In its article “Agentic Payments: When Payments Learn to Think”, the Deutsche Bundesbank addresses a topic that is likely to become much more than a vision of the future in the coming years: payments that are not merely executed automatically, but autonomously planned, initiated or managed by AI agents. In doing so, the Bundesbank outlines a potential structural shift in the payments landscape while also addressing an issue at the heart of current market and regulatory developments. The article was published in the Bundesbank’s Monthly Report on 21 September 2026.
Table of Contents
The market is still at an early stage of development. However, the Bundesbank’s publication demonstrates that agentic payments are becoming increasingly relevant from a regulatory perspective and that payments law, AI governance, DORA and data protection can hardly be considered in isolation in this context.
More Than Just Automation
With agentic payments, the AI agent no longer merely makes preparatory or supporting decisions but becomes part of the payment process itself. Within a predefined mandate, it can, for example, select the payment method, timing or settlement route and subsequently initiate a payment. Many modern AI agents use probabilistic AI models: their decisions are not based solely on predefined rules but are made on the basis of available information and probabilities.
Areas of Application for Agentic Payments
The use of AI agents is particularly conceivable in retail payments. This area is characterised by high transaction volumes, comparatively low individual transaction values and a wide range of standardised payment methods. It is precisely this standardisation that facilitates the use of agentic systems. AI agents can compare payment routes, transmit payment data, select payment methods and initiate payments.
The interaction with agentic commerce currently plays a key role. While agentic commerce applications can search for, compare and select goods and services, agentic payment solutions handle the actual payment process. As a result, the payment process can largely recede into the background from the user’s perspective. Typical use cases range from automated purchases and the management of subscriptions and invoices to rule-based spending models. Agents can also optimise the choice of payment method, for example to take advantage of discounts, early-payment discounts, loyalty points or cashback benefits.
However, agentic payments are not limited to agentic commerce. They are also conceivable in conventional checkout situations where users make the purchasing decision themselves while the AI agent merely handles the payment process. Applications in financial and wealth management are another possibility, for example where agents automatically reallocate surplus liquidity on the basis of predefined return, risk or liquidity parameters and initiate the payments required to implement those decisions.
Further potential applications include micro- and instalment payments. AI agents can automatically initiate very small payments or payments subject to specific conditions, thereby supporting more usage-based business models. The Bundesbank also sees potential in cross-border payments: agents could compare providers, fees, exchange rates and execution times and select the most cost-effective or fastest payment route for the user.
What these use cases have in common is that the agent does not merely execute a predefined payment order from a technical perspective but can make its own decisions about the payment process within certain parameters.
This also opens up new areas of application in institutional payments. Banks, payment service providers and businesses could use agents for purposes such as routing, payment aggregation, liquidity management or selecting suitable settlement routes. At the same time, however, the Bundesbank emphasises that the market is still at an early stage of development and that many applications are currently only being tested or piloted.
Key Payment Law Issues: Authorisation and SCA
From a legal perspective, the authorisation of payment transactions is a key issue. For the time being, PSD2 remains the relevant framework; in future, the corresponding requirements will be governed by the interplay between PSD3 and the directly applicable Payment Services Regulation (PSR). However, the new legal framework likewise does not contain any specific provisions for agentic payments. The fundamental question therefore remains: how can the general rules on authorisation, authentication and liability be applied to payment transactions where an autonomous decision by an AI agent takes place between the customer’s mandate and the specific payment?
In particular, the question arises as to whether a mandate granted to an AI agent in advance is sufficient to constitute authorisation within the meaning of Article 64 PSD2 or Section 675j of the German Civil Code (BGB), or whether the agent’s activities could themselves qualify as a regulated payment service, such as a payment initiation service. This gives rise to further questions of classification: how specific must the customer’s instructions be, how much discretion may the agent have, and how can it be demonstrated in the event of a dispute that a specific payment was still covered by the mandate granted?
Where an agent makes its own decisions within a defined framework, clear rules are required regarding the limits of the mandate, any actions exceeding those limits, revocation, prioritisation and emergency stop mechanisms. Where does an action covered by the user’s mandate end, and at what point does a payment become unauthorised? These questions are far from academic. They affect civil liability as well as complaints and claims processes, the allocation of the burden of proof and the practical design of customer interfaces.
Closely linked to the question of authorisation is strong customer authentication (SCA). Where it is not the user who initiates the payment transaction at the final stage, but rather an agent acting on the user’s behalf, the question arises as to when and how authentication must be implemented from both a legal and technical perspective. Does each individual payment need to be authenticated again? Is a sufficiently granular authorisation granted in advance sufficient? Or are new models of delegated authentication required?
For autonomous agent models, it must also be determined how SCA requirements can be implemented in practice and whether existing exemptions can be relied upon, for example for low-value transactions, whitelisting, transaction risk-based exemptions or merchant-initiated transactions. As systems become increasingly autonomous, these questions of interpretation are likely to become significantly more important.
These issues will not become obsolete with PSD3 and the PSR. The new legal framework further develops the requirements relating in particular to strong customer authentication, fraud prevention, liability and open banking, but does not currently establish a separate regulatory framework for autonomous AI agents. Agentic payments will therefore initially have to be assessed under the general provisions of the future payment services framework as well.
Agentic Payments as a Cross-Cutting Regulatory Issue
From a regulatory perspective, agentic payments cannot be considered solely through the lens of payment services regulation. As systems become increasingly autonomous, payments law, DORA, data protection, AI governance and general supervisory requirements increasingly intersect. This is precisely where one of the key challenges lies: the payment transaction becomes part of a technically and organisationally far more complex system based on AI models, data sources, interfaces and, frequently, multiple third-party providers.
For regulated institutions, requirements relating to digital operational resilience therefore come to the fore. Agentic payment models create new dependencies on models, APIs, cloud providers and other technology providers. Issues relating to ICT risk management, access control, incident management, logging and the monitoring of agents’ actions therefore become directly relevant. It must also remain possible to identify which components are critical to the execution of a payment transaction and what impact the failure or manipulation of individual components could have on the overall process. Agentic payments are therefore also a matter of ICT and third-party governance under DORA.
At the same time, significant data protection issues arise. In making their decisions, AI agents may access and combine highly sensitive payment, transaction, consumer or behavioural data. It is therefore necessary to determine, in particular, the legal basis on which such data is processed, the purposes for which it may be used, and how the principles of data minimisation and purpose limitation can be ensured. In the case of learning or context-sensitive agents, the processing of data and the resulting decisions must also remain sufficiently transparent and comprehensible to the user. General privacy notices alone will generally not be sufficient for this purpose. Instead, robust frameworks governing the allocation of roles, data flows, access rights and documentation will be required.
The identity of the agent itself is also of particular importance. For agentic payments to operate reliably, it must be technically possible to determine which agent is acting, on whose behalf it is acting, what authority it has and whether a specific action remains within the scope of its mandate. Secure identity and authorisation models, together with tamper-resistant logging of agents’ actions, are therefore relevant not only for authorisation and liability. They also play a key role in AML/CFT, fraud detection, compliance and incident management.
The contractual allocation of responsibilities between the customer, agent provider, merchant and payment service provider is likewise becoming increasingly important. Erroneous decisions by an agent could, for example, result in payments being initiated outside the scope of its mandate, unwanted products being purchased or transactions being carried out with fraudulent merchants. Clear rules on responsibility and liability, reliable and evidentially robust documentation of the mandate, and technical and organisational mechanisms for limiting the agent’s scope of action will therefore become all the more important.
A further particular challenge lies in the differing functional logic of AI and payment systems. Traditional payment systems are based on deterministic rules: a payment transaction must be capable of being clearly initiated, executed, booked and finalised. AI systems, by contrast, often make decisions probabilistically. They assess probabilities and select a course of action on that basis.
This is not problematic per se, but it can lead to outcomes that are not entirely predictable or reproducible. In the context of payments, this can have significant consequences. Even the order in which payments are executed can, for example, affect liquidity, interest or the performance of contractual obligations. A purely probabilistic decision-making logic therefore reaches its limits where legal certainty, finality and clear accountability are required.
Agentic payments are therefore likely to require a governance model that translates the AI agent’s probabilistic decision into a binding, deterministic process before the payment is actually executed. The agent could, for example, select or propose a course of action, while the specific payment instruction would subsequently have to be validated, authorised and executed in accordance with clearly defined rules. Payment service providers, agent providers and financial market infrastructures will need to develop appropriate technical and organisational control mechanisms for this purpose.
Risks of Agentic Payment Systems
As AI agents become increasingly autonomous and interconnected, operational, technical and systemic risks are gaining prominence alongside legal considerations. Even highly capable models cannot entirely eliminate the risk of erroneous decisions. Such errors may result, among other things, from model bias, misinterpretation of user preferences, software errors or hallucinations. In the retail sector, this may lead to unintended purchases, reduced visibility over personal spending or delays in identifying erroneous transactions.
Appropriate control and limitation mechanisms are therefore essential. These could include transaction amount and merchant limits, additional checks before a payment is executed, or mandatory human approval for unusual or particularly high-value transactions. With complex models, however, inherent biases and the lack of transparency of complex algorithms – the “black-box” problem – can make decisions more difficult to understand and consequently impede subsequent error analysis.
As agent-based systems become increasingly interconnected, interoperability and IT security are also becoming more important. Suitable interfaces and technical standards are required to enable different agents, merchants, payment service providers and payment infrastructures to communicate securely with one another. At the same time, every additional interface expands the potential attack surface. Risks may arise in particular from manipulated agents, compromised credentials, misuse of interfaces or attacks on the availability of the systems involved. Increasing interconnectedness therefore also makes it necessary to reassess which actors and technical components are critical to the functioning of the overall system and how their resilience can be ensured.
New forms of fraud and manipulation risk must also be considered. Criminals could deliberately tailor their activities to the decision-making logic of AI agents, for example by presenting themselves as supposedly legitimate merchants or attempting to induce agents to carry out specific transactions through manipulated information. Direct attacks on agents are also conceivable – for example, to probe security mechanisms, gain access to confidential customer data or manipulate the decision-making process through prompt injection. Finally, agents specifically designed for fraudulent purposes could also be introduced into payment ecosystems.
Beyond individual payment transactions, agentic payments may amplify systemic risks. If large numbers of agents use similar models, data sources or objective functions, they may make similar decisions simultaneously. Such herding behaviour could lead to increased liquidity requirements, peaks in technical workloads or procyclical effects, particularly where transaction volumes are high. Implicit algorithmic collusion between agents that frequently interact with one another should likewise be considered as a potential risk.
This is particularly sensitive where AI agents are used for institutional liquidity management. Decisions based on historical data may reach their limits in unusual market conditions or periods of crisis. At the same time, agents optimising according to similar parameters could amplify system-wide effects such as gridlock or free riding, for example by withholding payments in order to minimise their own liquidity requirements. Potential countermeasures range from adjusted objective functions and transparent feedback mechanisms to restrictions on the degree of autonomy. Exceptional situations will also require escalation and intervention mechanisms that allow for human review or override.
Another essential prerequisite for functioning agentic payment models is the quality and availability of data. AI agents depend on up-to-date, reliable data and standardised interfaces. Unequal access to data may not only affect the quality of decisions but also contribute to distortions of competition. Interoperability, harmonised interfaces and robust data standards are therefore likely to play a central role in the broader integration of agentic payments into existing payment ecosystems.
Overall, the risks extend far beyond individual erroneous decisions by an AI agent. They affect individual transactions, cyber and fraud risks, market structures and the stability of payment infrastructures. The more autonomously and extensively interconnected agentic payment systems become, the more important technical safeguards, clearly defined mandate boundaries, human intervention capabilities (human-in-the-loop) and robust governance structures will be.
New Challenges for Supervision and Regulation
As systems become increasingly autonomous, the question also arises as to whether the existing regulatory framework is sufficient in all respects. While the relevant European regulatory frameworks are generally designed to be technology-neutral, agentic payments may introduce new actors and risk scenarios into the payments ecosystem that have not previously been a primary focus of regulation.
This is particularly relevant for providers that have traditionally operated outside the financial sector but whose technology effectively becomes an essential component of payment initiation or payment management. In principle, the approach of “same business, same risks, same rules” should apply to such providers: comparable risks should be subject to comparable regulatory requirements, irrespective of the underlying technical or corporate structure. Otherwise, there is a risk of competitive distortions and regulatory arbitrage. At the same time, the principle of proportionality remains important to ensure that innovative business models are not subject to requirements that are disproportionate to their actual risk profile.
In this context, the Bundesbank also raises the broader question of whether existing supervisory standards, such as the Principles for Financial Market Infrastructures, may in the longer term need to be adapted to agentic payment systems or, at a minimum, further developed in terms of how they are applied. The greater the influence of AI agents on payment flows, liquidity and routing, the more relevant they will also become for payment systems oversight and financial stability.
Conclusion
Agentic payments are more than simply another stage in the automation of payments. The more autonomously AI agents are able to decide on the payment method, timing or execution of a payment, the more the central regulatory question shifts towards the following: how can a probabilistic decision by an AI system be transformed into a legally attributable, authorised and secure payment instruction?
The existing legal framework already provides important points of reference – ranging from authorisation and strong customer authentication under PSD2 to data protection, DORA, governance and liability requirements. PSD3 and the PSR will not fully resolve these issues either. To date, the future payment services framework does not provide a specific regulatory architecture for payment models in which an autonomous decision by an AI agent intervenes between the customer’s mandate and the specific payment.
The key challenge is therefore less whether existing and future payment rules apply to agentic payments, but rather how those rules should be translated to new technical roles, processes and responsibilities. In particular, clearly defined mandates and limits on autonomy, reliable identity and authorisation mechanisms, evidentially robust logging, and effective control and escalation mechanisms will be required.
There is also a strategic dimension, as many of the agentic payment solutions and technical standards currently emerging are being shaped by non-European providers. The issue therefore extends beyond regulatory compliance to the question of who will ultimately control the key decision-making, identity and access layers of the European payments ecosystem. Concentration among a small number of platforms or protocols could create new dependencies, raising questions of competition, resilience and technological sovereignty. The Bundesbank therefore identifies interoperability, open interfaces and provider diversity, in particular, as important prerequisites for a functioning market.
The Bundesbank’s publication therefore comes at an important time. While Europe is reshaping its payment services framework through PSD3 and the PSR, agentic payments are already creating an additional technological layer within the payments ecosystem. The issue is not merely whether existing regulatory categories can also be applied to AI agents. In particular, the concepts of mandate and authorisation, regulatory roles, responsibilities, technical control mechanisms and the boundaries of autonomous decision-making will need to be defined for this new environment.
