When the Agent Does the Shopping: Six Banks, Five Principles and Amazon's Closed Door

Three events in six weeks show where agentic commerce stands in autumn 2026. On 4 August, a US appeals court vacated the injunction Amazon had used to keep Perplexity's shopping agent off its site. On 20 September, Amazon blocked Meta's new agent Muse, twelve days after its launch. On 22 September, six banks from four continents published a joint principles paper titled "Building Trust in Agentic Commerce". A court, a retailer and six banks each answered the same question differently: who speaks for the customer when software does the shopping, and who is liable when something goes wrong?

For banks this is not a footnote from retail. They issue the card, run the account and often acquire for the merchant too. Every agent transaction passes through their systems, and every dispute lands on their desk.

What the six banks propose

ASB Bank, Bank of America, Capital One, Commonwealth Bank of Australia, ING and NatWest frame their paper as voluntary and non-binding. It prescribes no conduct, technology or timetable and endorses no provider. A follow-up paper on implementation is announced; other banks and payment institutions are invited to take part.

The paper defines agentic commerce as AI agents making or facilitating payments between a consumer and a merchant, by card, account-to-account or tokenised money, from human-in-the-loop to fully autonomous. Five principles structure the field:

• Transparency: All parties should know when an agent is involved and on whose behalf. Agents should disclose how they prioritise and decide, including sponsored options and the use of data.

• Safety: Consumers control and manage their agent's authority. Credentials and authorisations are captured securely and auditably; authentication is available to the parties who may end up liable. Disputes should be resolved fairly and efficiently, and liability should reflect where risks or errors are introduced.

• Privacy and data: Auditable records of instruction, authentication, intent, decision and outcome. Access only to the data the agent needs for its function; any further use requires consent.

• Choice: Access and choice without unreasonable restrictions, while every provider keeps the right to decide which services it supports on safety, commercial or legal grounds. The merchant of record must be clear, and consumers decide whether to share their identity.

• Interoperability: Compatibility across ecosystems from day one.

Mark Monaco, Head of Global Payments Solutions at Bank of America, names in the press release the open items plainly: identity, authorisation, fraud prevention, liability management and customer protection. An honest list: it describes what is missing, not what is solved.

The numbers behind the caution

The gap between preparation and use is wide. According to an analysis by Yahoo Finance, 89 percent of merchants are preparing for agentic commerce while roughly 3 percent of transactions involve an AI agent, and consumer trust stands at 24 percent. Other surveys paint an even more cautious picture: payments provider NMI found that only 3 percent of US adults would trust an agent to complete a purchase, and agency VML found that a third of active AI users would never let an agent buy on their behalf, as Business Model Analyst compiles. Amazon CEO Andy Jassy points out that agents still mishandle prices and product details.

Add a technical problem the principles name but do not solve: agents have no standardised identity. Five agent identity products appeared within five weeks, none compatible with the others. A NIST profile on agent interoperability is expected in the fourth quarter of 2026. Until then, "the agent should identify itself" is an intention without a protocol.

Amazon's closed door

While the banks draft rules for an open ecosystem, the largest retailer in the Western world has decided otherwise. Amazon blocks shopping agents from OpenAI, Google, Anthropic and Perplexity, and since 20 September Meta's Muse as well. Its reasoning: Muse did not identify itself as automated and could capture customer credentials. Meta counters that Muse has no visibility into passwords or payment methods. Three days later, Walmart, Best Buy, Gap and Sephora opened their stores to Muse, and Shopify switched it on for its merchants.

The conflict has an economic side. Amazon's advertising business generated 68.6 billion US dollars in 2025 and is expected to reach around 84 billion in 2026, much of it from paid placements in search results that an agent comparing on the customer's behalf never sees. But retailers without an advertising business hesitate too: Tapestry, parent of Coach and Kate Spade, lets agents browse but not buy, citing fraud and bots that fill carts without paying. eBay has banned buy-for-me agents and automated end-to-end orders without human review in its terms since 20 February. Kohl's blocks, Gap decides case by case.

The courts have drawn a first line. On 4 August, a unanimous Ninth Circuit panel held that whoever instructs an AI tool is the one accessing Amazon's computers, not the tool's maker, so a violation of the anti-hacking statute CFAA is unlikely. Amazon may still enforce its own terms of service, and the underlying case continues. For banks the direction is what counts: legally, the customer acts, even when the agent clicks.

What this means for banks

Three consequences follow, none of them confined to retail.

First, agent involvement becomes a data field banks must maintain themselves. If liability is to sit where the error was introduced, a dispute must be able to reconstruct whether a person or an agent initiated the payment, under what instruction and within what limits. The principles call for exactly this record of intent, decision and outcome. Today neither card networks nor merchants deliver that information reliably; the bank will have to create it itself.

Second, the addressee of customer communication changes. When an agent compares offers on a customer's behalf, the bank's offer reaches her software, not her. The transparency principle requires sponsored options to be disclosed; an agent that takes this seriously judges an offer by its value to the customer, not its packaging. Offers that rely on attention lose effect; offers that fit the situation gain.

Third, a new lifecycle task appears. The safety principle requires that consumers can control their agent's authority. Somewhere, the limits, permitted merchants, duration and revocation of such a mandate must be managed. The bank is an obvious place: it runs the account and authorises the payment anyway. An agent mandate would then have a lifecycle of its own: set-up, first use, ongoing monitoring, adjustment when behaviour looks unusual, termination. The same logic applies today to cards, standing orders and powers of attorney.

None of this requires fast growth; the numbers suggest a slow start. But the principles describe what the field should look like if it grows, and Amazon's block shows what it looks like when everyone builds their own door. Banks that prepare data, offer logic and mandate management now will not have to retrofit later.

Five takeaways

1. On 22 September 2026, six banks published five voluntary principles for agentic commerce: transparency, safety, privacy, choice and interoperability. An implementation paper will follow.

2. The central sentence is that liability should reflect where risks or errors are introduced. That presupposes banks documenting agent involvement, instruction and decision themselves.

3. 89 percent of merchants are preparing, roughly 3 percent of transactions involve agents, and between 3 and 24 percent of consumers trust them depending on the survey. The ramp-up will be slow.

4. Amazon blocks third-party agents while Walmart, Best Buy and Shopify open up. The appeals court treats the user as the actor, not the agent's maker; terms of service remain enforceable.

5. Three tasks emerge for banks: agent involvement as a data field, offers that hold up in front of an agent, and a lifecycle for agent mandates with limits, monitoring and revocation.

Illustration: AI-generated. AI-assisted content: We use AI technologies and automated agents in the creation of our articles, including from Microsoft, Google, OpenAI, Anthropic and other providers. Topics, editorial direction and final approval remain with our team.