AI agent payments and KYA compliance

Card networks have built agentic payment infrastructure through 2026, but chargeback and liability rules have not kept pace. Visa expanded its Agentic Ready program globally in late April 2026, Mastercard and Santander completed Europe's first live end-to-end AI agent payment in March 2026, and Mastercard launched Agent Pay for Machines on June 10, 2026, enabling machine-to-machine payments with credentialed agent permissions. American Express introduced an agentic commerce developer kit and committed to covering erroneous purchases made by registered agents, while Visa and Mastercard have not published equivalent rules.

No payments network has published dispute rules allocating chargeback liability specifically between merchants, issuers, and agent platforms. Chargebacks911 warned that dispute infrastructure does not yet exist at the scale being built. A coalition of banks warned that AI shopping agents can steer users toward weaker payment protections, and no existing Visa or Mastercard rule holds an AI platform responsible when an agent makes a mistaken or unauthorized purchase, leaving merchants to bear that liability.

Know Your Agent (KYA) frameworks are taking shape. Legal analysts defined a five-pillar KYA compliance standard requiring identification of the accountable legal person behind each agent, covering identity, authority, monitoring, incident response, and compliance readiness. HM Treasury's 2026 Financial Services AI Adoption Plan named KYA protocols as one of three pillars of a trust framework for agentic payments, and the IMF issued a note calling for interoperable KYA verification standards. Draft standard ERC-8004 proposes encoding an AI agent's identity as an ERC-721 token on-chain, recording its creator and ownership history.

Merchant responses remain fragmented. Expedia stated it remains merchant of record for hotel bookings made via its Muse agent, keeping dispute ownership with the merchant. Amazon and eBay have blocked AI shopping agents to maintain control over their ad businesses and checkout flows. Target's position is that anything an agent does is 100% the consumer's liability.

Deloitte warned that current online transaction laws built on human intent, notice, and consent do not map cleanly onto autonomous AI agents, and that AI-facilitated transactions may be deemed unenforceable under the precedent established in Nguyen v. Barnes & Noble Inc. Cheq recorded a 100x surge in agentic shopping traffic over 45 days following releases of consumer AI agents.