The global landscape of digital finance is undergoing a structural bifurcation as the emergence of agentic commerce—AI-driven systems capable of executing transactions on behalf of human users—collides with vastly different regional regulatory environments. While Europe has leveraged the robust architecture of the Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR) to provide a clear, albeit rigorous, roadmap for deployment, the United States remains trapped in a state of legislative inertia. This regulatory divergence has created a distinct commercial reality: European banks and payment processors are rapidly moving to live, production-scale agentic transactions, while their American counterparts are sidelined by a profound ambiguity regarding liability and consumer protection.
The European Regulatory Backbone: A Mandate for Clarity
In Europe, the transition toward agentic commerce is not merely a technological evolution; it is a legally codified shift. By integrating agentic protocols into the PSD3/PSR framework, European regulators have effectively forced the financial sector to move from traditional "Know Your Customer" (KYC) protocols to the more nuanced "Know Your Agent" (KYA) standard. This transition assumes that while the machine initiates the action, the accountability remains anchored to a defined digital identity.
This regulatory certainty has acted as a catalyst for institutional adoption. Rather than waiting for a secondary market to develop, established financial pillars—including Santander, Mastercard, ING, and Worldline—have aggressively integrated agentic payment capabilities into their existing infrastructure.
A pivotal milestone in this timeline occurred on July 2, 2026, when a consortium comprising ING, Worldline, and Visa successfully executed an agentic payment in Germany. The transaction utilized Visa Payment Passkeys for biometric authentication, providing a template for how AI agents can interact with legacy banking rails without compromising security. This event proved that the technical infrastructure for agent-driven commerce is not only ready but interoperable with existing global networks.
Mastercard, in particular, has positioned itself at the vanguard of this shift. By enabling all issuers in Europe at the network level for "Agent Pay" and establishing a dedicated Lisbon Centre of Excellence for Innovation, the firm is providing the plumbing for a new economic era. Kelly Devine, President of Mastercard Europe, described the development as a fundamental shift in the initiation of commerce, emphasizing that the firm is applying decades of expertise in security, trust, and global interoperability to a landscape defined by autonomous agents.
The United States: A Liability Vacuum
In stark contrast to the European experience, the United States is currently characterized by a proliferation of disparate agent platforms that lack a unified commercial ecosystem. The primary obstacle is not the sophistication of the AI models, but rather a "liability vacuum" that prevents merchants from adopting these tools at scale.
The US regulatory environment is currently struggling to interpret existing statutes in the context of autonomous decision-making. The US Treasury Office of Inspector General (OIG) has flagged significant ambiguity in Regulation E, which governs electronic fund transfers, particularly regarding the definition of "authorized" transactions when an agent, rather than a human, initiates the request.
Legislative efforts, such as the AI AGENT Act introduced in July 2026, have largely focused on the fiduciary duties of AI developers. However, these measures have failed to address the most critical issue for market participants: liability allocation. If an autonomous agent erroneously authorizes a purchase or falls victim to a sophisticated prompt-injection attack, current law provides little clarity on who bears the financial burden—the merchant, the bank, the AI provider, or the consumer.
The Consumer Bankers Association (CBA) has recognized this paralysis, recently suggesting that in the absence of federal guidance, the industry may need to develop its own private network rules. Without such a framework, the US risks falling behind in the global race to establish the standards that will govern the next generation of commerce.
The Economic Mismatch: Data and Sentiment
The discrepancy between the two regions is further highlighted by a growing chasm between technological capability and consumer/merchant behavior. Data from Hypertrade indicates that AI-generated traffic to retail sites has surged by 4,700% year-over-year. Yet, despite this massive increase in machine-to-machine interactions, agentic commerce accounts for less than 1% of total US e-commerce volume.
This figure exposes the "trust gap." According to the Visa Earning Trust report, only 23% of US consumers feel comfortable with generative AI managing their payment credentials or executing financial transactions. This hesitation is mirrored on the merchant side, where a PYMNTS Intelligence report found that 93% of retailers believe the liability for incorrect AI-driven purchases should reside exclusively with the AI provider.
This data paints a clear picture: the technology is functioning as intended, but the commercial risk-reward profile is fundamentally broken. Merchants are unwilling to absorb the "machine error" rate, and consumers remain wary of delegating their purchasing power to autonomous systems that lack clear legal recourse.
Chronology of Development (2025–2026)
- Q1 2025: Initial prototypes of AI-agent shopping assistants gain traction in the US; limited to basic product searches with no native payment functionality.
- Q4 2025: The EU releases final technical guidelines for PSD3, specifically addressing "delegated authentication" for AI-led payments.
- Q2 2026: The AI AGENT Act is introduced in the US Congress, focusing on fiduciary duties but leaving liability frameworks for payments unresolved.
- July 2, 2026: ING, Worldline, and Visa complete the first large-scale, biometrically authenticated agentic payment in Germany, setting a European benchmark.
- Q3 2026: Mastercard announces the full integration of "Agent Pay" across all European issuers, marking the transition from experimental pilots to network-wide utility.
Implications for the Future of Global Commerce
The current state of affairs carries significant long-term implications for the global digital economy. If Europe continues to lead in regulatory-first agentic architecture, it may export its standards globally, much as it did with the General Data Protection Regulation (GDPR). By defining what constitutes an "authorized" autonomous payment, Europe is creating a blueprint that international banks will likely follow to ensure cross-border compatibility.
Conversely, the US model of "regulatory silence" may lead to a fragmented market where different private networks develop incompatible rules. This risks creating a "balkanized" commerce environment where AI agents operating on one network cannot seamlessly transact with merchants on another, stifling the very efficiency that autonomous agents are meant to provide.
As Stephanie Cohen, CSO at Cloudflare, aptly noted, the internet was built for human-to-human or human-to-machine interactions, but the infrastructure of the future must be built for autonomous ones. The current struggle in the United States highlights the difficulty of retrofitting a 20th-century financial legal framework onto a 21st-century technological reality.
Moving forward, the resolution of the liability question will be the single most important factor in determining the growth trajectory of agentic commerce. Whether through federal mandates or industry-led private network consensus, the establishment of a clear, predictable liability framework is the necessary prerequisite for moving agentic commerce from a niche novelty to the standard method of digital exchange. Until that occurs, the US will likely continue to observe a widening gap between the immense potential of its AI developers and the limited reality of its retail market.
