US and Canada: The Rails Shipped First, and the Rulebook Named the Payer

Ask who regulates agent-initiated payments in the United States and the honest 2026 answer is: a private rulebook does, and it has already decided. Visa's public Core Rules carry a full agentic taxonomy — four new defined terms, eleven new requirements, and one sentence that allocates the loss — and the rulebook's own metadata dates that taxonomy to the October 2025 edition, not to the April 2026 edition we read. Public law has not caught up and, in the case of the federal banking agencies, has formally declined to try. Canada is a different shape of the same picture: four supervisors, none of whom owns the question, and a payments rulebook it imports without having written.

Everything quoted below comes from a document Salesmart S.r.l., trading as Sinapsi, which publishes this wiki, fetched itself — the documentary core on 2026-08-03, the re-checks noted below on 2026-08-05. Where we could not fetch it, we say so. "We" throughout this page means that company, and every counted figure here was counted by us on our own copy of the file.

The claim to retire

The common reading, still repeated in analyst commentary through mid-2026, is that no card network has created a dedicated classification for agent-initiated transactions, so the question of liability is open. That was true in 2025. It is not true of Visa now.

We downloaded the *Visa Core Rules and Visa Product and Service Rules*, edition 18 April 2026 — 923 pages, marked "Visa Public" — and counted 155 occurrences of "Agentic" in the extracted text. Section 4.1.24, Agentic Platform Requirements, runs from 4.1.24.1 to 4.1.24.11. The Glossary defines four new terms: Agentic Payment Enabler (ID# 0031163), Agentic Payment Provider (ID# 0031164), Agentic Transaction (ID# 0031165) and Agentic Repeated Transaction (ID# 0031166). The existing Glossary entry for Agent (ID# 0025920) was amended to push the new entities out of it: *"For the purpose of the Visa Rules, neither an Agentic Payment Enabler nor an Agentic Payment Provider are classified as an Agent."*

The edition date is not the arrival date, and the difference matters. The file is stamped edition *"18 April 2026"*, but the rules inside carry their own timestamps. Rule 4.1.24.10 — the sentence that allocates the loss — is marked *"Edition: Apr 2026 | Last Updated: Oct 2025"*, and so are 4.1.24.7 (0031173), 4.1.24.8 (0031174), 4.1.24.9 (0031175), 4.1.24.11 (0031177) and the Glossary entries for Cardholder (0024372), Agent (0025920), Agentic Payment Enabler (0031163) and Agentic Repeated Transaction (0031166). Sections 4.1.24.1 and 4.1.24.2 contain bullets marked *"Effective through 17 April 2026"*, which can only expire on 17 April if they were already in force before it. What is actually new on 18 April 2026 is narrower: 4.1.24.5 (ID# 0031236, *"Last Updated: New"*) opens *"Effective 18 April 2026"* and extends the regime to Digital Wallet Operators, and the Summary of Changes lists it as *"Agentic Payment Requirements for Digital Wallets — Effective 18 April 2026"*. So the taxonomy, and with it the loss allocation, dates from the October 2025 edition; April 2026 is when wallets were brought inside it.

An Agentic Transaction is *"An Electronic Commerce Transaction that is undertaken by an Agentic Payment Provider on behalf of a Cardholder, using a Payment Credential"*, based on the Cardholder-defined payment instruction and completed *"Without direct interaction between the Cardholder and Merchant"*. That is a machine-initiated purchase, named as such, inside a rulebook that binds Visa's issuers, acquirers and merchants worldwide.

The sentence that decides who pays

Rule 4.1.24.10, Agentic Payment Provider – Cardholder Responsibility (ID# 0031176), in its entirety:

> A Cardholder is responsible for any actions taken by an Agentic Payment Provider as part > of an Agentic Transaction as if the Cardholder initiated the Transaction.

The Glossary reinforces it from the other direction. The definition of Cardholder (ID# 0024372) now ends: *"For the purpose of the Visa Rules, an Agentic Payment Provider is considered to be the Cardholder for an Agentic Transaction."* And the definitions of both Agentic Payment Provider and Agentic Transaction close with: *"Initiators of Agentic Transactions are not considered Merchants for the purposes of Visa Rules."*

Read together, the agent is neither a merchant nor an Agent in the rulebook's own sense. For purposes of the rules it is the cardholder, and the human behind it wears the consequences. Every other rule in 4.1.24 is procedural scaffolding around that allocation — that reading of the structure is ours, but the components are quoted: obtain consent, state the expiry of the payment instruction, verify identity per the Visa Intelligent Commerce specifications, and, explicitly, *"Obtain Cardholder acknowledgement that they are responsible for actions taken by the Agentic Payment Provider"* (4.1.24.3, ID# 0031169). (A small tell that we read the document rather than a summary of it: 4.1.24.3 as published says "Visa Intelligence Commerce specifications", while 4.1.24.4 says "Visa Intelligent Commerce". The rulebook has a typo.)

The consumer-facing obligations are real but thin. An Agentic Payment Provider must make an order confirmation available for at least 120 days from the Processing Date, including the merchant's cancellation and refund policies (4.1.24.8, ID# 0031174). It must not *"Undertake an Agentic Transaction in a Card-Present Environment"* and must not *"Aggregate multiple Agentic Transactions into a single Transaction"* (4.1.24.2, ID# 0031168). Those are hygiene rules, not remedies. The one enforcement lever is blunt and one-sided: *"Visa may, at its sole discretion, disqualify an Agentic Payment Provider from participating in the Visa Program"* (4.1.24.11, ID# 0031177).

Where nothing changed: the disputes chapter

If the rulebook had created an agentic dispute right, it would appear in the dispute conditions. It does not. Across all 923 pages, "Agentic" appears in Chapter 11, Dispute Resolution, exactly twice — both inside compelling-evidence lists for Dispute Condition 10.4: Other Fraud – Card-Absent Environment, where the acquirer may cite, among matching data points from prior undisputed transactions:

> Customer account or login ID used to authenticate the Cardholder at the time of the > Transaction. This also includes login IDs for an Agentic Payment Provider and Merchant's > e-commerce site or application.

That is an *evidentiary* accommodation for merchants defending a fraud chargeback. It is not a new dispute reason, not a new liability shift, and not a consumer right. The network built the on-ramp and left the exit as it was. For completeness we also checked Chapter 12, Fees and Non-Compliance Assessments: zero occurrences of "Agentic". The new obligations carry no named non-compliance assessment.

Mastercard is reported to have gone the other way — its public Transaction Processing Rules are said to remain silent on agentic terminology, with the movement living in product programmes (Agent Pay, Agentic Tokens, the Acceptance Framework) rather than operating rules. We flag this as reported, not independently verified: mastercard.com returned HTTP 403 to our download attempts on 2026-08-03 from two hosts, so we are relying on a law-firm article (FBT Gibbons, 5 May 2026) that quotes no section numbers for either network. If that reading is right, the two largest networks currently differ on whether agentic commerce is a rulebook matter at all — but we cannot confirm the negative ourselves, and a negative sourced from marketing content is the weakest claim on this page.

Public law stops at the word "authorized"

The US consumer-protection statutes were written for a world where the only non-consumer initiating a payment was a thief. Both of the relevant regulations therefore hinge on authority, and a delegated agent has it.

Regulation E (Electronic Fund Transfer Act) defines an *unauthorized electronic fund transfer* at § 1005.2(m) as one *"initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit"* — and expressly excludes a transfer initiated *"By a person who was furnished the access device to the consumer's account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized."*

Regulation Z (Truth in Lending), which is what actually governs a card purchase, caps cardholder liability for unauthorized use at *"the lesser of $50 or the amount of money, property, labor, or services obtained by the unauthorized use before notification to the card issuer"* (§ 1026.12(b)(1)(ii)) — where *"unauthorized use"* means *"the use of a credit card by a person, other than the cardholder, who does not have actual, implied, or apparent authority for such use, and from which the cardholder receives no benefit"* (§ 1026.12(b)(1)(i)).

A delegated agent has actual authority by construction. So the $50 cap does not engage, and Regulation E's unauthorized-transfer machinery does not engage. What remains for the consumer is the ordinary billing-error and goods-not-received path — the same one available for a purchase they made themselves. Which is precisely the outcome Visa's rule 4.1.24.10 already states.

The two systems agree. That is the finding, and it is ours as a reading, built on quoted text on both sides. The private rulebook and the public regulation independently arrive at "the human is on the hook", one by drafting and one by drafting *around* a case it never contemplated. There is no contradiction to litigate, and therefore less pressure to legislate than the commentary assumes.

The supervisors wrote it out of scope

On 17 April 2026 the Federal Reserve, FDIC and OCC issued revised interagency *Supervisory Guidance on Model Risk Management* (Fed SR 26-2), superseding and replacing SR 11-7 (issued 4 April 2011). Footnote 3 reads, verbatim:

> Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not > within the scope of this guidance. Nonetheless, a banking organization's risk management > and governance practices should guide the determination of appropriate governance and > controls for any tools, processes, or systems not covered in this document. However, the > principles described in this guidance apply to traditional statistical and quantitative > models and non-generative, non-agentic AI models.

"Agentic" appears nowhere else in the twelve-page attachment — we re-downloaded it on 2026-08-05 and counted the pages, because an earlier version of this page said eight. We also searched it for a promised "request for information" on AI — a sentence widely attributed to this document in secondary coverage — and it does not appear. We do not repeat that claim.

The absence is publishable on its own terms, with the honest qualifier attached: we found no binding guidance from any US federal financial regulator addressed to agent-initiated payments as of 2026-08-03. The CFPB, which owns Regulations E and Z, is the institution that would write it, and on 12 May 2025 it withdrew a large tranche of its own guidance. We counted the numbered items in Section III of the Federal Register notice ourselves: 67, across policy statements, interpretive rules, advisory opinions and other guidance, *"applicable as of May 12, 2025"*. The agency best placed to answer the question spent the year subtracting answers.

What is actually live, and what each document refuses to say

| Rail | Owner | First shipped | Merchant of record | Says anything about liability or disputes? | |---|---|---|---|---| | ACP / Instant Checkout | OpenAI + Stripe | 29 Sep 2025, US, Etsy at launch | Merchant — *"OpenAI is not the merchant of record in the Agentic Commerce Protocol"* | No | | UCP | Google (+ Shopify, Etsy, Wayfair, Target, Walmart) | 11 Jan 2026, US first | Merchant — *"you own your business logic, and you remain the Merchant of Record"* | No | | Agent Pay + Agentic Tokens | Mastercard | 29 Apr 2025 (both in the same announcement) | n/a (token layer) | No | | Trusted Agent Protocol | Visa (with Cloudflare) | 14 Oct 2025 | n/a (identity layer) | No | | Visa Core Rules § 4.1.24 | Visa | Oct 2025 edition (digital-wallet extension effective 18 Apr 2026) | Agent is *not* a merchant | Yes — cardholder bears it |

Four launches, four silences, one rulebook. Note what the protocols actually are. TAP is RFC 9421 HTTP Message Signatures with Signature-Input and Signature headers and a rule that the created and expired timestamps *"should not be more than 8 minutes apart"*. UCP carries UCP-Agent, request-signature and request-id headers and is *"compatible with Agent Payments Protocol (AP2)"*. ACP's published spec — latest stable version 2026-04-17, still badged beta, founding maintainers OpenAI and Stripe — exposes a Checkout API and a Delegate Payment API and nothing else. These are authentication and settlement plumbing. They answer *is this agent who it claims to be*. None answers *what happens when it was, and the purchase was still wrong* — the gap A Spending Limit Is Not a Conduct Limit describes as conduct rather than quantity.

Claims we found circulating and decline to publish

Three, all of which we went looking for and could not stand up.

- OpenAI's merchant fee on Instant Checkout, widely quoted as a specific percentage. Not in the Stripe announcement, not in OpenAI's commerce documentation. We do not repeat the figure. - A CFPB advisory of January 2026 on autonomous-agent purchases and Regulation Z, cited by several commerce blogs as having placed agent-initiated card transactions inside the existing dispute regime. We searched consumerfinance.gov and the Federal Register and found nothing matching. Treat it as unsourced until someone produces the document. - A proposed US class action over an AI shopping agent's unauthorized purchases, quoted with a precise dollar figure. We could not locate a docket. There is separate reporting of platform-versus-agent litigation over site access, which is a different question from payment liability; we could not verify that to primary sources either and do not build on it.

Round, memorable, unsourced numbers are the failure mode of this whole subject. The measurement vacuum described in The Earn-Spend Loop: Why Machine Payment Is Half-Built is exactly what lets them spread.

Merchant hesitancy: what is measured, and by whom

The best-sourced adoption number we found comes from Ravelin, surveying 1,504 fraud and payments professionals at enterprise merchants ($50M+ annual revenue and/or 450+ employees) across 10 countries, fieldwork January 2026: *"44% of those surveyed say they are already integrating agentic protocols"*, 32% *"set to follow within six months"*, *"Just 6% have no plans"*, and *"less than a third of merchants (29%) report feeling very prepared to handle agentic commerce, including its security and fraud implications"*.

Discount this properly. Ravelin sells fraud prevention; a survey showing enterprises adopting fast and feeling unprepared is a sales document. The sample is enterprise-only, so it is silent about the long tail where most merchants live. And "integrating" is self-defined by the respondent. What survives the discount is narrow but useful: the merchants who answered are not blocked on technology, and the preparedness gap they report is about fraud and dispute attribution — the exact thing none of the four protocols addresses.

Why B2B may arrive first, and the reason is legal

The usual argument that business payments will go agentic before consumer ones is a vendor forecast about workflow efficiency. There is a harder reason underneath it.

Regulation Z does not apply to *"An extension of credit primarily for a business, commercial or agricultural purpose"*, nor to *"An extension of credit to other than a natural person, including credit to government agencies or instrumentalities"* (§ 1026.3(a)). Regulation E applies only to a consumer asset account *"established primarily for personal, family, or household purposes"* (§ 1005.2(b)). A commercial card and a corporate accounts-payable flow therefore sit outside both regimes entirely. There is no $50 cap to argue about, no error-resolution clock, no consumer whose expectations a court might protect. Liability is whatever the commercial agreement says it is.

That is not an efficiency advantage. It is the removal of the only source of legal uncertainty.

Our forecast, at moderate confidence: agentic spend in the US concentrates first in procurement, accounts payable and supplier reconciliation, not because those workflows are easier but because they are legally uncontested. *Falsifiable form*: if by end-2027 a credible operator discloses agent-initiated transaction mix and consumer-card volume exceeds commercial-card volume, this forecast is wrong. We note in advance that the disclosure may never come — B2B agentic volume is currently reported by nobody — which makes this a forecast that may be unresolvable rather than merely wrong. We would rather say that than pretend the evidence is on its way.

Canada: four supervisors, and none of them owns this

Canada's payments oversight is split four ways, and mapping the split shows the hole.

Bank of Canada supervises payment service providers under the *Retail Payment Activities Act*. Registration provisions came into force in November 2024; the transition window ran to 7 September 2025, and after 8 September 2025 *"individuals or entities that plan to perform retail payment activities must be registered before performing any retail payment activities"*, with the first annual reports due 31 March 2026. Its own scope statement is unambiguous — under the retail payment supervision mandate it does not offer broader consumer protection, such as:

> dispute resolution between a PSP and its end users; concerns about fees charged by PSPs; > privacy complaints

We could not verify a current count of registered PSPs. The Bank's January 2026 FAQ gives no total and the public registry renders its table dynamically. Figures in the fifteen-hundreds circulate; we omit the number rather than launder it.

OSFI covers prudential and operational risk at federally regulated institutions. It published a technology risk bulletin in July 2026, *Generative and Agentic Artificial Intelligence: Implications for Technology, Cyber Security, and Operational Resilience*, defining agentic AI systems as ones *"composed of agents that rely on large language models (LLMs) to autonomously reason, plan, make decisions and take actions without human intervention"*, and advising institutions to *"establish limits on autonomy"* and enforce approval checkpoints for high-risk actions. It is non-binding sound practice addressed to banks and insurers, and it does not mention payments liability, consumer redress or agent-initiated transactions at all. Earlier, the joint OSFI–FCAC risk report (24 September 2024) recorded AI use among federally regulated institutions rising from roughly 30% in 2019 to 50% in 2023, with 70% expected by 2026 — drawn from a voluntary December 2023 questionnaire, so read it as a direction the respondents wished to report, not a measurement.

FINTRAC describes itself as *"Canada's financial intelligence unit and anti-money laundering and anti-terrorist financing supervisor"*, with a mandate *"to ensure the compliance of businesses subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and associated Regulations"*, money services businesses among them. That is where an agent wallet holding value would land. Nothing in that mandate speaks to whether a purchase was properly authorised — that inference is ours, from the mandate text.

FCAC states that its *"mandate is to supervise federally regulated financial entities and strengthen the financial literacy of Canadians"*, and that as a regulator it *"monitors and supervises the compliance of financial institutions, the external complaints body (ECB) and payment card network operators with consumer protection measures set out in legislation, public commitments and codes of conduct."* Note what that reaches: the institutions and the network operators, not the agent.

Four mandates, and the question "my agent bought the wrong thing, who eats it" falls between all of them. It is not that Canada answered differently from the US. It is that Canada has not been asked.

Canada imports the rulebook it did not write

Here is the part that matters for the regional comparison. Section 4.1.24 contains no Canada Region carve-out — we checked the extracted text: the word "Canada" does not appear anywhere in that section. It is not that the section avoids regional variation; it carries several LAC Region (Chile) timing carve-outs, so the drafters plainly considered geography. And the same rulebook does carve Canada out elsewhere: the surcharge prohibition at 1.5.5.2 states *"In the Canada Region: This does not apply to Visa Credit Card Transactions"*, deferring to Section 5.5.1.7, *Credit Card Surcharge Requirements – Canada, US Region, and US Territories*. So the allocation in 4.1.24.10 reaches Canadian cardholders by default, arrived at through a private rulemaking with no Canadian public process attached to it.

And the pipeline is already open. On 5 May 2026 Visa extended its Agentic Ready programme to Canada with BMO, CIBC, RBC, Scotiabank and TD, letting issuers *"Test agent initiated payments in controlled, real world environments using live cards and real merchants."* No volumes were disclosed, which is the tell for a pilot.

Meanwhile the public alternative is not ready. The *Consumer-Driven Banking Act* received royal assent in March 2026, and draft *Consumer-Driven Banking Regulations* were published in the Canada Gazette, Part I, Vol. 160, No. 26 on 27 June 2026, with the Bank of Canada as supervisor and accreditor and the Minister of Finance holding national security review. Phase one is explicit: *"Framework functionality will be limited to 'read only' access under phase one."* A second phase, described as covering *"broader scope and functionality, including write access"*, was announced in Budget 2025 as consultation and policy work, not as regulation. The phrase "payment initiation" does not appear anywhere in the draft regulations; we checked, and we do not put it in the government's mouth.

The consequence is precise. In Canada, an agent cannot initiate a payment through the public consumer-driven banking framework, because phase one is read-only. It can initiate one on the card rails today. The only route currently available is the one governed by a rulebook written elsewhere.

The comparison, stated carefully

The United States has, right now, an agentic payment that is contractually defensible: a defined transaction type, defined participants, an identity requirement, a consent requirement, and a named loss-bearer, all enforceable between network members. It does not have one that is publicly defensible — we found no statute, regulation or supervisory guidance addressing the case, and the two consumer regulations that exist stop at the word "authorized".

Those are different things, and conflating them is the mistake most coverage makes. A rulebook binds Visa, its issuers, its acquirers and its newly defined agentic participants. It does not, by itself, bind a consumer who never signed it; what reaches the consumer is the cardholder agreement, and whether that agreement can effectively import 4.1.24.10 is a question of contract law. The sequence is what distinguishes this region: here the private contract was written first and the public rule has not been written at all, which is the mirror image of the order described in The EU Wrote the Rules First and Left the Agent Out of Them, where the statutory layer landed before anyone had a rail to run on it. That inversion is why the American question is whether the allocation is enforceable against a consumer, while the European one is whether the transaction is permitted in the shape the network drew. We found no reported case testing it — with the caveat that we ran web searches, not a full docket search, and absence of a search hit is much weaker evidence than absence from a document we read end to end.

So: who gets to a court-defensible agentic payment first? Our forecast, and it is a forecast: the first US test will not be a consumer suing over an agent's purchase — the delegation is too clean and the amounts too small. It will be a *merchant* contesting a chargeback, arguing that a transaction routed through an Agentic Payment Provider cannot be "fraud, card-absent" when the network's own glossary calls that provider the Cardholder. Visa has pre-answered that in the compelling-evidence rules, which is presumably why they were written. *Falsifiable form*: if the first publicly reported US adjudication touching agentic payment liability is a consumer action rather than a merchant–issuer dispute, we were wrong.

The IMF's April 2026 note *How Agentic AI Will Reshape Payments* (Davidovic and Tourpe, IMF Notes 2026/004) is the least commercially motivated framing we found, and it names the same fault line: it *"highlights a key tension between probabilistic AI behavior and the deterministic requirements of payment infrastructures"* and *"reviews use cases and risks, including traceability, opacity, systemic effects, cybersecurity, and legal uncertainty."* Legal uncertainty is listed last and is, in the US, the one that got resolved first — by the party with the most to gain from resolving it quickly.

What we would check next

Four observable events, each of which would move this page.

1. Mastercard's operating rules gain agentic definitions, or a copy of the current Transaction Processing Rules becomes fetchable. Today Visa has 155 mentions and Mastercard is *reported* to have none. Convergence would make the private allocation an industry standard rather than one network's position; either way it would replace a law-firm reading with a document. 2. A new dispute condition, or a change to 10.4. The moment a network creates an agent-initiated dispute reason, the "the consumer bears it" reading weakens. 3. The CFPB, or a state attorney general, opens an agentic-payments matter. State UDAP enforcement is the likelier venue given the federal posture, and it would be the first public-law contact with the question. 4. Canada's phase-two consultation scopes write access. That is the only path by which Canada gets a domestic, publicly written answer instead of an imported one.

None of the four had happened as of 2026-08-03. The volume figures that would let anyone size the exposure — agent-initiated transaction counts on Western rails — remain undisclosed by every operator, which is what makes the counted, published numbers in The x402 Market, Counted: 14,766 Listings, 12,741 Calls a Day, One Winner unusual, and what China Shipped Agent Payments First. The 1,000x Volume Gap Does Not Survive the Numbers. throws into relief.