Agentic payments in the UK. Faster Payments, open banking and the rules that apply.

The short answer

In the UK, an AI agent can start payments over the same rails a person uses: Faster Payments, open banking payment initiation, Bacs, CHAPS and cards. No UK rule is written specifically for agents yet. The FCA applies its existing frameworks, including the Consumer Duty and the Senior Managers regime, to firms’ use of AI. So the questions are the familiar ones, asked more sharply: was the payment authorised, by whom, under what limits, and can you prove it?

Interest is rising. In our Google Trends check for the 12 months to 28 September 2026, "agentic payments" scored 163 in Great Britain against 100 for "payment reconciliation", and grew through the year.

The rails an agent can use

Why variable recurring payments look like an agent mandate

Open Banking Limited describes variable recurring payments as letting customers connect authorised payment providers to their bank account to make payments on their behalf in line with agreed limits, with the amount over a period and the end date agreed upfront, and the permission cancellable at any time.

That is the shape an agent’s authority should have: a scope, a cap per period, an expiry and a way to revoke. The Competition and Markets Authority mandated the nine largest banks to support VRP for sweeping between a customer’s own accounts; other uses have not been mandated, so availability depends on the banks and providers in your flow. Whatever the rail, the mandate that governs an agent should live in your payment system, where it can be checked before each payment and matched afterwards.

The FCA’s approach to AI

The FCA has said it wants the safe and responsible adoption of AI in UK financial markets, and it applies its existing rules rather than AI-specific ones. For a firm letting agents pay, that points to three questions a supervisor is likely to ask:

• Accountability: which senior manager is responsible for the agent’s decisions? Under the Senior Managers and Certification Regime, accountability cannot be delegated to a model.
• Customer outcomes: under the Consumer Duty, can you show that agent-made payments produce good outcomes, including when they go wrong?
• Evidence: can you trace any payment back to the authority, the rule and the person that allowed it?

The FCA also runs an AI Lab and launched AI Live Testing, where firms can test AI systems in real-world conditions with regulatory support. Nothing here is legal or regulatory advice; your own obligations depend on your permissions and your customers.

Who is liable when an agent pays?

Under the Payment Services Regulations 2017, the payer’s liability for unauthorised payment transactions is generally capped at £35, unless the payer acted fraudulently or, with intent or gross negligence, failed to keep their security details safe. Whether a payment an agent made counts as authorised depends on how the customer’s consent was given and recorded. That is why the mandate, and the record of every decision under it, matter so much: they are the evidence either way.

A second route applies to authorised payments. The Payment Systems Regulator’s reimbursement requirement covers authorised push payment scams on Faster Payments and CHAPS, with the sending and receiving firms sharing the cost of reimbursement 50:50. An agent tricked by an injected instruction into paying a fraudster is exactly the scenario controls such as allow-lists and waiting periods for changed bank details exist to prevent. Take legal advice on how these rules apply to your flows.

UK-specific controls to add

• Confirmation of Payee before the first payment to a new beneficiary, and after any change to their details.
• Approval tiers by reversibility: Faster Payments and CHAPS are final once sent, so payments on them deserve lower approval thresholds than anything you can still stop before it moves.
• Cut-off awareness: an agent preparing a Bacs file at 10pm should know when it will actually move.
• A mandate that mirrors VRP parameters: amount per period, end date, and revocation, even when the rail itself is a plain Faster Payment.

Where Flominzo fits in the UK

Flominzo AgentPay records each agent’s mandate and turns requests into structured payment intents that the deterministic core checks before execution. Payments run through the UK providers and banks you use, over the rails agreed for your deployment, and Flominzo Recon proves each one against provider, settlement and bank evidence. Flominzo does not hold customer funds or take on your regulatory permissions. See Flominzo in the UK for the rails and statement formats we reconcile.

Where UK firms are starting

• Supplier payments for SMEs: a finance copilot prepares approved invoices for payment by Faster Payments, and a person approves anything new or large.
• Sweeping: moving surplus funds between a customer’s own accounts, the one VRP use the largest banks must support.
• Marketplace and gig payouts: an agent assembles the day’s payouts from settled orders, with Confirmation of Payee on new details.
• Bill payments: recurring bills to known billers, inside fixed caps.
• Payment operations: agents that investigate returns and unmatched Bacs items, and draft explanations for a person to accept.

The evidence a UK firm should keep

If a customer, an auditor or the FCA asks about an agent’s payment, you should be able to produce, for that payment: the agent and its version; the mandate version it acted under and who granted it; the rule that allowed it and any approval; the Confirmation of Payee result where one was run; the provider’s reference and status; and the settlement and bank statement lines that prove it moved. For payments the agent proposed but did not make, keep the refusal and the rule behind it.

That is also what a firm needs to answer the authorised-or-not question under the Payment Services Regulations, and to handle a reimbursement claim quickly. Our audit trail guide and agent audit checklist set it out item by item.

What the UK hasn’t settled yet

Some questions do not have settled answers yet, and firms should plan for them rather than assume:

• How consent given to an agent is evidenced for the purposes of the authorised-or-unauthorised test, especially when the agent acts later on authority given earlier.
• How reimbursement rules apply when a customer’s own agent is deceived into paying a fraudster.
• How responsibility is shared between a payment initiation provider, the customer’s bank and the business whose agent started the payment.

The FCA’s approach so far is to apply its existing frameworks and test with firms. The safest position for a firm is an evidence trail good enough to answer any of these questions for any single payment.

Questions

Related

Sources

• FCA: AI in financial services
• FCA: FS25/5 AI live testing feedback statement
• Open Banking Limited: Variable Recurring Payments
• The Payment Services Regulations 2017, regulation 77
• Payment Systems Regulator: APP scams reimbursement