Six Banks Set AI-Shopping Principles, Not Law. Who Controls the Payment?

Governance Watch

On 22 September 2026, six banks — NatWest Group, ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia and ING Group — jointly published shared customer-centric principles for agentic commerce: AI agents that shop and pay on a customer's behalf [1].

The paper, "Building Trust in Agentic Commerce", covers five areas: transparency, safety, privacy and data, choice, and interoperability. One line from the announcement is the whole problem in a sentence. Mark Brant, Chief Payments Officer at NatWest Group:

"Customers need to trust that they remain in control of how payments are made and that their money is safe." [1]

What actually happened

• 22 Sep — the six banks jointly published the principles and a downloadable paper, "Building Trust in Agentic Commerce" [1].
• Next, per the release's notes to editors: a subsequent paper detailing how the principles can be implemented, with engagement from customers, industry and stakeholders [1].

What it is — and what it is not

These are voluntary industry principles, not law. No regulator issued them, they impose no compliance duty by themselves, and nothing in this article is a judgment about any organisation's legal position. Whether actual payment or consumer law attaches in your case depends on jurisdiction, role and activity — get qualified legal advice for your own circumstances.

What the principles do show is direction of travel from institutions that sit on both sides of every card transaction. When six major issuers and acquirers across three continents say the customer must remain in control of agent-initiated payments, the control question stops being theoretical for anyone shipping agents that touch money.

The question underneath

Strip away the policy language and one operational question remains: does a connected shopping or payment action carry authority, or merely access?

An agent with a payment API key has access. That says nothing about whether a specific purchase — this merchant, this amount, this moment — was authorised. Consider a simplified illustration, a hypothetical, not a reported incident: an agent configured to reorder office supplies initiates a checkout at a merchant it found by itself. Nothing is broken. No fraud has occurred. And nobody decided to allow that specific payment before it happened.

Working practice, not a compliance checklist

• For every agent that can reach a payment surface, write down what the agent may buy, up to what value, and who approves above it.
• Decide the boundary before the transaction: an action checked against policy before it executes is a decision; an action reviewed after the money moved is an incident report.
• Keep evidence of the decision that can be shown to an auditor or a bank later.
• Watch for the implementation paper — that is where these principles get concrete.

Where a control layer fits — and where it doesn't

With HaltState, you connect the payment action and set the policy: permitted purchases proceed automatically, spending outside the allowed scope is denied, and payments needing authorisation are held for human approval before execution. A signed Proof Pack preserves the governed decision for later review — you can check what the agent requested and what the policy decided. It is a governance layer for the actions you connect. It is not fraud prevention for everything an agent touches, it does not satisfy the banks' principles by itself, and it is not a compliance certification. The illustrative refund policy on haltstate.ai is labelled as exactly that — illustrative, not live activity [2].

General information only. This article and its companion video are not legal advice.