Disclosure: I work on Pink Agentic AI Payments at PinkWallet, a spend-control layer for AI agents. None of the documents below mention Pink; they are summarized here in my own words, each linked to the publisher's official copy. Where I connect their ideas to a product, that is my interpretation, not theirs.
Short answer: In 2026, regulators, banks and consultancies converge on the same four controls for AI agents that pay: (1) a mandate that limits what the agent may buy (amount, payee, time), (2) a check at the moment of payment, not only at setup, (3) escalation to a human above a threshold, and (4) clear accountability when an agent gets it wrong. Almost none of them think "a human approves every payment" is realistic at scale, and none of them treat a prompt instruction as a control.
What each document says
Monetary Authority of Singapore (MAS) and industry members — Safeguards for Agentic Finance at Runtime (SAFR), v1.1, Oct 2026. Proposes that every agent action gets a runtime decision. Its "Escalate" outcome covers actions that are in scope but "above the threshold for autonomous execution", which are held for human review. It recommends per-action and aggregate value thresholds: below them the agent may act, above them a human reviews or the action is blocked. Official PDF
Bank of England — Sarah Breeden, "Agents of change", ECB Forum, June 2026. Names consent and authorisation for multiple transactions, and how disputes and liability are settled, as the open payment questions, and warns that keeping a human in the loop for every agent action is unlikely to be realistic. Official speech
Consumer Bankers Association — Agentic AI Payments white paper, Jan 2026. Describes agent authorization as given in advance and conditional on parameters the consumer set, and flags that existing protection for unauthorized transactions may not fit agent payments cleanly. Official PDF
Consumer Bankers Association — supplemental letter after the FSOC AI roundtable, Apr 2026. Argues that agentic risk comes from delegated authority across multi-step actions, and that consumers may end up liable for costly agent mistakes. Official PDF
GLEIF — Agentic AI in Payments: Establishing Interoperable Trust and Control, 2026. Describes delegation as limited authority with a payment class, counterparties, transaction ceilings, a validity period and escalation conditions, and pairs a static mandate with a runtime policy engine that evaluates conditions when the payment executes. Official PDF
CERRE (Christoph Busch) — Agentic AI and Consumer Protection, Jul 2026. Lists exceeding a spending limit through malfunction, hallucination or prompt injection as a concrete consumer risk, and contrasts it with human-in-the-loop setups where the consumer confirms each proposed transaction. Official PDF
Worldline — Agentic Commerce: The next transformation, 2026. Frames the payment mandate (how much and by which method) as the key consumer control and asks how people can confidently set a maximum budget. Official PDF
Citi Institute GPS — Agentic AI: Finance & the "Do It For Me" Economy, Jan 2025. Discusses a prefunded agent wallet with a capped total budget (an approach Citi credits to Bain) and a model where the agent does most of the work but humans keep final approvals. Official PDF
J.P. Morgan Payments — Payments Outlook 2026. Describes agents transacting autonomously within defined, narrow parameters, and for treasury expects agents to propose actions while humans keep the final say. Official PDF
Kearney — Agentic commerce: from brand loyalty to bot logic, Aug 2025. In its US consumer survey, the ability to limit how much an agent can spend is one of the features consumers ask for. Official PDF
KPMG Ireland — The next era of payments (x402), 2026. The most optimistic of the set about autonomous machine payments; it puts the burden on policymakers and firms to define accountability for AI-initiated transactions. Official PDF
The pattern, in one table
| Control | Who calls for it |
|---|---|
| Mandate / scope (amount, payee, time) | GLEIF, Worldline, CBA, J.P. Morgan, Citi |
| Check at the moment of payment | MAS (runtime decision), GLEIF (runtime policy engine) |
| Threshold → human, otherwise autonomous | MAS, Citi, J.P. Morgan, CERRE |
| Not a human on every action | Bank of England, MAS, Citi |
| Accountability and liability | Bank of England, CBA, KPMG |
| Spending limit as a consumer feature | Kearney, CERRE |
What this means if you build agents that pay
- Write the mandate down as data, not as a prompt. A budget in the system prompt is text the model can misread or be talked out of; a mandate checked by the payment layer is not.
- Decide at execution time. The same request can be fine on Monday and over budget on Friday.
- Use three answers, not two. Allow, escalate to a person, or block. Escalation should default to "no" if nobody answers.
- Keep the record. Who set the rule, which rule matched, who approved. That is what the liability questions above will be settled on.
One way to get these four without building them: an approval layer in front of the payment rail. Pink is one example (per-agent budgets and payee rules, checked on every request, answered with allowed / pending human / blocked; public sandbox with test money only): pinkwallet.com/agentic. A sourced map of 33 products across all layers, including other spend-control tools, is here.
If I misread any of these documents, comment with the page and I will correct it.
Top comments (0)