Summary
- Six banks have jointly published principles for agentic commerce as AI systems move towards selecting products and completing payments for customers.
- The framework focuses on transparency, safety, privacy and data, customer choice, and interoperability.
- Identity, authorisation, fraud, liability, and recourse become more complicated when an AI agent acts between the customer, merchant, and payment provider.
NatWest Group, ING, and four other global banks have proposed a shared set of principles for agentic commerce as artificial intelligence begins to move from helping customers search for products towards acting on their behalf during transactions.
The group — NatWest, ING Group, Bank of America, Capital One, Commonwealth Bank of Australia, and ASB Bank — wants the emerging payment model to develop around five areas: transparency, safety, privacy and data, customer choice, and interoperability.
Agentic commerce describes systems in which an AI agent can do more than recommend a product. Depending on the service and permissions involved, an agent may compare offers, choose an item, interact with a merchant, and help initiate or complete a payment for the customer.
That introduces another participant into processes where identity, authorisation, liability, and fraud controls have historically been designed around a customer directly instructing a merchant or financial institution.
The banks want participants to be able to identify when an agent is involved and for customers to retain control over how transactions are made. They are also calling for common treatment of data and interoperability so that agentic services do not develop as isolated payment environments with incompatible trust models.
The security exposure extends beyond manipulation of the AI model itself. An agent acting with purchasing authority may handle payment credentials, account data, customer preferences, merchant information, and identity signals. Compromise of that authority could combine elements of account takeover, payment fraud, third-party risk, and data misuse.
Establishing intent also becomes more complicated. Existing payment systems generally distinguish the customer, merchant, bank, and payment processor. An autonomous agent inserts another layer that may act under delegated authority while making choices the customer has not specified transaction by transaction.
Identity and authorisation therefore become fundamental to the model. A merchant needs to know whether an agent is legitimate, whose authority it is exercising, and whether a purchase falls within the permission granted. Banks need enough information to apply fraud controls without preventing legitimate automated transactions.
The same questions affect disputes. If an agent selects an incorrect product, exceeds an agreed limit, acts after its permission should have expired, or operates from a compromised account, responsibility has to be allocated among the customer, agent provider, merchant, and financial institution.
The six banks are not proposing a finished technical standard or new regulation. Their paper is intended as an initial framework, with other banks and payments participants invited to contribute to a subsequent implementation blueprint.
That leaves the technical form of agent identity unresolved. Delegated authority could eventually rely on payment credentials, platform attestations, transaction metadata, or other mechanisms capable of expressing what an agent is permitted to do and for how long.
Existing regulatory regimes will continue to apply around those systems. Payment services, consumer protection, data protection, fraud controls, and AI governance can intersect in a single transaction even when the customer experiences it simply as an automated purchase.
The banks’ intervention shows that agentic commerce is beginning to be treated as a payment-infrastructure question rather than only an AI interface. As agents gain the ability to spend rather than merely recommend, the security model has to establish not only who the customer is, but which machine is authorised to act for them, under what limits, and who is responsible when that authority is abused.
