What happened
- On September 22, 2026, six banks — NatWest, Bank of America, ING, Capital One, New Zealand’s ASB and the Commonwealth Bank of Australia — published a joint document of principles for commerce carried out by AI agents, released by each bank in its own newsroom.
- The text sets out five principles: transparency, security, privacy and data protection, consumer choice and interoperability. The first requires telling the shopper every time an agent takes part in the transaction.
- The document warns that shopping agents create risks of scams, fraud and privacy breaches, and that the technology is moving faster than industry standards and consumer protections.
- The risks it lists are concrete: agents that collect card data and send it to third-party sites, agents that favor payment methods with less protection, actors impersonating agents or merchants, and unassigned liability when something goes wrong.
Why it matters
- Mandatory disclosure is an obligation for the merchant, not the bank. Any online store in the region that accepts automated traffic today would have to distinguish it, log it and declare it: that’s integration work, not a settings checkbox.
- The John Lewis figure accompanying the document — agent searches went from 0.3% to 2.5% of total traffic in a year — explains the urgency. An eightfold increase in twelve months leaves little room to wait for a rule.
- With liability unassigned, the cost of a botched charge falls by default on the seller. It’s worth reviewing contracts with payment gateways before the point gets settled by the facts.
The number
2.5% of John Lewis’s total traffic comes from searches made by agents, versus 0.3% a year earlier. It’s the measurement the banks use to argue for urgency.
Context
Agent identity verification was already moving on the payment networks’ side: Visa, Mastercard and Ant started verifying agents jointly, though only in Singapore. And we noted the underlying shift in August, when software started behaving like a buyer.
What’s next
- No timelines announced: the principles aren’t binding and no regulator has taken them up yet.
- The signatory banks operate in six different markets, which points to uneven national rules before any single standard.
Bottom line
The survey the banks themselves cite says barely one in four U.S. consumers would fully trust an AI to shop and pay. Merchants are already receiving that traffic anyway.
Sources
- ING — As AI starts shopping, who stays in control? (includes the principles document)
- Quartz — Major banks warned AI shopping agents are outpacing consumer fraud protections
Edited by Rodrigo Cornejo. How we select and verify each fact is explained in who writes these notes.
