The Industry Builds Its Own Regulator
Washington is currently occupied with the GENIUS Act, a framework that focuses on stablecoin issuers while leaving the mechanics of machine-initiated transactions largely untouched. As Congress stalls on the specifics of AI-driven finance, the private sector has begun to construct its own regulatory architecture. On August 4, 2026, the Secure Technology Alliance launched the Agentic Trust and Commerce Forum, a body spun out of the U.S. Payments Forum with the explicit goal of establishing the rules for a projected $300 billion U.S. market by 2030.
The timing is not coincidental. That same day, the 9th Circuit Court of Appeals issued its ruling in Amazon v. Perplexity AI, effectively classifying AI agents as browsers rather than intruders. By holding users liable for the actions of their agents under the Computer Fraud and Abuse Act, the court confirmed a significant liability vacuum. The legal system has signaled that it will treat these autonomous entities as extensions of the user, yet it offers no guidance on how to verify the intent or authorization of a machine acting in the wild.
Mapping the Liability Vacuum
The Forum’s mandate is to address four core questions that map directly to the gaps left by the 9th Circuit’s browser analogy:
- How should agent identity be established and verified?
- What data standards and interoperability principles are required for capturing intent?
- What constitutes valid consumer authorization for an agentic commerce transaction?
- How are disputes and exceptions handled when no human was at the point of transaction?
These questions represent the practical reality of agentic commerce, where the current lack of a standardized framework creates openings for fraud and systemic failure. As Itai Sela, Chair of the Secure Technology Alliance Board, noted: “We need a clearer understanding of how intent is established, how consent is conveyed and who is accountable when an AI-initiated transaction goes off course. Identity and authentication will be cornerstones in that trust equation. The Agentic Trust and Commerce Forum is designed to bring the right stakeholders into the room before fragmented approaches create new openings for fraud, disputes and liability.”
Threading the Infrastructure
The industry is not waiting for a legislative mandate to build the necessary rails. The Forum’s approach mirrors the U.S. Payments Forum’s work on the EMV migration a decade ago, which successfully reduced card-present fraud through sustained, cross-industry collaboration. Today, the infrastructure is being built in parallel across several fronts:
Visa’s $2.4 billion acquisition of BioCatch on August 3, 2026, positions behavioral biometrics as the primary trust layer for machine-initiated transactions, utilizing 3,000 data points per session to verify agent behavior. Simultaneously, Mastercard’s $1.8 billion acquisition of BVNK provides the stablecoin infrastructure necessary for these transactions to settle. This follows Mastercard’s earlier launch of Verifiable Intent, a cryptographic trust layer co-developed with Google.
At the protocol level, the x402 Foundation, launched under the Linux Foundation, is facilitating protocol-fee-free stablecoin settlement. While the x402 protocol has processed 200 million transactions, the real volume remains tiny compared to the projected $300 billion market. These efforts, alongside the EPAA’s AI & Agentic Payments Working Group in the APAC region, suggest that the industry is prioritizing interoperability over waiting for federal oversight.
The Cost of Governance
Consumer sentiment remains cautious, with only 14% of consumers currently trusting AI to execute purchases without human verification. Devon Rohrer, Managing Director of the U.S. Payments Forum, emphasized the stakes: “Agentic commerce is reaching a point where early decisions could have lasting consequences for the payments, identity and AI landscape. This is the moment to make sure the whole technological ecosystem gets the fundamentals right.”
The Forum will hold its first in-person meeting on November 17-18, 2026, at the Best Buy corporate campus in Minneapolis. Membership is open to all organizations with a stake in the ecosystem, from LLM providers to fraud prevention firms. The regulatory gap will not stay open forever. The question remains whether this industry-led agent governance will arrive in time to establish a stable foundation, or if the first catastrophic agent payment failure will force a reactive, and likely more restrictive, regulatory response.
