Your AI Agent Can Move Money. Can You Actually Control It?

Emily Jones · 2026-11-10

AI agents aren't just suggesting financial moves anymore. They're making them. They reconcile invoices, kick off procurement workflows, call APIs, and increasingly push payments through under conditions you set in advance. So the instruction to move money might not come from a person at a screen. It could come from software acting on delegated authority. For payments teams, that's not just a speed boost. It rewrites the whole accountability conversation. Compliance has always leaned hard on identity. Who's the customer? Who's the business? Who ultimately owns or controls it? Those questions still matter. But with agentic payments, identity alone stops being enough. An agent can be perfectly identified and still fire off the wrong transaction, in the wrong context, at the wrong moment. That's why the industry needs to move past "Know Your Agent" and ask something bigger: can you govern your agent? ### Identity Solves the Wrong Problem Knowing who an agent belongs to answers an identity question. Risk comes down to authority. What is the agent allowed to do? Under what conditions? For how long? When does that authority stop? And who stays accountable when it acts? The next version of KYA shouldn't be a machine copy of KYC. It should be a control framework built around delegated authority, one that keeps business intent, agent authority, and financial execution bound together at all times. ### Bind the Agent to an Accountable Principal The first step is still identity, but the goal isn't to give AI its own financial identity. It's the opposite. Any agent that can start a financial action should be tied to a real business principal that's already cleared KYB, risk assessment, and due diligence. The system should be able to show which business account the agent represents, who created and authorized it, which credentials it's using, and whether that authorization is still valid. That link has to be technically verifiable and auditable. Banks don't need to decide whether an AI is inherently trustworthy. They need a clean chain of accountability: - Verified business - Authorized agent - Permitted action - Transaction Only when every link traces back to a real principal and a valid authorization can machine behavior be governed inside a regulated financial environment. ### Define the Mandate, Not Just the Limit Real risk control starts with authority. Old payment systems lean on per-transaction limits, daily caps, account limits, and API permissions. Those static controls aren't enough for agentic payments. An agent shouldn't just get a spending ceiling. It should operate inside a clearly defined business mandate. Take a procurement agent. It might pay suppliers, but only verified counterparties, against valid purchase orders or invoices, from designated accounts, using approved settlement assets and routes, within set amount and time thresholds. A treasury agent might rebalance liquidity across predefined accounts but shouldn't be able to create new beneficiaries on its own. A payroll agent might pay registered employee accounts but shouldn't be able to redirect funds to unrelated third-party addresses. So the real question isn't only "How much can this agent move?" It's also "Under what business context is this agent allowed to act?" Static limits restrict amounts. Context-bound authorization restricts behavior. For agentic payments, that second layer matters more. ### Every Transaction Must Prove Why It Was Allowed The third layer is provability. Traditional payment logs usually tell you who paid, who received the funds, how much moved, when it happened, and what the final status was. Agentic payments need more than that. Each transaction should carry evidence of why it was permitted: which mandate applied, which conditions were met, and which authority was in force at that moment. As one payments executive put it, "Identity tells you who is acting. Governance tells you whether they should be." That's the shift. Not just knowing your agent, but governing it, with controls that hold up long after the agent was first authorized.