Between 15 and 20 October 2026, a broker, a consumer bank, a card network and a payments group each set out how AI agents may touch money. None of them gives an agent the customer's own login. They give it a limited channel instead: a separate balance, a spending limit, or a credential tied to one payment.

What Each Company Said

OnePay: a separate pocket with caps

OnePay's chief technology officer, Moe Matar, wrote on 19 October: "We had a choice to make: block personal agents from accessing their customers’ accounts, or build a controlled way to safely help customers. We chose the latter." The rules he describes:

  • When first connected, the agent "can only see your OnePay accounts. It can’t take any action."
  • "Your agent will be able to spend only from its own balance and never from your main account, with per-purchase limits and monthly caps that you set."
  • Each purchase uses "an agentic single-use payment credential that expires immediately after the transaction".
  • Turning an agent off is "just a toggle in the app", and "you can revoke any one agent without affecting the others."

The feature is offered to eligible customers.

Mastercard: a budget and signed vouchers

On 20 October Mastercard opened early access to Agent Pay for Machines, which builds on the x402 payment protocol. "A business gives an agent a job and a spending limit." When a paid service asks for payment, "The agent creates a digitally signed payment voucher, which is a secure promise to pay within its approved limit." Providers "can combine vouchers and redeem them later." Mastercard's own summary: "Payments aren't the hard part. Authority is." It names pilots with Cloudflare, Ant International, AIsa, Base, BVNK, Coinbase and Hype.

Visa, BILL and Billtrust: a registered agent pays one invoice

The same day, the three companies announced a live pilot in which BILL's payment agent, "registered using Visa’s Trusted Agent Protocol and Agentic Directory", pays supplier invoices through Billtrust. The pilot lists "Tokenized payment credentials rather than shared supplier-portal logins" and "A purpose-built payment path tied to the specific invoice". The release says this agent authentication can satisfy the site protections historically provided by CAPTCHA "without requiring an additional agent login."

What It Means For Companies Running Agents

The three announcements describe the same boundary from different sides. An agent that signs in as the customer is designed out. An agent that is identified as an agent gets a narrow channel: read-only by default, its own balance, a limit per purchase or per task, a credential that works once, and a way to switch it off on its own.

A company whose agents buy services, pay suppliers or act for customers at a bank can plan for that boundary now: register agents where a counterparty offers it, keep spending in a separate balance with hard caps, and avoid any flow that depends on a customer's password or on getting past bot checks.

What This Does Not Settle

  • These are company policies and pilots, not rules. No regulator is cited in them.
  • Mastercard's early access and the Visa pilot give no general availability dates.
  • None of the three says who carries the loss if an agent pays the wrong party.

Related: The agent payments spend policy playbook sets out caps, approvals and credentials for agent spending, and the agent identity playbook covers registering agents as agents. See also our notes on EMVCo and agentic payment intent.