The rules governing who can buy what, from whom, and under what authority are being rewritten by trade groups and card networks racing to keep pace with software that shops on its own.
On July 22, 2026, the Financial Data and Technology Association (FDATA) released a white paper on agentic fintech and write access, offering policymakers a governance framework for AI tools that can act on behalf of consumers across the US and Canada. The paper examines how agentic fintech can move beyond today’s read-only data access into customer-authorized instructions and payments, without necessarily requiring an entirely new regulatory regime.
“This paper demonstrates that we do not need to reinvent financial regulation for the age of agentic fintech. By applying existing principles around consumer protection, payments, and data governance in a proportionate and technology-neutral way, we can support innovation while maintaining the trust, choice, and safeguards consumers expect.”
Steve Boms, Executive Director of FDATA
Central to the proposal is a three-tier model: Read, Instruct, and Transact. All three stages are mapped against existing rules on data protection, liability, and alignment of interests. FDATA’s recommendations also include standing authorizations for scoped agent-initiated transactions and clearer liability rules for write-access activity, which is precisely the terrain merchant acquirers and payment gateways now have to operationalize.
Card networks aren’t waiting for Washington or Ottawa to settle the question though. Visa’s Trusted Agent Protocol (TAP), developed with Cloudflare, gives merchants a way to cryptographically distinguish a legitimate shopping agent from a bot before checkout even starts. The protocol attaches signed request headers so a merchant can verify an agent against a Visa-operated directory rather than treating every non-human visitor as suspicious.
Visa built TAP after clocking a surge in AI-driven traffic to US retail sites, and has since brought on processors including Adyen, Stripe, Checkout.com, Fiserv, and Worldpay as launch partners, signaling the acquiring scale it expected to adopt.
The problem with existing identity verification and dispute frameworks are that KYC, in its current form, assumes a human is the one shopping. Now, agentic compliance mechanisms are being built for a purchaser that has no face, no browser fingerprint in the traditional sense, and no consistent behavioral pattern that legacy fraud models recognize. Rapid sequential orders and cross-category purchases — obvious red flags of a compromised account under old rules, today may simply be a sign of how an agent shops. And yet, the change in shopping and identification patterns does not necessarily mean the complete shift of liability should happen as well.
However, chargebacks compound the problem of ambiguous liabilities. If an agent overspends, misreads a return policy, or buys the wrong item, existing frameworks like Regulation E were never written with a non-human decision-maker in mind. FDATA’s write-access proposal and Visa’s TAP each chip away at the ambiguity from different angles. The first one from the standing-authorization side, the other from the transaction authentication side, but neither currently answers who eats the loss when both checks pass and the purchase still goes wrong.
The frameworks are arriving faster than the consensus on who’s accountable when they fail. Therefore, for now, PaySpace Magazine Global audience, i.e. PSPs, merchant aggregators, and fintech founders, face the near-term task of navigating agentic commerce landscape in the nearly Wild West style. Without clear rules defined, mapping fraud rules to agent behavior, deciding whether standing authorizations get built into onboarding flows, and figuring out which liability shield (e.g. network-issued or self-built) a given business model can actually rely on, is a risky experiment that stumbles on the first legal dispute faced.
Regulators in both the United States and Canada have a chance to change that, especially considering that open finance frameworks are still in progress as well across the globe, so emerging AI-enabled financial services may become part of those legal regimes already discussed rather than waiting for a whole new legal framework to arrive.
