Something significant is taking shape across the region’s payment systems.
An AI agent can now hold a card, be authorised by a customer and complete a purchase on that customer’s behalf. Mastercard has deployed Agent Pay in the UAE. Adyen has cited agentic AI as part of the rationale behind its Central Bank of the UAE licence. In India, agent-led payments are being built onto UPI; in Nigeria, AI checkout has arrived on home-grown rails. This is no longer a concept being discussed at conferences. It is live, and it is scaling.
It is also, for anyone who has spent time inside a regulated institution, a familiar kind of moment. A capability arrives before the framework that governs it. The technology works. The question of who is answerable when it does not, has not yet been settled.
That question is worth sitting with, because it is the one that will shape how far and how fast agentic payments are allowed to go.
THE UNDERLYING QUESTION
When a person makes a payment, the lines of responsibility are well understood. The customer authorises it. The bank processes it. The merchant accepts it. Decades of regulation, dispute resolution and consumer protection sit behind each of those roles, and everyone knows where they stand.
An AI agent making a payment does not remove any of those parties – but it does replace the customer at a critical decision point. Instead of the customer authorising the transaction, an agent does: it interprets an instruction, makes a judgement about how to fulfil it, and acts. The customer, the bank and the merchant are all still present. What has changed is who – or what – sits at the point of authorisation. And that raises a question the existing framework does not clearly answer: if an agent initiates a payment the customer did not intend, or fulfils an instruction in a way the customer did not foresee – who carries the risk?
Is it the bank that holds the account? The platform that deployed the agent? The merchant that accepts the transaction? The customer who set the agent in motion? Each has a defensible claim to say the responsibility lies elsewhere. That ambiguity is manageable when volumes are small. It becomes a material issue the moment these systems scale to handle meaningful volume – which is precisely the direction of travel.
THE REGULATOR IS ANTICIPATING
It is tempting to treat this as a question that can be resolved later, once the technology has matured. Experience suggests the opposite.
Regulators across the region have shown they will engage with new payment models early, and on their own terms. The UAE has built an open finance framework that already includes signals identifying when a third-party, rather than a human, has initiated a transaction. That is a meaningful detail.
It tells you the regulator is not waiting to see how the market settles – it is building the question of accountability into the infrastructure from the start.
For firms, this changes the order of things. The instinct in a fast-moving space is to launch, gain traction, and address governance once the product has proven itself. In agentic payments, that sequence is likely to be reversed. The institutions that scale will be the ones that can already answer, clearly and credibly, how responsibility is assigned when an agent acts – because that is what will be asked of them by the regulator, before they are permitted to grow.
GOVERNANCE AS THE ENABLER
This is where the framing matters, and where the opportunity sits.
It is easy to view the question of accountability as a constraint – a hurdle between an innovation and its market. In practice, the opposite will be true. In a new payment model where trust has not yet been established, the firm that can demonstrate control is the one that will earn permission to move.
A customer deciding whether to let an agent transact on their behalf is making a judgement about trust. A merchant deciding whether to accept agent-initiated payments is making the same judgement. And a regulator deciding whether to allow a model to scale is making it too. In each case, the deciding factor is not the sophistication of the technology. It is whether responsibility is clear, accountability is owned and whether a framework has been designed to respond when a transaction goes wrong.
Control, built in early, is what will allow an organisation to accelerate with confidence. It is the same principle that has always held in regulated finance: the firms that embed governance into how a product works, rather than adding it once the product is live, are the ones that move at pace when it matters, because they are not pausing to retrofit trust they never built.
GOVERNANCE BUILT IN PARALLEL
For a firm developing or adopting agentic payments, a few questions are worth answering while the product is being built.
Where does the agent’s authority begin and end? An agent acts on an instruction. What defines the boundary of that instruction before human intervention is required, and what happens when the agent encounters something outside the defined criteria?
Where does responsibility sit at each step? Not in principle, but in practice – mapped across the customer, the platform, the bank and the merchant so that when an issue is encountered, the response already exists.
How is an agent-initiated transaction identified and treated? The firm should be able to demonstrate to the regulator the additional controls that apply.
What happens when a transaction fails? The measure of a governance framework is not how it performs when everything works. It is whether there is a clear escalation path to address the process breaks. None of this requires slowing the innovation down. It requires building the control architecture alongside it, so the two grow together.
THE OPPORTUNITY
Agentic payments are one of the most genuinely promising shifts in how money moves. The markets leading it — the UAE, the wider GCC, India and Africa — are not waiting to adopt it. They are shaping how it works, with regulators engaged from the start.
That is precisely why the question of accountability is not a reason for caution. It is the opening. The firms that can answer who owns the risk before they are asked will be the ones trusted to lead as this scales.
The technology is ready. The opportunity belongs to those who develop the trust to match it.
At Blaze Meridian, we help technology and financial-services firms build governance that enables growth: across the GCC, India and Africa.
Also Read: Lessons from Three Decades Inside Supervised Institutions
If Article you liked: Share Us:
FAQs:
What are agentic payments?
Payments where an AI agent, authorised by a customer, initiates or completes a transaction on that customer’s behalf – rather than the customer doing so directly.
Who is responsible if an AI agent makes a payment a customer did not intend?
This is the central open question. An AI agent does not simply add a new actor – it replaces the customer at a critical decision point. The customer, the bank and the merchant are all still present, but what has changed is who – or what – sits at the point of authorisation. Existing frameworks do not yet clearly assign responsibility for that. Resolving it before scaling is what firms and regulators are working through.
Why should firms address this before launching, not after?
Regulators in the region are engaging early – the UAE has built an open finance framework that includes signals identifying when a third-party, rather than a human, has initiated a transaction. The firms permitted to scale will be those that can demonstrate how accountability is assigned, so governance built in parallel becomes a condition of growth, not an afterthought.
Does strong governance slow innovation down?
No, quite the opposite. In a model where trust is not yet established, demonstrable control is what earns permission to move. Governance built in early allows a firm to accelerate with confidence.
Can the transaction be evidenced?
An agent-initiated payment must be as auditable as a human-initiated one – who authorised the agent, the instructions it was given, what it did and when. The absence of a documented audit trail will create regulatory exposure.