When AI Agents Pay: The Legal Challenges Of Agentic Payments In Switzerland

AI agents no longer merely recommend purchases — they are beginning to select merchants, conclude transactions and pay, within mandates their users define in advance. For Swiss banks and fintechs, this shifts the legal question from whether an institution may deploy an autonomous agent to whether a customer can validly authorise today a payment whose amount, counterparty and timing will only be determined tomorrow. The payment mandate, not the individual payment instruction, becomes the decisive legal control point.

Peter Ruggle, lic. iur. HSG

Founding & Managing Partner, Ruggle Partner

1. From autonomous agents to autonomous payments

In an earlier briefing, we examined how Swiss law allocates responsibility when autonomous AI agents act within financial institutions.¹ The conclusion was clear: an AI agent has no legal personality, and autonomy in the machine does not displace responsibility in the firm. Agentic payments take that analysis one step further — what happens when the action taken by the agent is the payment itself?

This is no longer a hypothetical for the Swiss market. In May 2026, Mastercard executed the first authenticated agentic commerce transaction in Switzerland together with Cembra, Cornèrcard and Viseca: an AI agent selected a suitable purchase for a customer and completed the booking and payment autonomously, on the basis of the customer’s prior consent, strong authentication and defined user controls.² Internationally, the major card schemes and technology platforms are racing to build the corresponding infrastructure — agent-bound payment credentials, scoped consent policies and programmable spending controls.³

The legal challenge is therefore no longer merely whether a financial institution may use an autonomous agent. It is whether a customer can authorise an AI agent today to make payment decisions tomorrow — for transactions, amounts and counterparties that may not yet be known. That question is the subject of this briefing.

2. What exactly is an agentic payment?

Not every AI-touched payment is an agentic payment. For legal purposes, three configurations must be distinguished:

The first two configurations raise familiar questions. A voice assistant that transfers CHF 50 on express command is legally unremarkable: the human takes the decision and gives a specific instruction; the technology is merely the channel.

The interesting case is the third. Consider the instruction: “Book me a suitable hotel in Geneva next week for no more than CHF 700.” At the moment the mandate is given, the customer knows neither the hotel, nor the price, nor the concrete transaction. The agent will decide all three — and pay. It is precisely here that the legal analysis begins.

3. Can you authorise a payment that does not yet exist?

3.1 Mandate versus individual payment instruction

Swiss law has no difficulty with advance authorisation as such.⁴ Standing orders and direct-debit arrangements have long demonstrated that a payment can be validly authorised before it exists. But those instruments are deterministic: amount, payee and rhythm are fixed in advance, and the “decision” at execution is purely mechanical. An AI agent, however, is not itself a legal representative capable of holding authority under Article 32 CO — it has no legal personality. The relevant question is therefore not whether the agent “holds” authority, but one of attribution: under what conditions can a payment instruction generated autonomously by a system be treated as the customer’s own instruction? The general rules on agency and mandate may inform that analysis by way of analogy, but the algorithm should not be treated as if it were simply an ordinary representative.

An agentic mandate is categorically different. The customer does not pre-define the transaction; he pre-defines a decision space — “you may spend up to CHF 1,000 per month on travel” — within which the agent exercises genuine discretion over merchant, amount and timing. Two legally distinct authorisations are bundled into one instruction:

• the authority to decide — to select the transaction, the counterparty and the terms; and
• the authority to pay — to dispose of the customer’s funds or credit line in execution of that decision.

Traditional payment law fuses these into a single act: the customer decides and, in the same breath, instructs. Agentic payments pull them apart in time and allocate the first to a machine. In our assessment, Swiss contract law can accommodate this — a sufficiently determined or determinable mandate is valid — but the burden shifts squarely onto the quality of the mandate: its scope must be defined, evidenced and technically enforced, because it will later have to carry the entire weight of the question “was this payment authorised?”

3.2 How specific must the mandate be?

What, then, must the customer determine in advance for the mandate to function as a valid authorisation? At a minimum, institutions should require definition of:

• a maximum amount per transaction and a cumulative ceiling;
• the period of validity of the mandate;
• the category of goods or services covered;
• permitted merchants or merchant types, where feasible;
• the payment instrument the agent may use; and
• geographic limits, where relevant.

Yet even a well-drafted mandate leaves a residual zone of judgment. Take the instruction: “Buy the cheapest direct flight from Zurich to London next Friday after 5 p.m., maximum CHF 450.” The agent finds a flight for CHF 399 — straightforward. But what if it selects a non-rebookable fare at CHF 440 when a flexible ticket was available for CHF 445? The agent has acted within the monetary authorisation, but possibly outside what the customer reasonably expected.

Contractual mandate versus technical mandate. A further distinction concerns where the mandate lives. Three levels must be kept apart: the customer instruction (what does the customer want?), the contractual authority (what may the provider or the bank do under the agreements in place?) and the technical permissions (what can the agent actually execute?). These three levels must be congruent — a limit that exists only in the customer’s instruction, but is neither reflected in the contractual documentation nor technically enforced, is where disputes will begin.

3.3 Authority is not the same as discretion

This is the doctrinal core of agentic payments. Under the law of mandate, the mandatary owes not only obedience to instructions but diligent and faithful execution in the mandator’s interest; where the instruction leaves room, that room is bounded by the mandator’s recognisable interests, not by the outer monetary limit alone.⁵ The mandatary in this sense is, importantly, not the AI agent itself: despite the terminology, the “AI agent” is not necessarily an agent in the legal sense. The relevant contractual role must be identified separately — depending on the architecture, the duty to select and execute the transaction may lie with the bank, the AI provider, the platform or another service provider, the agent being merely the technical means by which that party performs its obligation. Transposed to agentic payments: a transaction may be authorised (within the mandate’s formal limits) and yet constitute defective performance of the mandate (a decision no diligent agent should have taken). The first question determines whether the account may be debited at all; the second determines who ultimately bears a loss from a poor decision. Keeping these two questions apart — authorisation versus performance — is, in our view, the key to analysing every agentic-payment dispute.

4. When the agent gets it wrong: who bears the loss?

The general Swiss liability architecture for AI agents — contractual liability for auxiliaries, organisational liability, directors’ duties — was set out in our July briefing and applies here without modification: an institution cannot delegate its liability to a tool.⁶ What agentic payments add are four payment-specific loss scenarios that institutions should think through before launch.

Case 1 — The agent exceeds the mandate. The limit is CHF 500; the agent pays CHF 750. On the assumed facts, this should in principle be treated as a payment outside the customer’s authorisation. Under settled Federal Supreme Court case law, a bank that executes a transfer without a valid instruction pays, in principle, at its own risk: it has no reimbursement claim against the customer, subject to valid risk-transfer clauses and questions of fault on both sides.⁷ Whether that principle applies unchanged here may, moreover, depend on which limit was declared to whom: a limit agreed between the customer and the agent provider is not necessarily part of the legitimation arrangements with the bank (see section 3.2 above). The technical enforcement of mandate limits at the point of authorisation is therefore not a mere product feature — it is the institution’s primary self-protection.

Case 2 — The agent stays within the mandate but exercises its discretion poorly. Recall the flight example above: the agent books the non-rebookable fare for CHF 440 although a fully flexible fare was available for CHF 445 — not an obvious error, but a questionable exercise of discretion. The payment is authorised; the account debit stands. The customer’s complaint is not against the bank as executor of the payment, but sounds in defective performance of the agency function — and is directed at whoever assumed that function: the agent provider, the platform, or the institution itself where it offers the agent as its own service. Providers will seek to exclude liability for the “quality” of agent decisions in their terms; the effectiveness of such exclusions will be tested against the limits Swiss law places on exculpation, particularly where the provider acts in a professional capacity.

Case 3 — The agent is manipulated. A merchant’s website embeds instructions — invisible to humans, legible to models — that steer the agent toward a different or more expensive purchase: prompt injection, in payment form. Unlike conventional payment fraud, the attacker need not steal the customer’s credentials; it may be sufficient to manipulate the information on which the authorised agent bases its decision. The transaction is formally within the mandate; substantively, the agent’s will was bent by a third party. Who bears that risk — the customer who chose to deploy an agent, the provider whose agent was manipulable, the merchant who manipulated, or the bank that executed? Swiss law offers claims against the manipulating merchant (tort, unfair competition), but recovery there will often be illusory. The practically decisive allocation will be contractual — between customer, agent provider and institution — and should be drafted now, deliberately, rather than discovered later in litigation.

Case 4 — The agent is compromised. Credentials, API keys or the wallet layer are taken over, and the “agent” transacting is now the attacker. This is the classical fraud problem in a new guise, and it produces what may be the central operational question of agentic payments: how can a bank distinguish an authorised autonomous payment from an unauthorised payment generated by a compromised autonomous agent? With human customers, banks rely on behavioural signals — device, location, typing pattern, habit. An autonomous agent has no fixed habits a fraud model can trust, and a well-instructed attacker can remain carefully inside the mandate’s limits. The answer will lie in agent-bound credentials, cryptographic binding of each transaction to a specific mandate, and anomaly detection recalibrated for machine behaviour — and, legally, in a fresh look at legitimation and risk-transfer clauses that were drafted for careless humans, not hijacked machines.

5. Instant payments change the risk equation

Any of the four cases above becomes materially more serious when the payment settles irrevocably within seconds. And the Swiss instant-payment infrastructure is rapidly becoming ubiquitous: since August 2024, the largest institutions have been required to be able to receive instant payments via the SIC5 platform, with the remaining institutions active in customer payments following in the second implementation phase in November 2026.⁸ While the regulatory rollout concerns the capability to receive instant payments, the broader market direction is clear: real-time payment execution is moving from exception to infrastructure. As banks increasingly extend instant-payment functionality to outgoing customer payments, the combination with autonomous agents creates a new risk profile. Agentic payments and instant payments will not arrive sequentially in Switzerland — they will arrive together.

Autonomy plus instant settlement is a qualitatively different risk. Consider the timeline:

• 03:17:02 — the agent decides;
• 03:17:03 — the payment order is submitted;
• 03:17:05 — the payment settles with finality;
• 03:17:10 — fraud detection flags the anomaly.

Too late. Traditional payment controls often assume that suspicious transactions can be stopped before execution. Agentic instant payments may invert that model: detection increasingly occurs after an autonomous and potentially irreversible transaction has already settled. There is no human hesitation to exploit as a time buffer, no overnight batch in which to review, and — at three in the morning — no customer awake to query a confirmation message.

The regulatory consequence is that controls must migrate upstream, from transaction review to mandate design and pre-authorisation enforcement. Ex-post monitoring retains its role — in stopping the second transaction, freezing the mandate and meeting anti-money-laundering duties — but the protective centre of gravity moves to the moment before the agent acts. For institutions calibrating their FINMA-facing risk management of AI use cases, agentic instant payments should rank among the most material applications an institution can operate.⁹

6. From KYC to “know your agent”?

Anti-money-laundering and know-your-customer duties were addressed in general terms in our July briefing. “Know your agent” is, to be clear, not a new AML category: the customer remains the person subject to identification and due-diligence duties. But institutions may increasingly need a parallel technical understanding of the software actor initiating transactions on that customer’s behalf. For agentic payments, three concrete questions deserve attention:

Identification. Should — and can — the institution recognise whether a transaction is initiated by the customer personally or by an agent acting under a mandate? The emerging card-scheme infrastructure points toward yes: agent-initiated transactions carry agent-bound credentials and are distinguishable at the rail level. Institutions onboarding agentic flows should insist on this distinguishability rather than accept agent traffic that masquerades as human traffic.

Authentication. What is actually being authenticated — the customer, the device, or the agent’s authority? In agentic payments, authentication may increasingly need to establish not only who the customer is, but also what the agent is authorised to do. Strong customer authentication at mandate creation, cryptographic binding of the mandate to the agent, and step-up authentication when the agent approaches its limits form the natural three-layer answer.

Monitoring. What does “normal customer behaviour” mean when an autonomous agent may lawfully execute hundreds of micro-transactions around the clock? Behavioural monitoring models trained on human rhythms will either drown institutions in false positives or, worse, be de-tuned until they catch nothing. Monitoring will need agent-specific baselines — expected velocity, merchant dispersion and mandate proximity per agent.

7. What should banks and fintechs do now?

Our July briefing set out the general governance framework for autonomous agents — oversight models, authority limits, escalation, audit trails. None of that is repeated here. What agentic payments require in addition is a payment-specific control architecture along the life cycle of the mandate:

An institution that can evidence each of these control points has, at the same time, built the factual record it will need in any later dispute over authorisation, performance or fraud.

8. Conclusion: the payment mandate becomes the new control point

In agentic payments, the legal focus shifts from approving individual transactions to defining the boundaries within which machines may transact autonomously. The questions that will decide disputes — Was the payment authorised? Did the agent perform its mandate diligently? Who bears the loss from manipulation or compromise? — all trace back to a single document and a single moment: the mandate, and the point at which it was given.

For Swiss banks and fintechs, the critical control point may therefore no longer be the individual payment instruction. It may be the mandate given to the AI agent before the payment opportunity even exists. Institutions that treat mandate design, enforcement and revocation as the core of their agentic-payment offering — rather than as terms-and-conditions boilerplate — will hold the advantage. In an agentic payment world, the decisive legal act may therefore take place long before any money moves: when the human defines what the machine is allowed to decide.

Footnotes

^{1 Peter Ruggle, “Control, Responsibility and Governance of Autonomous AI Agents in Swiss Fintech”, Ruggle Partner briefing, July 2026 (also published on Mondaq).}

^{2 Mastercard media release, “Premiere in der Schweiz: Mastercard führt die erste agentenbasierte Transaktion im Handel durch, gemeinsam mit Cembra, Cornèrcard und Viseca”, 28 May 2026; the transaction was executed via Mastercard Agent Pay, with the AI agent selecting and paying for the purchase on the customer’s behalf.}

^{3 Mastercard announced Agent Pay on 29 April 2025; “agentic tokens” bind a tokenised card credential to a specific agent, merchant scope and consent policy. Visa (Intelligent Commerce), and other schemes have launched comparable frameworks.}

^{4 Art. 394 et seq. CO (mandate/agency contract); on the bank–customer payment relationship, the transfer order is generally characterised as an instruction within a mandate relationship (Giroverhältnis; cf. Art. 466 et seq. CO on the Anweisung). The rules on representation (Art. 32 et seq. CO) presuppose a person as representative; they can inform the analysis of agentic mandates at most by way of analogy.}

^{5 Art. 397 para. 1 CO: the mandatary must comply with the instructions of the mandator; deviation is permitted only under narrow conditions (Art. 397 para. 2 CO). Art. 396 para. 1 CO determines the scope of the authority where it has not been expressly defined.}

^{6 Art. 101 CO (liability for auxiliary persons) and Art. 97 CO (breach of obligation); see in detail the July 2026 briefing (footnote 1), section 4.}

^{7 Under settled Federal Supreme Court case law, a bank that executes a payment without a valid instruction has no claim for reimbursement against the customer; it can debit the account only where the customer validly authorised the transaction or where the loss is shifted to the customer by valid risk-transfer clauses and the bank is not grossly negligent (cf. BGE 132 III 449; BGE 146 III 121 et seq.).}

^{8 Instant payments in Switzerland settle via the SIC5 platform operated by SIX Interbank Clearing under the aegis of the Swiss National Bank. Banks with more than 500,000 customer payments per year have been required to receive instant payments since August 2024; the remaining banks active in customer payments must follow in the second implementation phase in November 2026. The regulatory obligation concerns the capability to receive instant payments; offering outgoing instant payments to customers remains a business decision of each institution.}

^{9 FINMA Guidance 08/2024, “Governance and risk management when using artificial intelligence”, 18 December 2024; AMLA and AMLO-FINMA duties regarding transaction monitoring apply irrespective of whether a transaction is initiated by a human or an agent.}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.