When AI Agents Make Payments, Who Holds the Authority?
By Alexandre Kech, CEO at GLEIF
AI agents can discover services, negotiate terms, analyze data, and initiate transactions for people and organizations. In financial services, this creates a governance challenge: how can other parties determine which organization stands behind an agent, who authorized it, and whether an action falls within that authority?
As GLEIF’s most recent working paper on agentic payments observes, existing legal frameworks can generally allocate responsibility. The immediate challenge is operational. Payment providers, counter-parties, and auditors need evidence when a transaction occurs. Login credentials may show that a system is active, but they do not prove that it represents a verified legal entity or may make a specific payment.
Identity is only the starting point
The discussion is often framed as Know Your Agent (KYA). A fixed identity is insufficient. AI agents may be short-lived, change configuration, coordinate with other agents, or perform narrowly defined tasks. Each action must therefore be traceable through a chain of authority.
The organization behind the agent must be identified unambiguously. Its mandate must define what it may do, for which counterparties, up to what value, and for how long. Transaction-time controls must assess conditions such as sanctions checks, transaction limits and jurisdictional restrictions. These could, for example, be implemented through a runtime policy engine. The process must also create an auditable record for monitoring and dispute resolution.
GLEIF’s work on verifiable authority
The Global Legal Entity Identifier Foundation (GLEIF) is examining how organizational identity infrastructure can support these requirements. The Legal Entity Identifier (LEI) is a globally standardized code for the clear and unique identification of legal entities. It answers “who is who” and “who owns whom,” with reference data openly available through the Global LEI Index. The verifiable LEI (vLEI) extends verified organizational identity into the digital domain. It enables counterparties to computationally verify the identity, authority, and role of a person acting for a legal entity.
GLEIF’s recent working paper, Agentic AI in Payments: Establishing Interoperable Trust and Control, explores how this model could extend to software agents. It proposes an Agent Mandate Credential (AMC) that could bind an agent’s cryptographic identifier to authority delegated by an authorized person acting for a verified organization. The credential could define permitted actions, transaction limits, counterparties, and validity, while supporting revocation when the mandate changes.
The work draws on workshops and roundtables convened during 2026. Because agentic systems cross boundaries, payment providers and counterparties must interpret mandates consistently within their controls.
This approach separates delegated authority from transaction-time controls. A credential could establish the right to act, while a policy engine decides whether a payment should proceed under current conditions. An agent could then present evidence of its authority without exposing the organization’s underlying account credentials to counterparties.
Payments offer a practical testing ground
Cross-border supplier payments illustrate the need. A treasury officer might authorize an agent to validate invoices, check purchase orders and delivery data, prepare payment instructions, and initiate settlement within defined limits. Before execution, a payment service provider could verify the credential chain, confirm that the mandate remains valid, and test the transaction against compliance and risk rules. Each step could be recorded for review.
The inclusion of the LEI in the Financial Action Task Force’s (FATF) revised Recommendation 16 provides a foundation for this model. For qualifying cross-border payments above the applicable threshold, the revised standard specifies that, where an originator or beneficiary is a legal person, accompanying information should include a connected Business Identifier Code (BIC), an LEI, or a unique official identifier, where one exists. The LEI connects the payment message to a standardized organizational identifier and authoritative reference data. For GLEIF, this provides a foundation on which machine-verifiable authority could subsequently be layered through the vLEI. The revised requirements are expected to take effect by the end of 2030.
GLEIF’s paper sets out pilot concepts for supplier payments and payments for data used in due diligence. These are proposals for industry testing, not finished deployments. They would assess whether delegated authority remains interoperable across payment rails, runtime controls operate independently from credential issuance, and the resulting records meet compliance and audit requirements.
Cross-border interoperability requires open infrastructure
Agentic payments also need privacy controls, data provenance, secure execution, and sustainable verification. Platform-specific identity silos would limit interoperability. An agent should not require a new identity and mandate for every network it encounters.
GLEIF is contributing a framework for discussion rather than prescribing one single architecture. Financial institutions, payment providers, AI developers, policymakers, and standards bodies must test how authority is issued, constrained, verified, monitored, and revoked in real workflows.
AI agents can play a durable role in finance only if their actions remain attributable and reviewable. The LEI identifies the legal entity behind an agent, while the vLEI links identity to verifiable, time-bound authority. Testing will determine whether these mechanisms support accountable automation across payment systems and jurisdictions.
Sources
GLEIF, Agentic AI in Payments: Establishing Interoperable Trust and Control, Working Paper Series, September 2026.
FATF, FATF updates Standards on Recommendation 16 on Payment Transparency, 18 June 2025.
