Two developments landed within days of each other and together they tell you where agentic finance actually stands: not at the threshold of autonomy, but at the threshold of permission. Mastercard opened early access to a programme letting AI agents make payments within a fixed budget. Reuters reported that major US banks are doing the opposite - blocking third-party AI agents from touching customer accounts at all. Both reactions make sense. The question underneath them is who gets to decide what software is allowed to do with someone else's money.
A Bounded Demonstration, Not a Commercial Product
On 20 October, Mastercard opened early access to Agent Pay for Machines, following pilots that involved Coinbase, Base, Cloudflare and other partners. The demonstration had an AI agent making nine payments to two providers, all within a budget a business had pre-approved. That's a narrow use case, deliberately so. The agent wasn't deciding how much to spend or where; it was executing within a boundary someone else set. Developer tools for testing are now available. A commercial service is not - and that distinction matters more than the headline suggests.
The appeal for businesses is straightforward: less manual work handling recurring purchases, with spending caps enforced automatically rather than policed after the fact. The harder question is what happens when the task moves from paying a vendor invoice to something closer to capital allocation - a subscription, a distribution, a treasury transfer. Authority to pay for a software service does not translate into authority to invest in a security. Each activity needs its own mandate, its own eligibility check, its own approval trail.
Why Banks Are Drawing the Line at Account Access
Reuters reported on 22 October, with coverage updated the next day, that major US banks were blocking third-party AI agents from operating customer accounts and initiating transactions. The reporting is careful to separate two different scenarios: customers handing over their own login credentials to an agent, versus claims that an agent acted beyond what it was instructed to do. Neither scenario means every bank named has already dealt with a rogue agent. It means the industry is moving to close a gap before it becomes a liability problem.
The real distinction is between access to information and authority to act. Reading a balance is not the same as moving funds, buying an investment, or committing someone to a financial obligation - and treating them as equivalent is how account security breaks down. For banks, the practical question is whether an agent can identify itself, prove its mandate and operate through an approved connection without ever touching a customer's password. Who answers for it if the agent exceeds its authority or executes a payment incorrectly is a question still being worked out.
Tokenised Deposits and the Infrastructure Question
SoFi announced SoFi Earn on 22 October, a tokenised deposit representing dollars held at SoFi Bank, launched with a variable 4.40% APY and FDIC insurance subject to the usual limits. Customers can convert it 1:1 into SoFiUSD, a separate stablecoin, to buy crypto or move funds across supported blockchain networks. The two products are not interchangeable in terms of protection - the deposit insurance that applies to SOFIE should not be assumed to follow the money once it's converted. That's a distinction worth sitting with before any institution gets excited about frictionless movement between cash and crypto.
Regulators are building the scaffolding around all of this in parallel. The OCC finalized its GENIUS Act rule for payment stablecoin issuers on 21 October, covering reserve backing, redemption and risk management, with the rule taking effect 18 January 2027. The SEC's Division of Examinations named tokenisation a fiscal 2027 priority for clearing-agency reviews. In Europe, ESMA chair Verena Ross has floated an optional pan-EU regime for tokenised markets - a proposal, not a rule, with a workshop scheduled for 28 October to work through settlement and interoperability questions.
What Institutions Should Actually Be Watching
- Whether agents can prove a mandate without relying on shared passwords or static credentials
- Where responsibility sits when an agent exceeds its authorized scope
- Whether tokenised deposits and payment stablecoins carry genuinely different protections - and whether customers understand which one they're holding
- Whether cross-border tokenised instruments require rebuilding onboarding and eligibility checks at every new venue
None of this adds up to agentic finance arriving fully formed. It adds up to infrastructure being tested in public, one bounded pilot and one blocked access request at a time. The test over the next year won't be whether software can initiate a payment - it already can. It will be whether institutions can show, transaction by transaction, exactly who authorized it.
