This post build on “Agentic payments need risk layers”, by Thanos Alevizos and Ben Miller of Agio Ratings, feature on page 16 of OMFIF’s October 2026 Digital Monetary Institute Journal.
AI payment agents could change more than how quickly money moves. By selecting payment routes, settlement assets and service providers, they could take on decisions previously made by treasury and operations teams.
For institutions, the attraction is clear, with agents being able to reduce manual intervention, execute payments outside business hours and respond to changing costs, liquidity and counterparty conditions. Combined with programmable money and continuously available settlement infrastructure, this could make payments more flexible and efficient.
But delegating these conditions requires more than instructions about price and speed. Institutions also need to specify which risks an agent may take, what information it should trust and how it should response when conditions deteriorate.
The challenge becomes more significant when many institutions delegate similar decisions to similarly configured assets.
When separate agents make the same decision
An agent can follow its institution’s instructions correctly and still contribute to a wider problem.
Suppose many agents are tasked with minimising counterparty and liquidity risk. They use similar models, monitor the same information and apply comparable thresholds. They may favour the same custodians, stablecoin issuers, exchanges and payment routes.
If adverse information appears about one provider, those agents could attempt to withdraw, redeem or reroute funds at approximately the same time. The resulting outflows may weaken liquidity and confidence, generating further warning signals and prompting more exits. Funds leaving one provider may flow rapidly to others, shifting the pressure onto them rather than removing it.
Speed amplifies the feedback loop by reducing the time available for human assessment and coordination. The underlying vulnerability, however, is correlated behaviour, and not automation alone.
An exit may protect an institution while simultaneous exits by many institutions intensify stress across the system.
What belongs in a programmable risk layer?
A programmable risk layer brings risk information and decision limits into the agent’s payment mandate. Rather than choosing a provider solely on cost, speed or availability, the agent would also assess the exposure created by that choice.
A forward-looking probability of default (PD) could be an important input. With a clear time horizon and an understanding of its limitations, it can help an agent compare issuers and counterparties, inform exposure limits and identify changes in credit risk.
PD should not be treated as a complete default risk alongside reserve quality and coverage, liquidity and redemptions capacity, settlement reliability and operational resilience. Used together, these inputs can help distinguish sustained deterioration from short-lived noise.
Concentration also needs to be assessed across the full chain. Several apparently different payment routes may depend on the same issuer, settlement institution or critical service provider. Transaction-level comparisons alone may overlook those dependencies.
The quality of the information matters as much as its availability, so agents should be able to identify a signal’s source, timestamp, confidence level and limitations. Corroboration across independent sources can help distinguish an early warning from evidence of default, redemption failure or operational disruption.
Turning risk information into controlled action
Better information is useful if an institution has decided how its agent may respond to it.
Before delegating material decisions, institutions should establish exposure and concentration limits, diversification requirements and escalation arrangements. Those controls need to recognise both individual providers and dependencies shared across providers.
Depending on the strength of the evidence and the size of the exposure, an agent could issue an alert, pause new transactions, seek confirmation, reduce exposure or escalate for human review. A full exit could remain available where pre-agreed conditions are met.
A change in PD might inform a tighter exposure limit or an escalation to huma review, but it would not automatically trigger complete liquidation.
Human oversight should also be defined before an incident occurs with routine decisions remaining automated, while material actions may require additional confirmation or allow an opportunity for intervention. The mandate should make clear who can override the agent and under what circumstances.
Institutions also need a record of why funds moved. That means retaining the relevant inputs, model version, thresholds and instructions so that a decision can be reconstructed afterwards. Using an external model or data provider does not remove the institution’s responsibility for the resulting action.
Why the system-wide view matters
Firm-level controls address what an individual agent is permitted to do. They do not, by themselves, resolve the risks created when many agents act together.
For authorities, the relevant questions therefore extend beyond individual institutions’ governance. Where are exposures concentrated? Which agents depend on common models and data sources? How much liquidity could issuers, custodians and exchanges provide during simultaneous withdrawals? Could alternative payment routes absorb redirected flows?
System-wide scenarios could examine there interactions rather than assessing each institution’s response in isolation. Monitoring movements in counterparty PDs alongside redemption flows, liquidity indicators and concentration measures could help identify emerging pressure.
Timely, consistently defined and machine-readable risk information would support both institutional decisions and supervisory monitoring. Auditable decision records would also help authorities investigate how automated responses interacted during a stress event.
Operating arrangements matter too, for example if material decisions can occur overnight and across jurisdictions, incident escalation, information-sharing and crisis coordination will need to function beyond standard banking hours.
Risk controls belong in the payment mandate
The benefit of agentic payments is the ability to make and execute decisions with less manual intervention. The challenge is to define that authority carefully.
An agent’s mandate should explain not only where funds may move, but which exposures are acceptable, what evidence justifies a change and when a person must intervene. Risk assessment should shape the decision before execution, rather than become a separate review after funds have moved.
That is the purpose of a programmable risk layer, to connect the ability to act quickly with an explicit understanding of the risks being taken.
