Agentic Commerce Hits a Trust Wall, Not a Technology One

An AI agent can now find a product, compare prices, and finish a checkout without a human touching the screen. What it still cannot do reliably is convince everyone else in the transaction that it was allowed to. That gap was the subject of a Federal Reserve governor's speech at Sibos 2026 in Miami on 29 September, and it is the clearest map of agentic commerce anyone has published this month.

Governor Christopher Waller used the address to describe agentic commerce as "in an early phase" that "could significantly reshape commerce and payments if adoption scales," according to the prepared remarks released by the Federal Reserve. The Bank for International Settlements published the same text in its central bankers' speech archive. He then spent the rest of the speech on the unglamorous part: authentication, liability, and fraud. The capability of the models, in his account, is not the bottleneck.

Two models, two different kinds of risk

Waller split the field in two. In the agent-assisted model, a buyer uses an AI agent for search and discovery but keeps control of decisions and payment. In the agent-delegated model, the buyer hands the agent authority to shop and pay within constraints, such as a pre-funded virtual card loaded with instructions to buy groceries from past purchases.

The distinction matters because the risk profiles are not close. "Because it introduces higher risks of unintended purchases, the delegated model requires a more extensive buildout of trust mechanisms and guardrails," Waller said. He expects consumer-to-business transactions to arrive first, with assisted use cases preceding delegated ones, and he said business-to-business purchases may be especially well suited to agents because they are recurring and follow rules like approved suppliers and budget limits. Higher ticket sizes in B2B cut both ways: they make agents more useful and agent errors more expensive.

The three blockers, in plain language

Authentication is the first. Waller framed the shift precisely: "The question shifts from proving that a buyer is an authorized payer to proving that an agent has the authority to pay on the buyer's behalf." That is a different problem from cardholder verification, and it needs new approaches rather than a reused one.

Liability is the second, and he reduced it to a single question: "Who is on the hook if an agent makes the wrong purchase?" Existing frameworks, including network rules and consumer protection standards, could be adapted, he said, but technical standards that record what a buyer intended and how the agent carried it out might reduce the ambiguity that already makes transaction disputes painful.

Fraud is the third. "Existing fraud detection and prevention systems, calibrated to human behavior, may not translate well to agents," he said, which means fraud models and rules will need recalibration around agent payment patterns. He also flagged an asymmetry that should worry operators more than model releases: an attacker needs one vulnerability, while the defenders have to cover the whole surface.

None of this is theoretical for the card networks. Visa launched a program called Agentic Ready in Latin America and the Caribbean on 29 April 2026, aimed at helping issuers test agent-initiated payments with live cards and real merchants. In a statement announcing the program, Visa said dozens of issuers had already enrolled. It also published regional numbers that make the case for its own trust layer: Visa tokens have cut fraud by 70 percent and boosted authorizations by 9 percent there, and 50 percent of e-commerce in the region is already tokenized, with the company working toward 100 percent.

"As AI agents increasingly shape how people shop and buy, payments need to keep up," said Catalina Tobar, Visa's head of growth products and partnerships for the region, in the release. She described the program as helping issuers prepare for "secure, scalable agent-initiated payments, built on infrastructure people already trust." Visa's pitch is that an agent payment should stay tied to a real person, with consent and control at each step. That is a commercial answer to Waller's liability question, and it arrives before any regulator has settled it.

The conversation layer is moving too. On 20 October, Sierra and Stripe announced that customers can pay inside an AI agent call, with healthcare payments company Cedar reporting that 71.3 percent of the payment calls its Kora agent begins end in a successful payment, as GenZ NewZ reported. The transaction can already complete. The authority record around it is what is still being written.

The structural fight underneath

The quieter argument in the speech is about market structure. Waller asked whether agentic commerce drifts toward platform-specific standards built around one ecosystem, or interoperable standards that work across shopping agents, merchants, and payment methods. He connected that to the difference between open systems, where a retailer allows a range of shopping agents, and closed systems, where a retailer requires its own. "At this early stage, it is not clear which model will have the edge in shaping agentic commerce, but whichever gains traction could significantly influence how the market structure evolves," he said.

For a small merchant, the difference is not abstract. An interoperable standard is a way to be discoverable by every agent; a closed system is a way to be represented by exactly one, chosen by someone larger. Waller also noted that agents will make micropayments along the way for model queries, price feeds, and other data calls, and that those favor rails with low flat fees. That is an argument about infrastructure that sits well below the shopping interface everyone is arguing about.

What to watch

The unanswered questions he listed are the practical ones. Which standards are still missing for agents to carry identity, consent, and payment credentials across the full stack? And what is the right balance between convenience and "purposeful friction" in agent authorization? The order in which those get answered will decide whether delegated agents become ordinary, or stay a demo.

The short version: the trust layer, not the model, sets the timeline. Anyone building for agentic commerce who is still optimizing the shopping experience and not the authority record is working on the easy half.