As AI agents begin executing financial transactions, errors in how they interpret instructions could lead to unauthorized payments or trading losses. At an October 20 Axios Live event in Las Vegas, FDIC Chairman Travis Hill and Alpaca co-founder and CEO Yoshi Yokokawa discussed how much authority customers might delegate to these systems and who could bear responsibility for mistakes.
Banks and payment companies must establish whether each transaction falls within the customer’s permission. Verifying an agent’s identity addresses account access, but institutions also need evidence of what the customer authorized and procedures for resolving losses when an agent exceeds those instructions.
- Visa’s pilot lets AI agents complete approved supplier payments
- What happens when an agent exceeds payment instructions?
- Visa’s protocol verifies agents, but payment controls remain necessary
- Banks restrict third-party agents as regulators examine the risks
- Who is responsible when an agent makes an unauthorized payment?
Visa’s pilot lets AI agents complete approved supplier payments
On October 20, Visa announced a live pilot with BILL and Billtrust that lets AI agents complete supplier invoice payments after buyers approve them. BILL’s payment agent follows those instructions through Billtrust’s supplier portal, which verifies the agent before granting access.
The agent uses payment tokens in place of sensitive card credentials. These tokens let it submit the approved payment while keeping the underlying card details protected.
The announcement describes a pilot limited to previously authorized payments, with no confirmation of general availability. It also does not indicate that agents can independently choose recipients or approve purchases.
For accounts-payable teams, this process could reduce manual entry into supplier portals. Any authority to choose a recipient or change payment details would need separate approval and controls to prevent transactions beyond the buyer’s instructions.
What happens when an agent exceeds payment instructions?
If a business approves a $2,000 payment to an established supplier and its AI agent encounters different payment details in the supplier portal, the transaction should pause for confirmation. Permission to access the platform does not give the agent authority to send money to an unapproved recipient.
When a payment goes wrong, investigators may need to examine several providers’ actions. The agent software interprets the customer’s request, while the payment platform applies transaction limits before the financial institution processes the transfer. Comparing the original approval with the submitted payment could reveal where instructions were misinterpreted, or restrictions failed.
Establishing the cause would assess responsibility, although reimbursement could depend on applicable law and contractual terms. Customers need dispute procedures that specify who handles their claim and how that provider determines whether the payment was authorized.
Trading losses require a similar examination of permission. An agent that buys securities outside the customer’s instructions presents a different issue from an approved investment that later declines in value. Providers should explain how their agreements treat each situation and what recourse customers have.
Visa’s protocol verifies agents, but payment controls remain necessary
Visa’s Trusted Agent Protocol uses cryptographically signed information to help merchants verify an AI agent’s identity and the purpose of its interaction. Merchants can distinguish recognized agents from unidentified traffic, although additional controls are needed to establish whether a transaction falls within the customer’s authorization.
Financial institutions could impose transaction caps and approved-recipient lists. Changes to payment details should require renewed authorization, and customers should be able to revoke an agent’s access immediately.
Transaction monitoring could flag unusual payment patterns, while audit records would help investigators compare the customer’s instructions with the submitted payment. These are proposed safeguards; their implementation across Visa’s pilot has not been independently verified.
Banks restrict third-party agents as regulators examine the risks
According to an October 22 Reuters report, major U.S. banks have restricted third-party AI agents from accessing customer accounts amid concerns about unauthorized activity. Reuters cited reports of agents acting beyond users’ instructions, although a source said Morgan Stanley had imposed restrictions despite observing no rogue-agent incidents.
These restrictions suggest banks want to determine how agents verify their identity and which account functions they can use. A customer’s login credentials may grant access beyond the specific transactions the customer intended to authorize.
Hill also addressed how model-risk guidance applies to generative and agentic AI as regulators assess the need for further guidance. The April 2026 interagency document excludes both technologies from its scope, while stating that banks should use their risk-management practices to determine appropriate controls for systems outside its coverage.
Although the document imposes no independently enforceable requirements, regulators retain authority to act against legal violations or unsafe banking practices. Any future AI-specific guidance would operate alongside those existing supervisory responsibilities.
Who is responsible when an agent makes an unauthorized payment?
Determining who bears a loss would require investigators to compare the customer’s authorization with the agent’s actions, then assess the applicable legal and contractual obligations. A platform’s failure to enforce a spending limit could raise different liability questions from an agent’s misinterpretation of an approved instruction.
Before customers entrust agents with more consequential financial decisions, providers need clear procedures for investigating errors and settling disputed losses. Financial institutions should demonstrate that their systems enforce the limits customers set and explain when reimbursement is available.
The case for greater autonomy depends on whether agents stay within those permissions and whether customers have recourse when they do not. Completing a payment successfully provides only part of that evidence.
