Agentic AI in Banking: What Happens When AI Starts Making Payments?

Introduction

Artificial Intelligence in banking is moving from systems that predict and recommend to systems that can plan and act. This next stage, known as Agentic AI, allows AI agents to interpret objectives, perform multiple steps, interact with digital services and take actions with limited human intervention.

This creates an important question for financial institutions: What happens when AI does not just recommend a payment, but actually makes it? The International Monetary Fund (IMF) describes this transition as a potential move from "click-to-pay" to "decide-to-pay." Under this model, customers could provide an objective or mandate, while an AI agent determines and initiates eligible transactions.

The challenge is not simply enabling autonomous payments. It is ensuring that autonomy operates within clearly defined boundaries of authorization, security, compliance, accountability and auditability.

From AI-Assisted to AI-Acting Banking

Traditional banking AI supports activities such as fraud detection, credit scoring, customer service and risk analysis. Agentic AI introduces autonomous action, allowing systems to move beyond providing information or recommendations and perform tasks based on predefined objectives and permissions.

For example, instead of asking "When is my electricity bill due?", a customer could instruct an AI agent: "Pay my electricity bills automatically, provided each payment is below Rs. 10,000." The agent could identify the bill, verify the merchant, check the customer's mandate, perform risk checks, initiate the payment and record the outcome.

Research on banking operations also highlights the use of multi-agent architectures, where specialized agents can support credit assessment, fraud detection, compliance and customer-service activities. The key difference is simple: Traditional AI assists, while Agentic AI can act. This makes the AI agent itself a new object of governance.

A Three-Layer Model for Safer Agentic Payments

The IMF research proposes a three-layer approach for understanding and governing agentic payments.

The first layer is Intent and Orchestration - the AI layer where the agent interprets objectives, plans actions and interacts with external systems. Technologies involved may include Large Language Models (LLMs), APIs and tool calling, retrieval systems, multi-agent frameworks, Model Context Protocol (MCP), and Agent-to-Agent (A2A) communication.

The IMF identifies MCP and A2A as emerging technologies supporting agent interaction with tools, data and other agents. However, LLMs are probabilistic and can produce inconsistent or incorrect outputs. Therefore, AI reasoning should not automatically become payment authorization. The agent can determine what it believes should happen, but another controlled layer should determine whether that action is actually permitted.

The second layer is Control and Authorization - the critical GRC layer. The proposed transaction should be evaluated against deterministic controls such as transaction limits, approved counterparties, geographic restrictions, transaction frequency, sanctions screening, fraud controls and human-approval thresholds. For example, a transaction where the amount is less than or equal to Rs. 25,000, the merchant is approved and all compliance checks have passed could proceed automatically. However, a transaction above Rs. 25,000 could require human approval.

The IMF research emphasizes mandate-based authorization, where agent actions are restricted by defined scope, identity and transaction limits. This ensures that an AI agent cannot independently expand its authority beyond the permissions provided to it.

The third layer is Settlement - the actual payment infrastructure. This may include payment processors, card networks, instant-payment systems or other settlement mechanisms. The fundamental principle is to keep probabilistic AI separated from deterministic payment controls. AI can interpret and orchestrate, the authorization layer determines whether the transaction is permitted, and the payment infrastructure executes the authorized transaction.

Risks

Authorization and Model Risk

AI agents may misinterpret ambiguous instructions or generate incorrect outputs. In a normal chatbot, this may result in a poor answer. In an autonomous payment system, the same error could result in financial loss. Banks therefore need bounded autonomy, supported by clearly defined permissions, transaction limits and conditions. The agent should operate only within the authority explicitly granted to it.

Explainability and Auditability

With agentic payments, traditional transaction logs may not be enough. A bank may need to determine which agent acted, which model and version were used, what data was accessed, which tools were invoked, which policies were evaluated, why the transaction was approved and whether human approval was required.

A useful execution trail can therefore follow the sequence: Customer Intent → Agent → Data → Tools → Policy Checks → Authorization → Payment → Settlement. Research on agentic financial-crime compliance emphasizes traceability, explainability and compliance-by-design as important requirements. From a GRC perspective, if a decision cannot be reconstructed, it cannot be effectively audited.

Financial Crime Risk

Agentic AI could improve financial crime compliance by supporting activities such as KYC and onboarding, transaction monitoring, alert investigation, suspicious activity analysis, case prioritization and regulatory reporting. By processing information and coordinating multiple tasks, AI agents could help compliance teams respond more efficiently.

However, a compliance agent must itself be governed. It requires defined policies, audit logs, escalation mechanisms, human review and continuous monitoring. AI should strengthen compliance rather than become an uncontrolled compliance decision-maker.

Data Privacy and Cybersecurity

Payment agents may require access to financial information and external services. This introduces risks such as excessive permissions, data leakage, compromised credentials and unauthorized tool access. The IMF research highlights data-security and privacy concerns arising from autonomous agents interacting with AI systems, cloud services and financial infrastructure.

The GRC principle should therefore be giving an agent only the access required for its approved purpose. This applies the least-privilege principle to AI agents and ensures that an agent cannot access information or systems beyond what is necessary for its designated function.

Human-in-the-Loop

Autonomous does not mean unsupervised. A risk-based approach can determine the level of authority granted to an AI agent depending on the potential impact of its actions.

Research on banking agentic AI recommends human review for high-value transactions, uncertain decisions and significant model or system changes. The objective should therefore be appropriate automation, not maximum automation. Human oversight remains particularly important when an action could result in significant financial, regulatory, operational or reputational consequences.

What Organizations Should Do

Before scaling Agentic AI, organizations should establish a strong governance foundation.

The first step is to create an AI Agent Inventory that records each agent's identity, purpose, owner, model and version, permissions and risk classification. This provides organizations with visibility into which AI agents exist and what authority they have.

Organizations should also define clear mandates that specify exactly what each agent can and cannot do. These mandates should include transaction limits, approved counterparties, permitted systems, data-access boundaries and conditions requiring human intervention.

Another important measure is Policy-as-Code, where critical governance and compliance controls are converted into deterministic rules. For example, a system could automatically deny a transaction when the amount exceeds the mandate limit, escalate a transaction when the counterparty is not approved, block a transaction when sanctions screening fails, or require human approval when the risk level is high.

Organizations should also continuously monitor agent behaviour. Monitoring should cover transaction volume, transaction value, policy violations, escalation rates, unusual access patterns and potential model drift. Continuous monitoring can help identify abnormal behaviour before it results in significant consequences.

Finally, high-impact agents should have a kill switch or emergency suspension mechanism. If an agent behaves unexpectedly or its credentials are compromised, the organization should be able to immediately suspend its activities, revoke relevant credentials and preserve evidence for investigation.

Conclusion

Agentic AI could fundamentally change banking by allowing AI systems to move from assisting financial decisions to executing financial actions. However, autonomous payments require a different approach to governance.

The most sustainable model is neither "AI controls everything" nor "humans approve everything." Instead, the appropriate approach is a balanced model that combines AI, deterministic controls, human oversight, and continuous monitoring to ensure efficiency, accountability, and effective risk management.

The IMF's three-layer model provides a useful foundation by separating AI-driven intent and orchestration from authorization and settlement. This separation allows organizations to benefit from AI's ability to interpret objectives and coordinate activities while ensuring that financial transactions remain subject to deterministic controls.

For GRC professionals, this means expanding traditional governance to include AI identity, agent permissions, model risk, policy enforcement, execution traceability, human escalation and continuous behavioural monitoring.

Ultimately, the question is not simply "Can AI make payments?" - it increasingly can. The real question is: "Can AI make payments in a way that is authorized, secure, compliant, explainable, auditable and accountable?"

That is the foundation for trustworthy Agentic AI in banking.

Connect with QuassrCyberTech Experts

Ready to strengthen your organization's security posture?

At QuassrCyberTech, our specialized cybersecurity solutions help organizations stay ahead of evolving risks. From Vulnerability Assessment and Penetration Testing (VAPT) to Security Operations Center (SOC) implementation, Red Team exercises, and Governance, Risk, and Compliance (GRC) frameworks, we provide the expertise and tools needed to secure your digital assets and infrastructure.

Contact us today to develop a customized security strategy for your organization.

References

- IMF - How Agentic AI Will Reshape Payments

- ResearchGate - Agentic AI in Banking Operations

- ResearchGate - Revolutionizing IT Governance with Artificial Intelligence

- IEEE - Agentic AI: Autonomous Intelligence for Complex Goals - A Comprehensive Survey

- ResearchGate - Agentic AI in Financial Crime Compliance