For the past two years, AI in financial services has mostly meant AI that recommends. It summarises the case, drafts the response, flags the risk — and then a human does the thing that actually matters.
That gap is closing.
In the last twelve months Visa, Mastercard, Google and Stripe have all put agentic payment protocols into the market. Visa’s Trusted Agent Protocol, Mastercard’s Agent Pay, Google’s AP2 and the Agentic Commerce Protocol behind Stripe and OpenAI differ in the detail, but they solve the same three problems: how a merchant knows an agent is who it claims to be, how an agent proves a human authorised what it’s doing, and how it carries a payment credential it cannot misuse.
The rails are being laid now. So we stopped reading about it and built on them.
Three prototypes
Our sister company Enablis built three working demos - Buying, Permissions and Merchant Readiness - each one deliberately narrow, each one chosen to uncover something different.
01 - Conversational buying - the purchase flow
WHAT WAS TESTED
Keeping research, comparison and checkout inside a single agent conversation.
THE FINDINGS
Executing the payment was straightforward. The hurdle is fraud. Legacy fraud engines read "no human" as an attacker, authorised agents look identical to malicious bots, and step-up security checks fail when an agent buys at 3:00 AM with nobody at the screen.
02 - Cryptographic permission - the spend limit
WHAT WAS TESTED
A signed spending limit that travels with the agent and validates before funds move.
THE FINDINGS
A setting stored in an app database proves nothing to an external party. Permission has to be a cryptographically signed record - bounded by time and amount - that banks and merchants can verify independently, long after the transaction finishes.
03 Merchant readiness - the capabilities audit
WHAT WAS TESTED
Scoring a merchant platform against the six capabilities an agentic transaction needs.
THE FINDINGS
Four of the six capabilities needed to be ready for agentic payments are straightforward in terms of engineering: machine-readable catalogues, agent-friendly checkouts, retry handling and identity verification. The two that will likely stall readiness is governance - who signs off an agent as a valid counterparty, and which team pays when an agent transaction is disputed.
The findings were consistent across all three: AI making payments is fairly easy to enable. The protocols work. What’s genuinely unresolved is everything around the payment - how much authority you hand an agent, how narrowly you can scope it, how you revoke it, and whether, afterwards, you can prove what it was allowed to do and what it actually did.
Open finance raises the stakes
Agentic payments give you an actor to operate on your organisation's behalf. Open finance gives that actor insightful data to work with.
In April the FCA set out its vision for open finance, extending data sharing beyond current accounts into mortgages, investments, savings and pensions, with a discussion paper on the first scheme due this quarter. Open banking passed 16.5 million active connections last year, up 36%, carrying 351 million payments.
Put agentic payments and open finance together and you get something genuinely new - an agent that can see a customer’s whole financial position and act on it. That’s a better product. It’s also a much larger blast radius when it goes wrong.
Government has noticed. July’s Financial Services AI Adoption Plan put a trust framework for agentic payments among its high-priority recommendations, including identity protocols it calls “Know Your Agent”. HM Treasury’s consultation on modernising payment services, which closed earlier this month, asked directly whether the rules on authentication, consent and liability still work when the party giving consent isn’t a person.
Four questions to assess your agentic payment readiness
Most readiness conversations stall on capacity - do we have the people. We think that’s the wrong question. Ours are:
- Architecture. Can your systems tell an agent apart from a customer?
- Authority. What is an agent allowed to do, and who decided?
- Assurance. Can you prove, after the fact, what it was permitted to do and what it did?
- Accountability. When it gets it wrong, who answers?
Enablis's latest insights piece: When AI can spend your money
Enablis put what they learned to the people running AI and engineering inside banks. Their latest piece includes views from Vanquis, LHV Bank and FinTech North, and the real-time assurance platform they built for TransUnion, now monitoring 1.5 million credit requests a day.
