Agentic Payments Security for Banks and Fintechs

By the Guardian team Updated November 2026 6 min read

Quick answer. Treat the agent as a potential attacker: register its keys and require a signed, scoped mandate per payment, checked in deterministic code. Enforce payee, amount and time limits, atomic replay checks, human approval above thresholds, and mandate-linked logs.

Watch: Agentic Payments Security for Banks and Fintechs 1:46

Video transcript

AI agents are starting to pay on their own. For banks and fintechs, that is a new payer that can be talked into things.

Google's AP2 spec assumes prompt injection cannot be prevented, so every model and agent must be considered a potential attacker.

The threats include manipulated intent, mandate reuse, double spend, double delivery, fake agents and deepfaked approvals. Signatures alone do not fix manipulated intent.

Double delivery is measured. One study got two deliveries for one payment in 6 percent of test rounds against Coinbase's facilitator on Base.

Six controls follow. Know the agent, and bind each payment to a signed mandate checked in deterministic code. Limit the blast radius, stop replay, escalate to a human, and keep the evidence.

Stablecoin rails differ from cards. x402's exact scheme defines no refund, and in one study, all 15 facilitators tested violated at least one security rule.

Four DORA pillars map to agent payment evidence. Under NYDFS Part 500, inventory every agent that can pay, and confirm how each applies with counsel.

Then pilot narrowly. Start with one use case and a small budget, keep a human present, threat model the path, pentest before launch, and reconcile daily.

Guardian's Digital Asset Assurance Pilot covers threat modeling, standards alignment and offchain pentests, with five million dollars committed to fund pilots. Read the full article, or talk to Guardian.

AI agents are starting to pay on their own: for API calls, tools and purchases made while the customer is away.

For a bank or fintech, that is a new kind of payer. It acts for a customer, runs on a language model and can be talked into things.

The AP2 specification assumes that preventing prompt injection is "infeasible", so "all LLMs and Agents MUST be considered potential attackers".

This article explains the technical and security side of DORA and the NYDFS Cybersecurity Regulation for agent payments. It is not legal advice; confirm how it applies to you with counsel.

The New Payer

Several standards define how an agent proves it may pay. Each secures something different.

Standard	Published by	What it secures
AP2 v0.2	Google; donated to the FIDO Alliance in April 2026	Signed mandates binding a payment to a checkout
ACP (beta)	OpenAI and Stripe	Agent checkout, passing secure payment tokens
Trusted Agent Protocol	Visa	Agent identity, signed per request to one merchant
MPP	Tempo and Stripe	HTTP 402 payments in cards and stablecoins
x402 v2	x402 Foundation (Coinbase, Cloudflare and Stripe on its steering committee)	HTTP 402 payments settled onchain by a facilitator
ERC-8004 (draft)	The Ethereum ERC process	Onchain agent identity and reputation registries

In August 2026, Jiang et al. formally analyzed x402, MPP, ACP and AP2. They reported 40 previously undocumented formal-consistency findings across 86 verification cases.

Their conclusion is a useful frame: delegated authorization must stay consistent with the payment and service it produces.

The Threats

Manipulated intent. Prompt injection through tools, messages or web pages steers the agent's purchase.
Mandate reuse. A stolen, signed authorization is attached to an unrelated checkout.
Double spend. One standing authorization approves several checkouts.
Double delivery. One stablecoin payment unlocks a service twice.
Fake agents. Sybil agents inflate their reputation in open registries.
Deepfaked approvals. The person approving a risky payment is socially engineered.

Signatures do not fix the first one. Aviv et al.'s study of AP2 v0.2 found that "valid mandate signatures alone do not ensure that an agent-mediated transaction reflects the user's intent when its pre-authorization context is manipulated".

That context includes A2A messages and MCP tool calls. Our MCP pentesting checklist covers testing them.

Double delivery is measured. Ling et al. got two deliveries for one payment in 6% of test rounds against Coinbase's CDP facilitator on Base. Our x402 facilitator checklist covers the fix.

NYDFS calls AI-enabled social engineering "one of the most significant threats to the financial services sector".

A Control Framework

AP2's design makes a good template for any rail. Six controls follow.

1. Know the agent

Register every agent, its operator and its keys before it can pay.
Verify a signature on each request. Visa's carries a timestamp, session ID and key ID.
Treat registry reputation as a signal. ERC-8004 warns that "Sybil attacks are possible".

2. Bind every payment to a mandate

Get consent on a trusted surface, not through the agent. AP2 requires it to be non-agentic.
Verify mandates in code, never in a model. AP2 says validation "MUST happen in deterministic code".
Bind the payment to the checkout by hash, and the mandate to the agent's key.
Release payment credentials only against a final, verified Payment Mandate.

3. Limit the blast radius

AP2's open mandates carry constraints: allowed payees and instruments, an amount range, a total budget, recurrence rules and an execution window.

Set the shortest expiry that lets the agent finish, as AP2 recommends.
Fail closed on unknown constraints, as AP2 requires.
Onchain, give the agent a capped delegation, not a treasury key.

4. Stop replay and double spend

Reject overlapping mandates drawn on one authorization. AP2 lets credential providers and networks do this.
Claim each payment ID atomically before you credit or deliver.

5. Escalate to a human

Require human-present approval above a value or risk threshold.
Resist deepfakes. NYDFS suggests digital certificates and physical security keys instead of SMS, voice or video.

6. Keep the evidence

AP2's signed mandates and receipts give "a non-repudiable picture of the transaction" in a dispute. The spec leaves retention out of scope, so set your own.

Stablecoin Rails

x402 and MPP both carry agent payments over HTTP 402, stablecoins included. Those rails differ from cards.

No protocol refund. If a paid request fails after settlement, x402's exact scheme "defines no refund".
Finality is a choice. On Base, a block takes about 2 seconds; L1 finality about 20 minutes.
A facilitator sits in the middle. It verifies and settles, and holds no funds.
Screening varies. Coinbase's hosted facilitator runs OFAC and KYT checks. Self-host, and it is yours.

Facilitators are young software. In July 2026, Wang et al. tested 15, and every one violated at least one security rule.

Pin each payee's receiving address, pick a finality stage per payment size, and reconcile served requests against settled payments. For issuers, see stablecoin security.

Evidence for Regulators

DORA

DORA, Regulation (EU) 2022/2554, has applied since January 17, 2025. Four of its pillars map to agent payments.

DORA pillar	Evidence for an agent payment program
ICT risk management	Agent inventory, threat model, mandate and limit policies
Major incident reporting	Logs that rebuild a payment from mandate to settlement
Resilience testing	Pentests of agents, mandate verifiers and payment APIs
ICT third-party risk	Due diligence on agent platforms, facilitators and wallet vendors

Ask counsel which agent platforms and facilitators count as your ICT third-party service providers.

NYDFS Part 500

The NYDFS letter on AI of October 16, 2024 "does not impose any new requirements". It explains how Part 500 applies to AI.

Risk assessments should cover your own AI, vendors' AI and weaknesses in AI applications.
MFA covers all Authorized Users as of November 2025.
Firms should inventory systems that use or rely on AI.

A September 10, 2026 letter adds that the asset inventory "should serve as the foundational input to the Risk Assessment", which must inform control selection.

Put every agent that can pay in that inventory, and trace each control to a risk. Our NYDFS risk assessment template shows the rows.

A Pilot Approach

Start narrow. One use case, one rail, one payee list and a small budget.
Human present first. Go autonomous only once constraints hold in testing.
Threat model the path. Agent, tools, trusted surface, verifier, facilitator and keys.
Test before launch. Pentest agent-facing APIs, MCP servers and signing services.
Reconcile daily. Every payment against a mandate, every delivery against a settlement.
Build the evidence pack as you go. Mandates, receipts, test reports and runbooks.

How Guardian Helps

Guardian's Digital Asset Assurance Pilot is built for regulated digital asset programs. You choose from five self-contained modules.

The architecture assessment maps "every route value can take" and writes a threat model against your design. Standards alignment reads MiCA, DORA, VARA and GENIUS "as demands on the design".

Offchain pentests cover "the consoles, APIs and signing services that can reach your keys".

Guardian is committing $5,000,000 to fund pilots for programs selected for their impact on digital asset adoption.

For fintechs, Guardian also builds a trust center: one page bank partners and auditors can read instead of emailing you.

Frequently Asked Questions

What is agentic payment security?

It is the set of controls that make sure an agent's payment is one the customer authorized. That means verified identity, scoped mandates, limits, replay protection, human approval for risky payments and dispute evidence.

Does AP2 stop prompt injection?

No. AP2 assumes prompt injection cannot be prevented and treats every agent as a potential attacker. Its mandates bound what a manipulated agent can do, but manipulated inputs before signing can still distort a purchase.

How do AP2 and x402 differ?

AP2 is a payment-agnostic authorization layer: signed mandates proving what the user approved. By contrast, x402 is a payment method: a facilitator verifies a signed payment, usually in stablecoins, and settles it onchain.

Do DORA or NYDFS have rules for AI agent payments?

NYDFS's 2024 AI letter adds no new requirements; it explains how existing Part 500 duties apply to AI. DORA's ICT risk, testing and third-party rules are where agent controls would be evidenced. Confirm how each applies with counsel.

Sources

Pressure test your agent payment program

Guardian's assurance pilot threat models your design, maps it to DORA and NYDFS Part 500, and pentests the systems that can reach your keys.

Talk to Guardian Explore the assurance pilot