Regulatory Response to Agent Payments So Far — What's Actually on the Books vs Assumed

As of August 2026, no regulator — not the CFPB, not the EU, not the UK — has issued a rule that names "agentic payments" and says how liability, authorization, or consent must work when an AI agent initiates the transaction. What exists instead is old law applied by extension, two very live open questions, and one place where private rulemaking has moved faster than public rulemaking: the card networks. This page is the ground truth check for Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki and for any protocol page in this wiki that claims to have "solved" compliance.

US: CFPB — no agent-specific guidance, old rules, one open question

No CFPB guidance document specifically addressing agentic payments has been issued as of August 2026; federal regulators have not issued agent-specific guidance, and the Trump Administration has signaled a preference for innovation before regulation (https://consumerbankers.com/research/agentic-ai-payments-navigating-consumer-protection-innovation-and-regulatory-frameworks/). The closest the CFPB came was a proposed Interpretive Rule issued January 10, 2025, clarifying how the Electronic Fund Transfer Act (EFTA) and Regulation E apply to modern digital payment systems — but its future became uncertain with the change to the Trump Administration, and as of August 2026 no follow-through guidance has been issued (https://www.mwe.com/insights/cfpb-proposes-clarifications-to-the-scope-of-regulation-e-for-digital-assets-and-nonbank-payment-platforms/). The CFPB's most recent AI-related action, Circular 2026-03 (May 5, 2026), addresses AI underwriting in lending — it tells lenders they remain responsible under ECOA/Regulation B for AI-driven adverse decisions, but it does not touch agentic payments (https://www.nationalmortgageprofessional.com/news/cfpb-issues-ai-underwriting-guidance-adverse-action-notices). A search of the CFPB's public enforcement database as of August 2026 shows no enforcement action specifically targeting agentic payment products (https://www.consumerfinance.gov/enforcement/).

The one thing that has taken direct effect on agent-adjacent commerce

the CFPB's digital payment app rule, finalized November 2024 and effective January 9, 2025, gives the CFPB proactive examination authority over nonbank payment companies processing more than 50 million consumer transactions annually — but its supervisory scope is general, not agentic-specific (https://www.skadden.com/insights/publications/2024/12/cfpb-finalizes-rule-to-subject-large-payment-apps-to-direct-supervision).

The open question that matters most

EFTA/Regulation E is the primary federal consumer-protection framework governing disputed electronic payments (https://fbtgibbons.com/the-payment-infrastructure-layer-how-network-rules-already-govern-agentic-commerce/), but its liability model was written for human-initiated transfers. It does not explicitly say whether a transfer made by an AI agent acting under a valid-but-manipulated mandate (e.g. via prompt injection) counts as "authorized" or "unauthorized" — and no regulator or court has resolved this as of the source date; the source poses this as an open question ("Is an agentic AI transaction authorized by the consumer?") rather than predicting how or when it will be resolved (https://www.dickinsonbradshaw.com/blogs-articles/2026/01/20/new-reg-e-liability-the-ai-bought-that-not-me). See Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki for the full analysis of this gap.

EU/UK: PSD3 written for a human at the keyboard, UK moving first via consultation

PSD3's final rules were agreed by the European Parliament and Council on April 23, 2026 (https://brc.org.uk/news-and-events/news/associate-insight/2026/psd3-agentic-commerce-and-the-new-frontier-of-payment-risk/). As written, PSD3 "largely assumes a human is still at the keyboard": it does not explicitly define how to classify an agent-initiated transaction within the existing "customer-initiated" vs "merchant-initiated" categories, and the traditional distinction blurs once an autonomous agent is the initiator (same source). Implementation is not expected until H2 2027 at the earliest, with the source's timeline running through early 2028, which it describes as leaving a regulatory gap for agent-led commerce through 2026 and beyond (https://www.alchemycrew.ventures/blog/europe-s-agentic-future-a-directive-blueprint-for-ai-powered-payments-and-commerce/). The predecessor regime, PSD2's Strong Customer Authentication (SCA) requirement, is built on the same assumption — "a human is present at the moment of payment and gives explicit consent to that specific transaction" — and nothing in the current framework treats an AI agent's mandate as equivalent to that human authorization (https://paymentexpert.com/2026/03/25/fca-2026-payments-regulatory-priorities-report/).

UK is ahead of the EU in process, though not yet in rules. HM Treasury published a consultation on July 14, 2026 (closing October 6, 2026) proposing what is described as the most significant restructuring of UK payments regulation since the Payment Services Regulations 2017 / Electronic Money Regulations 2011, explicitly to accommodate agentic AI and tokenized payment services (https://www.skadden.com/insights/publications/2026/07/hm-treasury-proposes-major-overhaul). Its Recommendation 10 proposes an "agentic payments trust framework" and a "Know Your Agent" standard, and directly asks whether existing consent, authentication, and unauthorized-transaction liability provisions need updating to allocate liability when an AI agent acts autonomously (https://bratby.law/agentic-payments-accountability-gap/) — i.e. the UK consultation is asking, as an open question for comment, exactly the liability question the US has left unresolved by silence. In parallel, the FCA's Mills Review (led by Sheldon Mills) on the long-term impact of AI on retail financial services was due to report in summer 2026 (https://paymentexpert.com/2026/03/25/fca-2026-payments-regulatory-priorities-report/), and the UK Competition and Markets Authority stated in a March 2026 paper, "Agentic AI and consumers," that "existing consumer protection law applies whether decisions are made by people or by AI systems" — a position that applies old law by extension rather than creating agent-specific rules (same source).

Card network rule changes: the fastest-moving layer, and it isn't a regulator

Visa and Mastercard have moved ahead of every public regulator by amending their own operating rules — private rulebooks, not law, but the rules that actually govern most agent-initiated transactions today.

- Visa: the Visa Core Rules edition dated April 18, 2026 contains explicit provisions for agentic transactions, requiring identity verification per Visa Intelligent Commerce specifications and use of provisioned tokens (https://www.visaeurope.lu/content/dam/VCOM/download/about-visa/visa-rules-public.pdf). Visa's Trusted Agent Protocol, launched late 2025, operates as a cryptographic three-signature handshake between agent, merchant, and payment system (https://fbtgibbons.com/the-payment-infrastructure-layer-how-network-rules-already-govern-agentic-commerce/). - Mastercard: the public Transaction Processing Rules remain silent on agentic terminology as such — Mastercard's agentic-commerce governance runs through separate product programs (Agent Pay, Agentic Tokens, Acceptance Framework) rather than formal rulebook language (same source). Mastercard's Agent Pay for Machines (AP4M) product launched June 10, 2026, with four capabilities — credentialing, permissioning (programmatically enforced spending limits), transacting, and multi-rail settlement (https://www.mastercard.com/global/en/news-and-trends/press/2026/june/mastercard-launches-agent-pay-for-machines.html); neither the investor announcement nor the primary source describe this as a change to the public Transaction Processing Rules, and no field-level rulebook change (e.g. a program identifier for Agent Pay transactions) is confirmed by a primary Mastercard source. See Mastercard AP4M — an announced authorization layer, not yet a published spec or a shipped integration for the full spec-vs-announcement breakdown.

How the networks classify agentic transactions matters for the liability question above: both Visa's and Mastercard's approaches treat agentic transactions as a variant of existing tokenized/stored-credential/delegated-payment rule categories rather than inventing a new legal category (https://fbtgibbons.com/the-payment-infrastructure-layer-how-network-rules-already-govern-agentic-commerce/). That is "regulated by extension" in the same sense EFTA/Reg E is being applied by extension — private rulemaking filling the same kind of gap public rulemaking has left open.

Gap map: regulated by extension vs genuinely unaddressed

| Question | Status | |---|---| | Liability for a prompt-injected or malfunctioning agent's spend | Unaddressed. No CFPB interpretation or court ruling distinguishes an "authorized" agent acting under a valid mandate from an "unauthorized" manipulated one under Reg E (https://www.dickinsonbradshaw.com/blogs-articles/2026/01/20/new-reg-e-liability-the-ai-bought-that-not-me). | | Classifying an agent-initiated transaction under PSD3 | Unaddressed. PSD3 sidesteps the human-initiation assumption; no explicit label for agent-initiated transactions exists within customer-initiated/merchant-initiated categories (https://brc.org.uk/news-and-events/news/associate-insight/2026/psd3-agentic-commerce-and-the-new-frontier-of-payment-risk/). | | Dispute resolution for stablecoin-settled agent payments | Unaddressed. When an agent-initiated payment settles on-chain (e.g. USDC), no chargeback mechanism exists under current card-network rules, and loss allocation is unaddressed (https://fbtgibbons.com/the-payment-infrastructure-layer-how-network-rules-already-govern-agentic-commerce/). See Stablecoin Settlement Cost, Measured — why sub-cent agent payments are only viable on-chain for the settlement mechanics this leaves exposed. | | Real-time human override mid-transaction | Unaddressed, and unverified as even a shipped feature anywhere. No published spec in AP2, AP4M, Visa Intelligent Commerce, or ACP defines a protocol-level mid-transaction intervention/revocation mechanism; one source describes "mid-session real-time override" as a roadmap item, not a shipped feature (unverified) (https://www.chargeflow.io/blog/agentic-commerce-regulation-what-merchants-need-to-know/). | | Cross-protocol portability of a mandate | Unaddressed as a regulatory matter, confirmed as a technical gap. An agent authorized under an AP2 mandate cannot currently spend via a Visa Intelligent Commerce merchant without re-authorization; the protocols operate as silos (https://fbtgibbons.com/the-payment-infrastructure-layer-how-network-rules-already-govern-agentic-commerce/). | | Agentic transaction identification/tokenization at the network level | Regulated by extension, and shipped — Visa via its rulebook, Mastercard via product programs. Visa's April 2026 Core Rules extend existing tokenized/stored-credential rule categories to cover agent transactions explicitly; Mastercard covers the same ground through separate product programs (Agent Pay, Agentic Tokens) rather than a public rulebook change, so the two networks have reached similar coverage by different routes (same source). | | Whether existing consumer-protection law applies to AI-made decisions at all | Answered, generically. UK CMA (March 2026): "existing consumer protection law applies whether decisions are made by people or by AI systems" — a general position, not agent-specific rules (https://paymentexpert.com/2026/03/25/fca-2026-payments-regulatory-priorities-report/). |

What does NOT work

Treating a law firm's summary or a protocol vendor's compliance marketing as equivalent to a regulator's actual text is the single most common error here. AP2's signed Intent/Cart Mandates, for instance, are marketed as solving the authorization question — but nothing in these notes shows that claim has been tested by an actual regulatory ruling or dispute (see Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki). Likewise, "the CFPB is looking at this" is not the same claim as "the CFPB has issued guidance": as of August 2026 the former may be true informally, but the latter is false — the January 2025 Interpretive Rule that would have been the closest thing never took effect, its future left uncertain by the change in administration and never followed through on since.

The filed-under-'nothing-yet' test

Applying the wiki's own verification standard (How to Verify an Agent-Payment Protocol Claim Before Citing It — the four checks this wiki runs on every page) to regulation itself: an "agentic payments trust framework" that is a consultation question (UK HM Treasury Recommendation 10) is not a rule; an interpretive rule proposed and then left in limbo (CFPB, January 2025) is not guidance; a card-network rule amendment (Visa, Mastercard) is not law but is at least a binding private rule that is already in effect. Readers of any protocol page in this wiki that claims regulatory compliance or "solved" liability should check this page's gap map first — as of the source dates here, the liability question for a manipulated agent's spend is open in both the US and the UK, and the EU has not yet reached implementation at all.

Related

- Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki — the deep dive on the Reg E "authorized vs unauthorized" question this page only summarizes; read that page for the access-device-exception analysis and any disputed-case examples. - Mastercard AP4M — an announced authorization layer, not yet a published spec or a shipped integration and Visa Intelligent Commerce: Tokenized Agent Credentials — the spec-vs-announcement test applied to Visa's own numbers — the protocol pages whose network-rule changes are covered here at the regulatory level; check those for the technical/product detail behind the rule citations. - What None of These Protocols Currently Solve — the gaps common to AP2, AP4M, Visa, ACP and stablecoin rails — the technical mirror of this page's gap map: cross-protocol portability, no on-chain chargeback, and no mid-transaction override are gaps both regulators and protocol designers have left open. - How to Verify an Agent-Payment Protocol Claim Before Citing It — the four checks this wiki runs on every page — apply the same spec-vs-announcement, outside-implementation, and sourced-number discipline to any future regulatory claim before repeating it.