by default, which isn’t useful once agent commerce is legitimate. Modern risk systems instead need to evaluate agent-specific signals, verified cryptographic signatures, registered intent mandates, merchant verification history, to separate a permissioned agent from a malicious bot.

What is the business impact of agentic payments?

How agentic payments change the checkout funnel

The traditional funnel runs on human emotion, visual design, and friction reduction: landing pages, persuasive copy, retargeting. None of that works on an agent. Agents decide in milliseconds based on structured, comparable data: cost, delivery speed, return policy, specs. Just as SEO made content legible to search engines, businesses now need to make their storefronts legible to agents.

Who is liable when an AI agent makes an unauthorized payment

Consumer debit: EFTA and Regulation E

For consumer debit, the Electronic Fund Transfer Act and Regulation E protect against unauthorized transfers, capping liability if fraud is reported quickly. Applying that to agentic payments gets complicated fast: it’s currently unresolved whether a consumer granting an agent access to their account even satisfies Regulation E’s authorisation requirement in the first place.

Consumer credit: TILA and Regulation Z

Under the Truth in Lending Act and Regulation Z, consumer liability for unauthorized credit card use is generally capped at US$50, meaning the card issuer typically absorbs the loss if an agent goes rogue. Card networks are now rolling out agent-specific network tokens to build clearer audit trails, so issuers can tell whether a transaction actually matched the user’s original intent.

Commercial payments: UCC Article 4A

B2B transactions fall under UCC Article 4A. If a business and its bank agree on a commercially reasonable security procedure and the bank follows it, the business bears the loss from any unauthorized transfer, which makes airtight API controls essential for any finance team running autonomous AP agents.

How KYC and AML rules apply to AI agents

Software agents aren’t legal persons, so standard KYC rules can’t apply to them directly. Instead, institutions are building Know Your Agent (KYA) frameworks that identify and verify the human or business ultimately responsible for the agent’s actions, keeping the whole chain compliant with anti-money laundering and counter-terrorist financing standards.

What security risks do digital payments agents introduce

Credential theft and account takeover

Agents need access to stored credentials or API keys to transact autonomously, which makes agent platforms a concentrated target. If a hacker compromises an agent’s backend, they can potentially take over accounts across every connected merchant platform before anyone notices.

Prompt injection and substitution scams

Agents lean on language models to interpret instructions and product listings, and that makes them vulnerable to prompt injection. Hidden, adversarial text buried in a listing could tell an agent to skip a price check or route payment to a fraudulent account, which is exactly why verified merchant directories matter so much.

How to prepare your business for agentic payments

1. Audit your payment stack for API readiness

Start by moving off systems that assume a human at every step. Your payment infrastructure needs to be API-first, so agents can query catalogues, manage carts, and trigger checkout without a graphical interface in the way.

2. Define agent spending limits and authorization rules

Before you deploy any automated purchasing or treasury system, put finance automation controls in place first: daily transaction limits, approved vendor lists, and multi-factor rules that force a human sign-off above a set threshold.

3. Structure product listings for machine discoverability

Your product data needs to be legible to AI crawlers: structured feeds, accurate inventory, real-time shipping costs, and return policies in standardised formats. Stale feeds are one of the fastest ways to get skipped by an agent doing real-time comparison.

4. Optimize for Agent Engine Optimization

Much like SEO optimized content for search engines, Agentic Commerce Optimization is about structuring your digital footprint so LLM recommendation models favour it: detailed product attributes, verified reviews, and clear shipping data, all in machine-readable form.

5. Set clear liability boundaries before deploying agents

Legal and finance teams need explicit liability agreements with payment providers, software vendors, and platform partners, ones that spell out who eats the loss if an agent makes a bad purchase, hits an API error, or gets caught by a pricing exploit.

How Airwallex helps businesses run agentic payments

Why global payment infrastructure matters for autonomous transactions

AI systems operate globally and at high speed, so businesses need payment infrastructure that can settle cross-border transactions instantly and cheaply. Traditional international transfers route through multiple intermediary banks, adding fees and delays of several business days. Airwallex runs its own global payment network instead, letting businesses settle through local payment rails.

Multi-currency accounts for AI-driven cross-border payments

To avoid the FX margins traditional institutions charge, businesses can use Airwallex Multi-Currency Accounts to collect, hold, and pay out in 20+ currencies. A treasury engine can plug directly into Airwallex to manage international liquidity and pay overseas suppliers in their local currency without unnecessary FX fees.

API-ready rails built for machine-initiated transactions

Airwallex provides a developer-friendly API-first payment platform built for this kind of automation. Developers can programmatically issue multi-currency Airwallex Corporate Cards with built-in spending rules, merchant restrictions, and transaction limits, and assign those virtual cards directly to individual AI agents so they can pay vendors autonomously while your core capital stays protected.

For platforms building their own agentic ecosystems, Airwallex Embedded Payments provides the checkout infrastructure and compliance frameworks needed to process machine-initiated payments globally, streamlining card issuance, treasury management, and routing so platforms can run best online payment processing for high-velocity, automated checkouts without building that infrastructure themselves.

Frequently asked questions about agentic payments

What payment rails do agentic payments run on?

They run on a mix of card-on-file networks, real-time fiat rails, and programmable stablecoin protocols. Card networks are adapting with agent-specific tokens, but machine-to-machine micro-transactions increasingly lean on stablecoins instead, mostly to sidestep legacy clearing times and fees.

Can AI agents have a bank account?

No, AI agents can’t legally own a bank account because they lack legal personhood under corporate and banking law. ⁵ They operate under a delegated corporate account or digital wallet held by a human or business entity that carries the ultimate legal liability for the funds.

Can agentic payments handle cross-border and multi-currency transactions?

Yes, autonomous agents can manage cross-border payments through API-driven global platforms, comparing rates in real time and routing transactions through the most cost-effective local clearing rail available.

What is the difference between an agentic payment and a standard API payment?

A standard API payment fires from rigid, pre-defined code. An agentic payment relies on probabilistic AI reasoning to decide whether, when, and how much to pay based on dynamic context and the user’s goals.

Which industries will adopt agentic payments first?

High-volume, repeatable categories are moving first: grocery delivery, utilities, travel booking, and B2B accounts payable. These sectors benefit heavily from automated price comparison and replenishment, which makes them the easiest place to hand over delegated spending authority.

How do agentic payment disputes and chargebacks work?

They lean on cryptographic proof to work out whether an agent exceeded its delegated guardrails. If an agent transacts outside its pre-authorised scope or limit, the audit trail lets issuers and merchants spot it and resolve the unauthorized activity fast.

Do agentic payments work for small and mid-sized businesses?

Yes, SMBs can adopt these flows by using modern, API-ready platforms that handle agentic discovery and payments out of the box, capturing automated traffic without building custom, enterprise-grade infrastructure themselves.

Who is legally responsible if the AI makes a mistake?

Under current law, the human or business that deployed the agent remains legally responsible for what it does. An AI model has no legal personhood, so it can’t hold liability or enter into a contract itself. If an agent buys the wrong item, misjudges inventory, or executes a bad payment, the business is still the merchant of record and covers the cost.

How do disputes and chargebacks work in agentic payments?

Traditional dispute mechanisms assume a human is actively disputing a charge they physically approved, which doesn’t map cleanly onto agentic commerce. Newer protocols are addressing this with cryptographic audit trails, Google’s AP2 signed mandates being one example, that provide non-repudiable proof of exactly what a user authorized, so issuers and payment networks can tell whether an agent acted inside its approved boundaries.

Sources

1. https://www.checkout.com/guides-and-reports/agentic-commerce-2026

2. https://www.imf.org/en/publications/imf-notes/issues/2026/04/22/how-agentic-ai-will-reshape-payments-575560

3. https://stripe.com/guides/agentic-commerce

4. https://gr4vy.com/posts/agentic-payments-in-2026-what-merchants-need-to-understand-and-prepare-for/

5. https://www.fenwick.com/insights/publications/is-2026-the-year-of-agentic-payments