How agentic payments present risk

“There’s no clear legal rule for who bears the loss when an AI tool exceeds its mandate,” writes Aaron Cheiffetz, an analyst and executive strategist in the financial services industry, working with banking leaders on artificial intelligence governance, enterprise architecture, regulatory compliance and operational resiliency.
In the debit-card context, Regulation E generally limits a consumer’s liability for unauthorized transfers involving a lost or stolen debit card to $50 if the loss is reported within two business days. But Regulation E excludes from its definition of an “unauthorized electronic fund transfer” a transfer initiated by a person to whom the consumer furnished the access device, unless the consumer has notified the financial institution that transfers by that person are no longer authorized.