How Autonomous AI Agents Meet PSD3, the Instant Payments Regulation, and a Consent Standard Europe Did Not Write
Strong Customer Authentication is, at bottom, a turnstile that opens only for a heartbeat. Europe spent the better part of a decade building it, and by the regulators’ own measure it worked. The complication arriving now is that the party asking to pass has no pulse, carries a perfectly valid credential, and was hired by the account holder on purpose.
A rulebook buil aroud a present human
European payments law rests on a quiet anthropological assumption: behind every transaction stands a person who can be asked to prove they are there. Strong Customer Authentication, in force since 2020, turned that assumption into two factors drawn from knowledge, possession and inherence.
The joint payment fraud report published by the European Banking Authority and the European Central Bank in December 2025 gives the problem its shape. Fraud across the European Economic Area reached roughly 4.2 billion euros in 2024, up about 17 percent, with fraudulent credit transfers near 2.5 billion of that and rising some 24 percent. The authorities concluded that authentication is broadly holding and that fraudsters have adapted by manipulating payers into authorizing transfers themselves. Payment service users absorbed around 85 percent of credit transfer fraud losses.
That finding deserves more attention than it received. Fraud has migrated away from defeating the turnstile and toward persuading a legitimate human to walk through it. To the payment infrastructure, an autonomous agent presents exactly the same profile. It presents genuine credentials, acts within a mandate it claims to hold, and is not the person whose name is on the account.
The legislative calendar around this was drafted before the problem became commercially real. The Instant Payments Regulation has required Verification of Payee in the euro area since 9 October 2025, with non-euro providers following by July 2027. PSD3 and the accompanying Payment Services Regulation reached political agreement on 27 November 2025, were endorsed by COREPER on 22 April 2026, and apply roughly twenty-one months after publication. Europe will enter the 2030s governed by a payments rulebook negotiated when agentic commerce was still nascent.
What an agent actually does with money
Strip away the vocabulary and a payments agent is a treasurer who never sleeps and never asks. In a mid-sized manufacturer it reads the ERP system, notices a liquidity shortfall eleven days out, sweeps balances across four currency accounts, executes the hedge, reschedules three supplier payments to protect an early settlement discount, and files the reconciliation before anyone opens a laptop.
Every one of those acts is legally significant. Each is a place where European law expects a signature and silently assumes a hand behind it. The existing authentication exemptions—for low-value payments, trusted beneficiaries and transaction risk analysis—are narrow operational carve-outs. To date, no European supervisor has issued written guidance extending them into a doctrine of delegated machine agency.
The surrounding instruments tighten rather than loosen. The AI Act places creditworthiness assessment inside Annex III, so an agent that decides rather than recommends inherits logging, human oversight and conformity documentation, with standalone high-risk obligations now scheduled for December 2027 following the Digital Omnibus. GDPR Article 22 grants a right not to be subject to decisions based solely on automated processing where the effects are significant, which describes a declined payment rather well—though an explicit, documented mandate may serve as the human authorisation that takes a decision out of the “solely automated” category. DORA pulls the model supplier inside the resilience perimeter. Four regimes, one transaction, and no article anywhere that says who signed.
The mandate Europe did not write
While Brussels legislated, the card networks built the missing piece. Visa announced Intelligent Commerce in April 2025 and a protocol-agnostic on-ramp a year later. Mastercard launched Agent Pay around the same time, built on agentic tokens that bind a credential to one specific agent, one merchant scope and one consent policy. Google published the Agent Payments Protocol in September 2025 with more than sixty launch partners and donated the second version to the FIDO Alliance in April 2026.
The commercially decisive object in all of these is not the token. It is the mandate: a signed record of what a human authorized before stepping away—how much, for what, for how long, and when the delegation lapses. That artifact is precisely what European law needs in order to allocate liability, satisfy Article 22 and populate an audit trail. It is being standardized outside Europe, by commercial actors, on a commercial timetable.
What should such a mandate contain, at minimum? Scope and amount limits are obvious. Duration and revocation mechanisms matter equally: a delegation without a clear expiry or a one-click revocation path is a liability trap. The mandate should also record the merchant or counterparty scope, the purpose of the expenditure, and any human override thresholds above which the agent must pause. These are not technical details. They are the difference between a delegation a court can interpret and one it cannot.
A standard is a riverbed. Whoever digs it first decides for a generation where the water runs. Europe is on course to legislate the water rights of a channel cut elsewhere and ratified by an industry alliance with significant American membership. That is workable only if European supervisors engage with the mandate format early enough to shape what it records. There is a genuine opening here for European RegTech. The translation layer between a signed delegation and a supervised liability allocation is unbuilt, difficult, and exactly the sort of unglamorous infrastructure the continent has historically done well.
Settlement is the other half, since agents prefer money that is programmable. A small number of MiCA-authorized euro stablecoins carried a combined value near 674 million dollars in the year to early 2026, roughly 128 percent higher than twelve months before, with Circle’s EURC around 220 million of it. Against a payments market measured in trillions that is a rounding error. As a supervised, programmable settlement asset available to software, it is the only European instrument of its kind in production.
Washington’s absence, Beijing’s enclosure
The United States never imposed an equivalent of Strong Customer Authentication, so whether an agent may authorize a payment is settled by network rules and contract rather than statute. That produces speed. Grand View Research values global agentic commerce near 5.7 billion dollars in 2025 and roughly 7.7 billion in 2026, with North America holding close to 38 percent. Consent in the American arrangement is a private specification, and regulators arrive afterwards through enforcement.
China has done what China does: build the enclosure before releasing the animal. On 8 May 2026 the Cyberspace Administration of China, the National Development and Reform Commission and the Ministry of Industry and Information Technology jointly issued implementation opinions on intelligent agents, the first framework anywhere to treat agentic AI as a governed category in its own right rather than a species of model. The revised digital yuan framework took effect on 1 January 2026, adding programmable smart contracts, tiered wallets and interest on verified balances. An agent on those rails receives permission and constraint in the same document.
The asymmetry is not about who writes better rules. It is about who can answer the question of delegated machine consent inside a single decision cycle. Washington answers by declining to ask; Beijing answers by decree. Europe intends to answer deliberatively, which is the most legitimate route and also the slowest, and legitimacy compounds only if the answer arrives while the question is still open.
Spain as the test bench
Spain is a better laboratory than its profile suggests. Bizum now serves more than thirty million users across some forty institutions, close to the entire adult banking population, and reached roughly 3.4 million instant transfers a day during 2025. Banco de España has noted that it accounts for around half of all transfer payments in the country, and the phased rollout of in-store contactless payments through 2026 pushes the rail from person-to-person transfers into retail.
A near-universal instant rail, co-owned by the banks and supervised nationally, is an unusually clean bench on which to test what a delegated payment mandate should look like before it hardens into continental law. The institutional habit already exists. The financial sandbox created by Law 7/2020, jointly supervised by Banco de España, the CNMV and the Dirección General de Seguros, has run multiple cohorts concentrated in credit scoring, fraud detection and automated advice.
The digital euro sits behind all of it. The ECB moved to its next project phase in October 2025. It closed the call for expressions of interest from payment service providers in May 2026 and notified those selected at the end of June. A twelve-month pilot is expected from the second half of 2027, with possible first issuance around 2029. Whether that instrument will be programmable enough for an agent to hold and spend under a supervised mandate is a design decision being taken now, largely out of public view.
There is, however, a fragmentation risk worth naming. If national supervisors—Banco de España, BaFin, the ACPR—issue divergent criteria on machine-authorized payments before the European Banking Authority takes a position, the single market fragments precisely at the moment when it most needs a common standard. Spain’s sandbox is valuable, but only if its outputs feed a continental conversation rather than a national one.
The European wager
Europe is wagering that a consent standard which can be audited will outlast one that is merely convenient. It is a defensible bet. Delegated authority is the oldest problem in commercial law, and the continent has centuries of practice in deciding when a signature binds someone who was not in the room.
The bet fails in one foreseeable way. If the mandate format is settled abroad before European supervisors hold a position on it, European banks will spend the late 2020s writing liability opinions on a consent object they did not design, executing it on rails they license, and settling it in tokens denominated in someone else’s currency. The continent would then own the world’s most carefully reasoned rules on delegated payment authority and none of the infrastructure that carries it.
The window is short and dated. The Payment Services Regulation applies from roughly 2028, the AI Act’s standalone high-risk obligations from December 2027, the digital euro pilot from the second half of 2027. Somewhere in that overlap a European supervisor—most plausibly the European Banking Authority—has to state in writing what a machine may authorize on a person’s behalf. Until someone does, the safest payments system in the world will keep asking for a heartbeat, and the buyer will keep not having one.
Sources
Banco de España. (2026). Bizum and instant payments in Spain. https://www.bde.es
Circle Internet Financial. (2026). EURC market data, Q1 2026. https://www.circle.com/en/eurc
Cyberspace Administration of China, National Development and Reform Commission, & Ministry of Industry and Information Technology. (2026, 8 de mayo). Implementation opinions on intelligent agents. http://www.cac.gov.cn
European Banking Authority & European Central Bank. (2025, diciembre). 2025 report on payment fraud. https://www.eba.europa.eu
European Central Bank. (2025). Instant payments regulation and verification of payee. https://www.ecb.europa.eu
European Central Bank. (2026). Digital euro project timeline. https://www.ecb.europa.eu/euro/digital_euro
FIDO Alliance. (2026, abril). Agent Payments Protocol donation announcement. https://fidoalliance.org
Google. (2025, septiembre). Agent Payments Protocol launch. https://developers.google.com
Grand View Research. (2026). Agentic commerce market size report. https://www.grandviewresearch.com
Mastercard. (2025). Agent Pay announcement. https://www.mastercard.com
Norton Rose Fulbright. (2026). PSD3 and PSR: From provisional agreement to 2026 readiness. https://www.nortonrosefulbright.com
People’s Bank of China. (2026). Digital yuan operational framework. http://www.pbc.gov.cn
Visa. (2025, abril). Intelligent Commerce announcement. https://www.visa.com
