An AI agent can make decisions independently, but executing them requires a range of infrastructure components. The architecture of agentic finance consists of several interconnected layers: agent, identity, information, execution, payment and settlement, and financial asset access.
Depending on the use case, an AI agent’s financial transactions involve different components across these layers. Cross-cutting security and control mechanisms govern the agent’s permissions, access to data, and actions. CP Media takes a closer look at how agentic finance infrastructure works.
Agent Layer
At the core of agentic finance infrastructure is an AI agent, a software system capable of:
- Interpreting a given objective
- Analyzing available information
- Planning a sequence of actions
- Selecting the necessary tools
- Adjusting subsequent steps based on the results
The agent layer also includes an orchestration mechanism that coordinates individual tasks, interactions with external tools and data sources, tracks the state of the process, and handles exceptions. It also determines when the agent can proceed independently and when an operation must be stopped or referred to a human for approval.
In financial use cases, combining the probabilistic nature of AI models with deterministic execution logic is critical. An agent’s decisions can depend on context and change as new information becomes available, while critical conditions, including transaction limits, mandatory checks, permitted tools, and criteria for transferring control to a human, are governed by explicit rules. This architecture allows AI models to retain flexibility in decision-making while limiting the scope of their autonomous actions within the financial system.
Identity Layer
For a financial system, it’s important to distinguish among 3 questions:
- Who is the agent?
- Did the request actually come from that agent?
- What exactly is the agent authorized to do?
Identification links the agent to a user or organization, authentication verifies the participant’s identity, and authorization defines permitted actions, transaction amounts, recipients, and other restrictions.
Existing access mechanisms were designed primarily for direct interactions between people and services. In April 2026, when the FIDO Alliance announced the creation of a working group on agent authentication, it specifically highlighted this gap. Service providers still lack a standardized way to verify who instructed an agent to take an action, under what conditions, and within what limits.
Similar challenges are already being addressed at the application level. Visa Trusted Agent Protocol uses cryptographic signatures so merchants can distinguish trusted agents from ordinary automated traffic and verify the associated user context. The protocol also provides for separate signed structures linked to payment data.
In its Agent Payments Protocol (AP2), Google proposes recording user instructions as signed digital mandates. These mandates can specify the terms of a future transaction, such as a price limit or time frame, and create a verifiable chain from the user’s original intent to a specific payment.
Financial Asset Access Layer
A separate infrastructure layer provides actual access to funds. In traditional financial systems, this involves a bank or payment account and the associated credentials. In a blockchain environment, it involves a digital wallet and a transaction signing mechanism.
The primary objective is to separate the authority to initiate an action from full control over the funds. Circle’s Agent Wallets, introduced in 2026, allow an agent to conduct transactions within limits set by the user, while shares of the cryptographic key aren’t exposed to the model itself. Users can set transfer limits for the wallet, as well as allowlists and blocklists for recipient addresses and smart contracts.
This approach illustrates a broader principle: financial autonomy should be delegated and limited. An agent can use capital within the scope of a specific task, while custody of the funds and critical permissions remain separate from its ability to make decisions independently.
Information Layer
The quality of an agent’s decisions depends directly on the information available to it, including:
- Balances and transaction history
- Market data
- Payment details
- Liabilities and liquidity
Data quality, timeliness, and provenance also pose a challenge. In a report by the Cambridge Centre for Alternative Finance, 40% of financial industry respondents cited data availability and quality as one of the main barriers to AI adoption. The share reached 49% among traditional financial institutions and 34% among FinTech companies.
For an agent, an error at this layer can affect a real-world action. Infrastructure therefore needs to restrict access to data sources, verify their provenance and timeliness, and separate trusted data from external content that could alter the model’s behavior.
Execution Layer
Once an agent makes a decision, it needs a standardized way to interact with a financial service. APIs provided by banks, brokers, payment companies, exchanges, and blockchain protocols serve this purpose. Through these interfaces, an agent can check a balance, initiate a payment, place an order, or check the status of a transaction.
The more structured the interface, the easier it is to validate parameters before execution and handle errors correctly. Agentic infrastructure is therefore developing around standardized tool calls instead of direct model interaction with user interfaces.
One of the most prominent open protocols is the Model Context Protocol (MCP), which provides a standardized way to connect models to external data and tools. In July 2026, the main MCP software development kits recorded a combined total of around 500 million downloads per month. The latest version of the specification also strengthened authorization mechanisms and made it easier to scale server-side infrastructure.
MCP isn’t a financial protocol. Within agentic finance infrastructure, it can serve as a connective layer between an agent and the services that provide specific capabilities, eliminating the need for developers to build a separate integration method for each tool.
Payment and Settlement Layer
Initiating a financial action and completing settlement are separate tasks. An agent can generate a payment instruction, but the actual movement of funds takes place through existing infrastructure, including:
- Card networks
- Bank transfers
- Instant payment systems
- Blockchain networks
In agentic finance, payment infrastructure must account for the fact that a transaction is initiated by an AI agent acting within delegated authority. Along with transmitting payment data, the system needs to verify that the agent is authorized to execute a specific transaction and maintain a verifiable link between the user’s original instruction and the outcome. AP2, for example, was designed to be payment method agnostic and supports cards, real-time bank transfers, and stablecoins.
Mastercard takes a similar approach with Agent Pay, which allows AI agents to be registered and identified, user intent and consent to be verified, and agent-initiated transactions to be linked to predefined permissions and limits. Payments use Agentic Tokens, cryptographically secured credentials that allow transaction participants to determine that a transaction was initiated by a registered AI agent and trace its origin.
In June 2026, Mastercard also introduced Agent Pay for Machines, a separate solution for programmatically initiated transactions between AI agents and other automated systems. It provides for participant identification, permissions and limits, transaction execution, and settlement across multiple payment rails, including card infrastructure, bank accounts, and stablecoins.
Specialized identification, authorization, and control mechanisms can operate on top of existing payment systems, while transactions are processed through available settlement rails. The choice of rail depends on the type of transaction, jurisdiction, cost, speed, and other requirements.
Security as a Cross-Cutting Layer
In digital banking, users typically approve a critical action immediately before it’s executed. With highly autonomous agents, however, requiring human approval for every transaction becomes impractical and effectively conflicts with the model of autonomous execution. A significant share of controls therefore needs to be defined in advance through machine-readable rules.
These mechanisms include:
- Limits by amount and time period
- Permitted transaction categories and recipients
- Mandatory human approval for specific actions
- Isolation of cryptographic keys and payment data
- Logging
- Anomaly monitoring
- The ability to stop an agent in an emergency
The importance of these measures is supported by the findings of the Cambridge Centre study cited earlier. Among financial industry respondents, 74% identified data protection as a major risk associated with the use of AI solutions, 70% cited unreliable outputs and model errors, 55% cited the loss of human control, and 50% cited AI-enabled cyberthreats.
In agentic finance, autonomous execution can increase the consequences of these risks. Security measures therefore need to be in place at every stage, from data access and the granting of permissions to transaction processing and settlement records.
Interoperability and Emerging Standards
If every bank, wallet provider, and agent developer uses its own approach to defining permissions and interactions, agentic finance will remain a collection of closed ecosystems. Open protocols are therefore developing in parallel, with their functions gradually becoming more distinct:
- MCP connects agents to data and tools
- Agent2Agent (A2A) standardizes communication between agents
- AP2 provides authorization and context transfer for agentic payment transactions
According to the Linux Foundation, more than 150 organizations supported A2A by April 2026, and the protocol was integrated with cloud platforms from Google, Microsoft, and AWS. More than 60 companies from the payments and technology industries joined the AP2 initiative at launch.
In April 2026, Google contributed AP2 to the FIDO Alliance, while Mastercard contributed Verifiable Intent, a concept developed jointly with Google. These technologies became the foundation for developing agentic commerce specifications within FIDO’s Payments Working Group. In parallel, the organization formed a separate working group to develop standards for AI agent authentication and secure delegation of authority.
The development of several parallel initiatives indicates that the market is already moving toward a common architecture. Its final form, however, has yet to be defined, and a unified set of industry standards hasn’t emerged. The next stage will involve bringing individual infrastructure components together into an interoperable system that can operate across different providers and enable controlled AI agent autonomy. Progress on this front will largely determine whether agentic finance moves from individual solutions and experiments to widespread adoption.
