AI agents and payments

An AI agent that pays, places orders or runs a wallet for a user falls under financial law. No text targets agents as such: PSD2 and MiCA apply to what the agent does. ORWL Avocats qualifies each function, structures the product and handles the file before the AMF (Autorité des marchés financiers) and the ACPR (Autorité de contrôle prudentiel et de résolution), the French financial regulators.

An AI agent, or agentic AI, is software that receives an objective and chains the actions needed to reach it on its own: comparing offers, deciding, paying, placing an order, signing a transaction. The user no longer approves each step, and this transfer of decisions has caught regulators’ attention.

Financial law is neutral about technology. It looks at three facts: who acts, on whose behalf, and who controls the funds. The answers set the regime: payment service, crypto-asset service or plain software.

Which regime applies to an AI agent?

Three questions guide the qualification of any agent that handles money or crypto-assets:

• what the agent does: pay, place orders, advise, hold assets or transfer them;
• on whose behalf: the user alone, a merchant or the provider itself;
• who is in control: the user, who approves and keeps their credentials and keys, or the agent provider, who can act without them.

Qualification works function by function. One agent may initiate payments, recommend crypto-assets and run a wallet: each function falls under its own regime. The provider’s status also depends on its model: a publisher that sells software the user runs alone is not in the same position as a provider that hosts the agent and acts in its clients’ name.

Can an AI agent pay on the user’s behalf?

Yes, but the route the payment takes decides the regime. The French Monetary and Financial Code (CMF) lists the payment services, including payment initiation and money remittance (Article L. 314-1). PSD2 defines payment initiation as a service that initiates a payment order, at the user’s request, on an account held with another provider.

The dividing line is control of the account:

• an agent provider that connects to the user’s payment account to give the order provides a payment initiation service, which requires authorisation as a payment institution;
• a provider that receives the user’s funds in order to pass them on to the merchant provides a money remittance service, and may even issue electronic money if it holds a prepaid balance;
• an agent that prepares the payment, which the user approves and authenticates with their own bank, may leave its provider outside the scope of payment services.

The technical service provider exclusion does not settle the question. It covers a person that never takes possession of the funds, but it expressly carves out payment initiation. The commercial agent exclusion, which covers a person authorised by contract to negotiate or conclude a purchase on behalf of the payer only, is read narrowly: it requires real room to negotiate and a mandate from one party.

Two rules then weigh on the user journey. The user must protect their personalised security credentials: having users hand them to an unauthorised agent exposes them if a transaction is disputed. PSD2 requires strong customer authentication (SCA) (Article 97): the agent cannot bypass it, and the product must provide for the moment the user authenticates, or for the limits the user’s bank agrees to apply.

ORWL Avocats also handles the qualification of crypto activities under payment rules and payment institution authorisation applications, including dual status with CASP authorisation.

An AI agent that places crypto-asset orders: which MiCA service?

MiCA (Regulation (EU) 2023/1114 on markets in crypto-assets) reserves to authorised providers the supply of crypto-asset services to clients on a professional basis. An agent that acts on crypto-assets for a user therefore falls under one of those services as soon as its provider takes part in the order. Which service depends on how autonomous the agent is. Services can add up: an agent that recommends a transaction and then relays the order provides advice and reception and transmission of orders. If the agent provider acts as the user’s counterparty itself, it provides an exchange of crypto-assets for funds or for other crypto-assets.

Advice deserves particular attention. MiCA defines it as a personalised recommendation on one or more crypto-asset transactions, or on the use of crypto-asset services. On 18 June 2026, ESMA (the European Securities and Markets Authority) stated in a Q&A that recommending a crypto-asset service to an investor may amount to advice depending on the circumstances, even without recommending a specific asset. A mere reference to a provider, offered to everyone in the same way, is not a recommendation. An agent that steers the user towards an asset or a platform based on their profile therefore gives advice, even if it places no order.

Advice and portfolio management require a prior suitability assessment: the client’s knowledge, experience, objectives and ability to bear losses. For an agent, this requirement shows up in the product: the questionnaire, the agent’s limits and the report to the client are designed with the model, not afterwards.

A tool sold under licence, which the user runs alone with their own API keys, stays in principle outside the scope of the services. A provider that hosts the agent and places orders in the user’s name, with the user’s keys, falls within the framework. For agents that operate on decentralised protocols, ORWL Avocats also advises on the qualification of DeFi projects and on CASP authorisation applications where the service requires one.

AI agents and wallets: who keeps the keys?

MiCA defines custody and administration of crypto-assets on behalf of clients as the safekeeping or control, on behalf of clients, of crypto-assets or of the means of access to them, where applicable in the form of private cryptographic keys. The test is control, wherever the key sits technically.

Two situations stand out:

• the agent provider holds the private keys, or enough of them to move the assets without the user: it provides custody, with its segregation and return obligations, and often a transfer service for crypto-assets;
• the user alone holds their keys and delegates to the agent a limited, revocable right to sign: the provider may stay outside the scope of MiCA for custody of the assets.

Between the two, recent architectures create many borderline cases: session keys, permissions delegated by a programmable account, signing shared between several parties. The test stays the same: can the provider, alone or with a third party it controls, move the user’s assets? The analysis rests on the actual architecture, backed by a technical diagram.

In the first case, the provider may stay outside authorisation. In the second, it needs a status, or a partner that holds one.

Does a payment protocol for agents remove the need for authorisation?

Payment players are already standardising delegation to an agent. On 16 September 2025, Google introduced the Agent Payments Protocol (AP2), developed with more than sixty organisations: the user gives the agent a signed mandate that sets the purpose of the purchase and its limits, then approves the basket, and these mandates serve as evidence of the user’s instructions. An extension of the same protocol, designed with Coinbase among others, covers stablecoin payments (x402).

A protocol of this kind establishes who authorised what. It does not say who receives the funds or who holds the credentials or keys, and those two facts decide the regime, as in the previous sections. The diagram follows one payment, from the order to the arrival of the funds.

Three practical consequences follow:

• the mandate evidences the user’s intent; it does not, by itself, remove the requirement for strong customer authentication, which only the exemptions set by the regulations lift;
• an agent that receives the funds or signs with the user’s keys leaves the case where the user keeps control, whatever protocol is used;
• paying in stablecoin changes the qualification when the token is an e-money token (EMT): transfer and custody of EMTs on behalf of clients are then qualified as payment services, and the CASP must also obtain authorisation as a payment institution.

On that last point, the ACPR set out its expectations on 19 February 2026 (revised 24 September 2026; page in French): a CASP that limits its payment services to EMTs may file a streamlined application (agrément allégé). ORWL Avocats handles these files (payment institution authorisation) and also advises issuers of stablecoins.

What about the AI Act?

The AI Act creates no authorisation for AI agents. It adds to financial law without replacing it. Three sets of rules matter for a payment or trading agent:

• AI literacy, applicable since 2 February 2025: Regulation (EU) 2026/1744 of 8 July 2026, which amends the AI Act, now requires measures to support AI literacy, without guaranteeing a given level;
• transparency obligations, applicable since 2 August 2026, including telling people that they are interacting with an AI system; they will apply from 2 December 2026 to systems that generate synthetic content;
• the high-risk regime, which in finance covers the creditworthiness assessment of natural persons and the pricing of certain insurance, not a payment or trading agent as such; Regulation (EU) 2026/1744 postpones its application to 2 December 2027.

An authorised institution that integrates an agent supplied by a third party must also treat it as an outsourced ICT service under DORA: risk analysis, contract clauses, register of information, exit plan. ORWL Avocats also supports CASPs and payment institutions with their DORA compliance.

Our approach

Every engagement starts from the product: the firm reads the agent’s architecture with the technical team before qualifying anything, because control of the keys, the path of the funds and the user’s share of decisions are settled there. Structuring first aims to keep the product outside authorisation where its model allows: approval of the payment by the user, self-custody of keys, use of an authorised provider for the regulated function. Where a status is needed, the firm describes the agent, its governance and its controls in the application, then answers the questions of the AMF or the ACPR. Contracts settle what the law leaves open: payment services law sets the provider’s liability towards the user, while the terms and conditions, the mandate given to the agent and the agreements with partners allocate the cost of an agent’s error.

Why work with ORWL Avocats?

Since 2018, the firm has led dozens of authorisations before the AMF and the ACPR for start-ups building automated financial products, fintechs, payment service providers and crypto-asset service providers. It organises dual status where one product touches both crypto-assets and payments: an AI agent often crosses these two regimes. The firm is ranked by Chambers FinTech and Leaders League (page in French), and a partner sits on the board of ADAN (Association pour le développement des actifs numériques, the French digital asset industry association), where he contributes to industry work.

A lawyer brings what a consultant cannot: the legal qualification of each function of the agent, based on a technical reading of the product, legal professional privilege over the model and the exchanges with the client, and responsibility for the advice given. The lawyer drafts the contracts and speaks to the regulators on the client’s behalf.

A partner leads every file, from the architecture review to the exchanges with the regulator.