Agentic Commerce (A-Commerce) Do Not Work Without Agent Identities

Forbes

24-05-2025

Audience at the Featured Session "The Auto-Evolving Business: AI's Agentic Near Future" during SXSW ... More Conference & Festivals at the Austin Convention Center on March 10, 2025 in Austin, Texas. (Photo by Diego Donamaria/SXSW Conference & Festivals via Getty Images)
We all know that agentic commerce is coming at us quickly and agentic commerce will of course mean that agentic finance is inevitable. The smart money is already looking in this direction. For example: Catena Labs has announced an $18 million financing round led by a16z crypto and its plan to establish the first fully regulated AI-native financial institution designed to serve the unique needs of the emerging AI economy. In my view, initiatives like this make agent identities a priority for fintechs.
Catena's Sean Neville, who previously co-founded Circle and invented the USDC stablecoin, says that shortcomings in legacy systems make them poorly suited to the needs of agentic commerce and he specifically notes the inability to handle agent identity as a key issue.
I have to say I agree with him wholeheartedly about this, and also see his view that agents will soon conduct 'most' economic transactions as far from hyperbolic. And I am not the only one. Craig De Witt, from Skyfire (who are building agent-agent infrastructure) makes a similar point: 'AI has payment and identity requirements that are different from anything we've seen before". He goes to talk about the paradigm shift here, meaning that we are looking at an entirely new approach to how agents will access and pay for services.
That point about the digital identity of agents is, I think, central to developing a functioning agentic finance ecosystem. Ravi Loganathan from Sardine summarises some of the problems, asking
The race is on to solve these problems as agentic commerce heads to the mainstream, for the obvious reason that if they are not addressed then our commerce infrastructure will be vulernable to agentic fraud on overwhelming scale and trying to fight it using the techniques of a previous era will be like cavalry charges against tanks. Or, for that matter, tanks against drones.
Robot wars redux.
Earlier this year, payments guru Tom Noyes wrote that identity and authorization will be key to to agentic commerce, with digital wallets as the means for organising and permissioning agent actions, and highlighted the key role of the payment networks in the mainsteam. Well, in the space of a few days last month, Visa launched "Visa Intelligent Commerce', Mastercard launched 'Agentic Tokens' and PayPal launched the 'PayPal Agent Toolkit', all with the general purpose of giving AI agents the ability to pay for purchases and bookings on behalf of consumers. That point about granular access is at the heart of these announcements. They will offer agents payment tokens (rather like the tokens in you xPay wallet) that have tight restrictions so that your agent can only use them in certain merchant categories and with certain payment limits (eg, a token that can be used for travel but only up to $1000 per month, or whatever).
(PayPal in fact went even further. At its 2025 Dev Days event, the company announced not only a toolkit for AI agents but a Financial Operating System Financial OS tailored specifically for those agents—autonomous software that can browse, buy, negotiate, refund, and optimize transactions for users—to meet the needs of a future described by Jeremiah Owyang, partner at Blitzscaling Ventures, as a world run by AI agents in which websites may become obsolete and where 'the interfaces of the future are conversations, not clicks.')
I see these initiatives as starting points rather than complete solutions. In time, we need a more comprehensive infrastructure to deliver safe and secure agentic commerce. One way to think about this is in terms of the necessary Digital Public Infrastructure (DPI) for the new world of agents.
You are almost certainly familiar with the concept of DPI and the link between an effective DPI and the wider economy, but if not, a quick primer: The World Bank identifies DPI's core functions as digital identity, digital payments and data sharing. These essential features support more efficient public and private-sector applications to improve outcomes for citizens (across health, social welfare, financial services, business and beyond). The International Monetary Fund (IMF) say that DPI has the potential to support the transformation of the economy and support inclusive growth. They highlight the particular example of India's foundational DPI, the so-called "India Stack' , and show how it has been harnessed to foster innovation and competition, boost financial inclusion and improve government revenue collection.
Payments are an easy place to start. I've written before that with AI systems becoming increasingly agentic business-to-robot-to-consumer (B2R2C) commerce about to explode, and it is a natural evolution for AIs to become economic actors in their own right and to exchange value in return for services. Bots paying other bots are a new frontier for the payments industry that needs new rails.
Data exchange is desirable because among other things to do with productivity and efficiency, in the finance sector it is vital as (to use McKinseys framing) "a critical enabler of financial inclusion'. Open financial data can create economic value by benefiting financial institutions, individuals and businesses in many ways. For example, open data sharing can enable customers (or, more likely, customers' agents') to buy and use financial services they might not be able to otherwise access.
The future economy, however, is about agents as much as it is about businesses and consumers (the ABCs, if you like) and these will need a DPI that satisfies their needs. That is, AIs will need DPI too. So what will it look like? Let's focus on the digital identity element of an AI DPI to see what it might look like.
Clearly, unless we do something about the digital of identity of agents, agentic finance will bring agentic fraud (just as instant payments brought instant fraud). Jelena Hoffart of Mastercard and I have written a paper about this 'know your agent' (KYA) problem for a forthcoming Journal of Digital Banking in which we identify the need for digital identity for agents as a fundamental enabler for agents to access financial services on behalf of individuals or organisations (or, indeed, themselves) to create a new financial environment able to generate better outcomes for consumers and businesses.
To deliver on this vision of agentic finance as a means to improve financial health for all, we must therefore begin with a digital identity infrastructure that can provide identification, authentication and authorisation for not only financial institutions and their customers, but also their agents. In that environment, Know-your-customer (KYC) is necessary as know-your-business (KYB) and know-your-employee (KYE). But without know-your-agent (KYA) there will be no progress.
Addressing these issues begins with verifiable credentials (VCs) and claims that provide granular access to, for example, the payments system. Some commentators see this in terms of granting agents access to the VCs of individuals and organisations in order to act on their behalf but that's not quite right. We don't want AIs to present our credentials, we want AIs to present their own credentials in order to obtain claims that we have consented to authorise. In other words, my bot shouldn't show up at a bank pretending to me: it should show up at a bank as a bot acting on my behalf.
As I said at the start, the smart money is moving in. Persona, the verified identify platform used by a host of fintechs (including Robinhood, Brex and OpenAI) has raised $200 million at a $2 billion valuation. The company says that rise of AI agents, increasingly sophisticated AI-driven fraud, regulatory fragmentation, and growing privacy expectations have created a far more complex — and constantly evolving — identity landscape. As Rick Song, CEO of Persona, puts it 'Identity in an AI-driven world isn't about ticking a box, and the question is no longer 'is this a bot or not?' but rather 'who is the bot acting on behalf of, and what is their intent?''.
Indeed. This is how agentic commerce and agentic finance should work, and extending DPI to agent identities give us the right framework for ensuring that they do.