What happens when an AI agent sends a payment its user didn’t intend to send? Laws and industry regulations are still catching up, so for startups whose products allow agents to move money, the answer to the question “who covers the loss?” comes from two places: their agreements with banks or payments partners who actually move the money, and their Technology Errors and Omissions (Tech E&O) Insurance.
But agreements and insurance policies have existed long before agents, and banks are starting to settle the question on their own terms, namely by keeping outside agents from customers’ money entirely.
JPMorgan Is Keeping Outside AI Agents From Moving Its Customers' Money
In October 2026, JPMorgan confirmed that third-party AI agents can see retail customers’ account data, but can’t move money, pay bills, or even log in with a customer’s credentials.
As CEO Jamie Dimon explained on the bank’s earnings call, "You don't want rogue agents, and there could be thousands of them." He warned that "There's a liability transfer. [Customers] should understand the liability transfer."
No Rules Say Who Covers an Agent's Mistake
Dimon didn’t say who would pay if an agent gets a payment wrong, but neither has anyone else. Federal rules for consumer electronic transfers date back to 1978, when a human authorized every payment, and don’t address what agents can do: act on someone’s behalf and, potentially, go beyond what it was tasked to do.
So companies are beginning to come up with their own answers. In April 2026, American Express said that if a cardholder authorized an AI agent to pass along purchase instructions, the bank would “protect eligible customers from charges related to AI agent error." In October 2026 Amex also developed a framework to record what a purchaser told an agent could do before it took an action, creating a record that could be checked during disputes.
The catch is that as of October, that agent protection hasn’t been released yet.
For Startups, the Answer Is in the Agreement
The varying decisions between banks means that the agreements fintechs and other startups have in place with partner banks or payments providers are more important than ever. Those agreements are what determine what has access to money and what counts as unauthorized or erroneous. The question now is whether yours was written with an agent pressing “send” in mind.
If neither the bank nor the customer takes the financial hit of an agent’s error, there’s one party potentially left holding the bag: the one who built the agent.
Shayne Adler, co-founder and CEO of Aetos Data Consulting, says founders shouldn't assume someone else will absorb an agent's mistake. Even when the payment itself gets disputed elsewhere, the startup can still carry the costs around it: investigation, refunds, lost customers. "You can outsource the model without outsourcing the customer relationship," she says.
Four Steps to Take Before an Agent Moves Money
- Read the payment terms in your partner agreement. Look for language on erroneous and unauthorized payments, and who is ultimately responsible.
- Limit what agents are allowed to do. Cap amounts, restrict payees and timing, require approval above a set threshold, and log every action. Mercury, for example, built its banking assistant to prepare payments but "nothing ever happens without your approval."
- Keep a record of what the customer asked for. In a dispute, the question will be whether the agent did what it was told. Capturing instructions the moment they’re given is the idea behind Amex's framework.
- Check that your insurance backs your promises. If your terms of service promise to make customers whole for errors, or your partner agreement asks you to indemnify the bank, compare those commitments with your policy. It's a gap we see in conversations with founders: the commitment gets signed before anyone checks it against the coverage.
Adler suggests a company’s priority should be boundaries the AI can't change, enforced by the system rather than left to the model to interpret. "Telling an agent 'don't spend more than $500' is not the same as making it unable to do so," she says.
How Tech E&O Handles an Agent's Payment Error
If your product makes a payment error that costs a customer money, that's potentially a Tech E&O claim. But some Tech E&O policies weren't written with AI in mind, and a mistake caused by the model might not be clearly covered unless the policy includes affirmative AI language.
When founders building AI into their products ask us who's responsible if the model gets it wrong, the answer often turns on whose system the error started in: yours, or the vendor model underneath it.
For companies that move money, keeping Cyber and Tech E&O on the same policy avoids two insurers pointing at each other after an incident. It’s also worth looking into how social engineering coverage is written. Coverage that responds when someone tricks a company into sending money is often a sublimit inside a larger Crime or Cyber policy. It's typically described as deceptive communications leading to a transfer, like someone impersonating a vendor or an executive. If someone could manipulate an agent into sending funds, ask whether that wording would apply.
Build the Guardrails Before the Rules Arrive
The rules for agent payments are still being written by banks, card companies and industry groups, so the easiest way to move forward is to be smart and safe: be clear about what agents are allowed to do, and keep a record of what the customer asked for.
A startup that limits its agent's authority, knows what its partner agreement says about agent-initiated payments, and carries coverage that matches its promises won't need to rebuild when those rules arrive.
Vouch Specialty Insurance Services, LLC (CA License #6004944) is a licensed insurance producer in states where it conducts business. A complete list of state licenses is available at vouch.us/legal/licenses. Insurance products are underwritten by various insurance carriers, not by Vouch. This material is for informational purposes only and does not create a binding contract or alter policy terms. Coverage availability, terms, and conditions vary by state and are subject to underwriting review and approval.
.avif)
