L
LaFinteca
Guest
When an AI agent pays on someone’s behalf, responsibility should follow the mandate that person agreed in advance, says Dmytro Rukin, CEO of LaFinteca. The user answers for the limits they set, the agent provider for keeping the agent inside them, and the merchant and payment provider for the checks only they can run.
The payment already works. On 25 March 2026 a global card network announced live agentic payments across Latin America and the Caribbean with 17 financial institutions, all authorised with cardholder consent, according to its own release. The open question is who answers for a payment no human pressed. The FCA raised it in its Payments Regulatory Priorities report of 25 March 2026, and HM Treasury’s consultation of 14 July 2026 asks whether consent and liability rules should adapt.
Rukin’s answer is permission agreed before the agent acts, written as four limits. An amount cap, a named set of merchants, a time window after which the permission lapses, and a cancel option the user can reach in seconds. His test is simple. A stranger reading the permission should be able to say, without guessing, whether a given payment fell inside it.
Banco Central do Brasil launched Pix Automático on 16 June 2025. The payer authorises a company once in their banking app, can set a maximum amount and can cancel at any time. Payments then run without authentication each time, according to the central bank. It was built for monthly bills, and it already shows the shape an agent mandate could take.
Variable recurring payments follow the same logic. A customer gives a provider a mandate with limits agreed in advance and can view, amend or cancel it whenever they like. The commercial scheme went live on 2 June 2026, and according to the FCA, VRPs made up around 16% of open banking payments as of June 2026.
Dmytro Rukin runs LaFinteca, a company that moves business payments between Latin America and Europe. His position, offered from the payments side as a starting point for lawyers and regulators, is that the loss sits with whoever was best placed to stop the mistake. The user carries it when the agent stayed inside the mandate. The agent provider carries it when the agent stepped outside it. The merchant carries it when it ignored a visible limit on a payment flagged as agent-initiated, and the payment provider when a payment above the cap still cleared.
Agentic commerce is reaching UK checkouts before the rulebook is finished, so Rukin suggests four steps for this quarter. Store each mandate as plain fields the customer can read back. Keep a timestamped log of what the agent was allowed to do and why it bought what it bought. Make refunds a two-tap job. And carry the agent-initiated flag that card networks already send in authorisation data through your order and refund records.
Rukin’s stance is that trust in payments has always rested on consent and limits. AI agent payments need the same rules, agreed by a person before the money moves.
What are agentic payments?
Payments an AI agent starts and completes for a person or business, within permissions that person agreed beforehand.
Do UK rules already cover AI agent payments?
Partly. In 2026 the FCA and HM Treasury both opened work on whether consent and liability rules need to change for agents.
Who pays if an AI agent buys the wrong thing?
In Rukin’s view, whoever was best placed to prevent it, from the user inside the mandate to the agent provider outside it.
Dmytro Rukin is the CEO of LaFinteca, a payment infrastructure company operating across Latin America (Brazil, Mexico, Chile, Peru, Colombia) and Europe.
The payment already works. On 25 March 2026 a global card network announced live agentic payments across Latin America and the Caribbean with 17 financial institutions, all authorised with cardholder consent, according to its own release. The open question is who answers for a payment no human pressed. The FCA raised it in its Payments Regulatory Priorities report of 25 March 2026, and HM Treasury’s consultation of 14 July 2026 asks whether consent and liability rules should adapt.
What counts as consent when a machine pays?
Rukin’s answer is permission agreed before the agent acts, written as four limits. An amount cap, a named set of merchants, a time window after which the permission lapses, and a cancel option the user can reach in seconds. His test is simple. A stranger reading the permission should be able to say, without guessing, whether a given payment fell inside it.
How does Brazil’s Pix Automático handle it?
Banco Central do Brasil launched Pix Automático on 16 June 2025. The payer authorises a company once in their banking app, can set a maximum amount and can cancel at any time. Payments then run without authentication each time, according to the central bank. It was built for monthly bills, and it already shows the shape an agent mandate could take.
What does the UK already have that works the same way?
Variable recurring payments follow the same logic. A customer gives a provider a mandate with limits agreed in advance and can view, amend or cancel it whenever they like. The commercial scheme went live on 2 June 2026, and according to the FCA, VRPs made up around 16% of open banking payments as of June 2026.
Who carries the loss when the agent gets it wrong?
Dmytro Rukin runs LaFinteca, a company that moves business payments between Latin America and Europe. His position, offered from the payments side as a starting point for lawyers and regulators, is that the loss sits with whoever was best placed to stop the mistake. The user carries it when the agent stayed inside the mandate. The agent provider carries it when the agent stepped outside it. The merchant carries it when it ignored a visible limit on a payment flagged as agent-initiated, and the payment provider when a payment above the cap still cleared.
What should merchants and payment teams set up now?
Agentic commerce is reaching UK checkouts before the rulebook is finished, so Rukin suggests four steps for this quarter. Store each mandate as plain fields the customer can read back. Keep a timestamped log of what the agent was allowed to do and why it bought what it bought. Make refunds a two-tap job. And carry the agent-initiated flag that card networks already send in authorisation data through your order and refund records.
Rukin’s stance is that trust in payments has always rested on consent and limits. AI agent payments need the same rules, agreed by a person before the money moves.
FAQ
What are agentic payments?
Payments an AI agent starts and completes for a person or business, within permissions that person agreed beforehand.
Do UK rules already cover AI agent payments?
Partly. In 2026 the FCA and HM Treasury both opened work on whether consent and liability rules need to change for agents.
Who pays if an AI agent buys the wrong thing?
In Rukin’s view, whoever was best placed to prevent it, from the user inside the mandate to the agent provider outside it.
Dmytro Rukin is the CEO of LaFinteca, a payment infrastructure company operating across Latin America (Brazil, Mexico, Chile, Peru, Colombia) and Europe.