Agentic Payments Just Got a Rulebook: Inside MAS SAFR and Visa's European Rollout

For the past year, "agentic commerce" has mostly been a promise — AI agents that shop, book, and pay on your behalf, demoed on stage and piloted behind closed doors. In July 2026, two things happened within days of each other that turned the promise into infrastructure. Singapore's central bank published the first industry framework for governing AI agents that move money, and Visa switched on live agentic transactions across Europe. The question is no longer whether an AI agent can buy something for you. It's who is accountable when it does — and both announcements are, at their core, answers to that question.

What Visa Actually Turned On

At its Payments Forum in Paris in early July, Visa announced that AI agents can now search, select, and initiate purchases on merchant websites across Europe — not in a sandbox, but live. The agents operate strictly within controls and parameters the user defines, and every transaction still requires manual human authorization before money moves.

The plumbing matters here. Authentication runs through Visa's Payment Passkeys, which tie each transaction to a verified user and their explicit instruction, so an agent can't act beyond what the human actually approved. Visa is working with more than 30 European issuers — plus merchants like lastminute.com, Frasers, and BrickDepot — and has extended its "Agentic Ready" program to the merchant side through a Trusted Agent Protocol and Agent Directory that let merchants recognize and transact with verified agents. Partnerships with Cloudflare and Akamai push those capabilities onto merchant sites at scale.

Visa Europe's Mathieu Altwegg framed it plainly: "We're now seeing AI agents buy on behalf of people directly with independent merchants. The next step is to scale this by bringing the whole ecosystem together — from standards and infrastructure to partners and enablers — with trust built in from the start."

The Missing Piece: A Runtime Rulebook

Visa built the rails. But rails alone don't answer the harder question every bank and regulator has been circling: how do you let an autonomous agent execute a financial action safely, on every single transaction, in real time? That's the gap the Monetary Authority of Singapore set out to close.

On July 3, MAS and a group of major financial institutions published Safeguards for Agentic Finance at Runtime (SAFR), an industry white paper developed through MAS's BuildFin.ai program. The co-authors read like a roll call of the people who will actually run agentic payments: Ant International, Circle, HSBC, J.P. Morgan Chase, Manulife, Mastercard, OCBC, and Visa.

SAFR's core idea is a shift in where governance happens. Most AI oversight to date has focused on the model — testing it, red-teaming it, documenting it before deployment. SAFR moves the control point to runtime: the instant an agent proposes an action, and before that action executes.

ℹ️

The key mental model: SAFR sits between the AI agent and the execution environment. It intercepts every proposed action, evaluates it deterministically against the relevant controls, and decides one of four outcomes — Deny, Escalate to a human, Auto-Execute, or Observe. The agent never talks directly to the payment rail. It talks to the guardrail.

How SAFR Works: Four Runtime Components

The framework decomposes runtime governance into four building blocks that together evaluate every agent action before it happens.

Agent Identity. Every agent has a verifiable identity, so the system knows precisely which agent is acting, on whose behalf, and with what delegated authority. Without this, accountability collapses — you can't audit an actor you can't name.

Controls Repository. A central, policy-bound store of the rules that apply — spending limits, permitted counterparties, transaction types, escalation thresholds. These are the institution's guardrails expressed as machine-readable policy rather than tribal knowledge.

Disposition Engine. The decision-maker. It takes the agent's proposed action, checks it against the Controls Repository deterministically — not with another probabilistic model that might hallucinate — and resolves it to Deny, Escalate, Auto-Execute, or Observe.

Audit Log. Every proposed action, every decision, and every rationale is recorded at the point of decision. This is what makes agentic finance defensible after the fact, both to regulators and in disputes.

Diagram of SAFR's four runtime components: Agent Identity verifies the acting agent, Controls Repository stores machine-readable rules, the Disposition Engine deterministically decides Deny, Escalate, Auto-Execute, or Observe, and the Audit Log records every action, decision, and rationale.

MAS road-tests the framework against three concrete use cases: agent-assisted payments and treasury operations, wealth management and advisory document review, and client engagement where agents draft materials within approved content boundaries. In each, the principle is the same — the agent proposes, the runtime layer disposes.

Why This Matters: The Accountability Gap

The reason regulators moved now is that the existing rulebook simply doesn't fit. As law firm Fenwick lays out in its analysis of agentic payments, the legal frameworks governing money movement were built around human-decisioned transactions. When an AI agent makes a bad payment, it's genuinely unsettled who is responsible: the user who delegated authority, the developer who built the agent, the bank or processor that made it available, or the merchant who accepted it.

Consumer protection law has the same problem. In the U.S., Regulation E hinges on whether a transfer was "authorized" or "unauthorized" — and it's unresolved whether granting an AI agent access to your account satisfies that standard, or what happens when an agent violates your instructions. SAFR's cryptographic audit trail and explicit escalation logic are, in effect, an attempt to manufacture the "demonstrable consent" that existing law demands but agentic systems don't naturally produce.

Comparison of Visa's live European agentic-payment rails and MAS SAFR's runtime rulebook, shown as complementary, with a Gartner statistic that 40% of enterprise applications will embed AI agents by the end of 2026, up from less than 5% in 2025.

⚠️

The stakes are scaling fast: Gartner projects 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from less than 5% in 2025. Every one of those agents that touches money is a potential source of unauthorized transactions, mandate violations, and disputes with no clear owner. Governance that runs after the fact — quarterly audits, post-incident reviews — is structurally too slow for actions that execute in milliseconds.

What This Means If You're Building Agentic Commerce

Separate the agent from the execution layer. The single most important architectural lesson from SAFR is that your agent should never hold the keys to the payment rail directly. Put a deterministic guardrail in between that can deny, escalate, or approve every action. This also has regulatory upside — Fenwick notes that a platform which merely executes pre-authorized, user-directed transactions looks more like a technology conduit than a regulated money transmitter.

Make consent explicit, scoped, and logged. Visa's Payment Passkeys and SAFR's audit log converge on the same requirement: capture the user's intent as a signed, specific instruction, and record the decision trail. Vague, blanket delegation is both a security risk and a legal liability.

Design for escalation, not just automation. The goal isn't to remove humans — it's to route the right decisions to them. Actions inside the mandate auto-execute; anything ambiguous or high-risk gets escalated. Build that decision boundary deliberately.

Assume interoperability is coming. Between Visa's Trusted Agent Protocol, Google's AP2, Coinbase's x402, and Stripe and Tempo's Machine Payments Protocol, the industry is converging on shared standards for agent identity and consent. Building to a proprietary island now means a costly migration later.

The Bottom Line

The most telling detail of July 2026 isn't that an AI agent bought a plane ticket in Europe. It's that a central bank and eight of the largest financial institutions in the world sat down together to write the rules for when it's allowed to. Agentic payments are moving from the "can we?" phase to the "how do we govern it?" phase — and the answer emerging on both sides of the world is the same: put a deterministic, auditable guardrail between the agent and the money, and make it decide on every single action.

For anyone building in this space, the message is clear. The winners won't be the teams with the most autonomous agents. They'll be the ones whose agents can prove, transaction by transaction, exactly what they were authorized to do and why.

Agentic Payments Just Got a Rulebook: Inside MAS SAFR and Visa's European Rollout