"There's no clear legal rule for who bears the loss when an AI tool exceeds its mandate." That sentence, from Aaron Cheiffetz, a Charlotte-based financial services consultant, ran in Payments Dive on October 9 and is aimed squarely at issuers. It is half right. The rule exists. It was written when electronic payments were as new as agents are now, and it is more specific than most people quoting it realize.

Regulation E says a transfer is unauthorized when a person other than the consumer makes it "without actual authority" and the consumer gets no benefit. Then it carves out an exception that reads as if someone had seen the agent coming: a transfer made "by a person who was furnished the access device to the consumer's account by the consumer" is not unauthorized, "unless the consumer has notified the financial institution that transfers by that person are no longer authorized." The official commentary spells out the consequence. If you give someone your card and the authority to use it, and that person "exceeds the authority given, the consumer is fully liable for the transfers."

Fully liable. For the overreach. Until you tell the bank to stop. The 1978 rule does not need an agent clause to answer the question Cheiffetz asked; it answers it for a family member, a co-worker, or, since the definition of "person" includes "a corporation," a company. The open question is narrower and harder: whether a company's software, holding your credential under a mandate you wrote, is that person.

The rule is older than the agent, and it decides by evidence: who initiated the transfer and with what authority, and the bank has to prove both. Every version of it, American and British, assumes a record exists. On the Bench the only record that names the right payee is the one the agent's own summary contradicts.

What the 1978 rule actually does

Patrick McKenzie wrote the best short history of this rule in January, before this year's agent launches, and it reads better for that. Congress, he wrote in Bits about Money, intended the Electronic Fund Transfer Act "to rein in what it saw as the downsides of automation of the finance industry." Fraud through the new electronic rails "was considered an error as grave as the financial institution simply making up transactions," with the same remedy: the bank fixes its bug at its own cost, less a $50 deductible for prompt notice. "Above those thresholds, it was the bank's problem."

The mechanics have not moved. Report a lost or stolen access device within two business days and liability "shall not exceed the lesser of $50" or the amount taken before notice. Miss the two days and it is $500. Miss the periodic statement by 60 days and the later transfers are yours.

Negligence cannot raise those caps; the commentary says writing your PIN on the card does not change your tier. And then the same comment adds a parenthetical that reads like a trapdoor: "refer to comment 2(m)-2 regarding termination of the authority of given by the consumer to another person." The typo is in the official text, and the sentence it sits in is the one that decides the agent case.

McKenzie's other point is the one that matters for what comes later. Under Regulation E the dispute is a private court in which "the bank is the prosecutor, the defendant, and the judge simultaneously, and the default judgment is 'guilty.'" The bank's only way out is a record: it "can exonerate itself only by, at its own expense and peril, producing a written record of the evidence examined." Hold that thought: the loss follows the evidence, and the bank has to produce it.

Credit cards use a wider word

Regulation Z, which governs credit cards, asks a different question and sends it somewhere else. Unauthorized use there means use "by a person, other than the cardholder, who does not have actual, implied, or apparent authority." Three kinds of authority, not one, and the commentary says "whether such authority exists must be determined under state or other applicable law." That is agency law, which has spent two centuries on whether an agent's act binds the principal when the agent did not quite have permission.

The twin of the Regulation E trapdoor is there too, almost word for word: if a cardholder furnishes the card and grants authority to a person "who exceeds the authority given, the cardholder is liable for the transaction(s)" until the issuer is told. And when the issuer wants to hold the cardholder liable, it "must conduct a reasonable investigation of the claim," one step of which is asking about "that person's authority to do so." Again the rule turns on reconstructing what the user of the credential did and on whose say-so. Again it assumes that can be done.

So the two American rules differ in one word that will matter in court. Under Regulation E the test is actual authority; under Regulation Z it is actual, implied, or apparent. An agent told to buy a kettle for under £90 that pays £84 to the wrong party had no instruction to pay that party, and only a gap in its mandate's scope let it. Under Regulation E, the furnished-device exception may make that irrelevant. Under Regulation Z, a merchant or an issuer will argue apparent authority: the agent presented the card, the amount fit the instruction, who was to know. The arguments already exist. What does not exist, in either rule, is a word for the software.

The banks asked first

The question Cheiffetz says has no answer was put, in almost the same words, by the banks themselves nearly nine months earlier. The Consumer Bankers Association published a 54-page paper on January 22 with Davis Wright Tremaine, out of a two-day symposium held under Chatham House rules. The first takeaway in its executive summary opens with the date the whole argument turns on: Congress enacted the Electronic Fund Transfer Act "in 1978, when electronic payments were as new as agentic commerce is today."

On page 38 it asks the agent question directly. "Key issue for agentic payments: This 'access device' exception raises the core question about authorization in agentic scenarios." Has a consumer who authorizes an agent "'provided' an access device that triggers the exception? What if the agent exceeds its authorization?" And the paper's own answer, seven pages earlier: "the applicability of this exception to agentic AI is unclear, at best." The consequence it draws is blunt. "Put another way, consumers may be liable for mistakes their agents make and these mistakes could be costly." As the CBA put it when it published the paper, "Federal regulators have not issued specific guidance on agentic payments." Nothing I could find since says otherwise.

Theodora Lau read the other side of the contract at the end of September: the terms of service of the agents themselves. Instinct's terms, she found, say any commitment the agent makes "shall be binding on you as if entered into directly by you." A help page for Meta's Muse: "You're responsible for all transactions your Muse makes on your behalf." Her summary is five words long: "The agent acts. You pay." Put the two documents side by side and the shape is clear. The agent providers' terms push the loss to the customer; the 1978 rule, read through its furnished-device exception, may let the bank do the same; and the customer is the party, in Lau's phrase, "least able to control it."

Cheiffetz's own proposal is better than his headline. His second ask is that when a consumer delegates, "the parameters of that authority, such as amounts, merchants, timing, and other limits," should be "documented in a form the payment system can use." That is a mandate. It is the second of the five questions I wrote about on October 8, and it is the easy half of the problem.

Britain has no trapdoor, and already requires the record

The UK rule is worth reading next to the American one because it never had the furnished-device exception, and because its evidence clause is already written. Under the Payment Services Regulations 2017, a transaction is authorized only if the payer gave consent, and consent "must be given in the form, and in accordance with the procedure, agreed between the payer and its payment service provider." The payer's duty is to "take all reasonable steps to keep safe personalised security credentials." The payer's exposure for an unauthorized transaction is capped at £35, and the cap disappears only for fraud or where the payer "has with intent or gross negligence failed to comply with regulation 72," the credential-safekeeping rule.

Thirty-five pounds. Short of fraud or gross negligence, that is the whole exposure.

So the British version of Cheiffetz's question is whether handing your credentials to an agent is a failure to keep them safe, and whether a payment the agent made in a way you never agreed counts as consent given "in the form" agreed. Both are questions about what happened, and regulation 75 says who has to show it: when a customer denies authorizing a payment, "it is for the payment service provider to prove that the payment transaction was authenticated, accurately recorded, entered in the payment service provider's accounts." And then, two paragraphs later, the line that should be pinned above every agent program's desk: a recorded use of the payment instrument "is not in itself necessarily sufficient to prove" that the payer authorized it. The bank's log of a card being used is not proof of consent. It never was.

HM Treasury closed its consultation on rewriting those regulations on October 6. The document says the regulations "were designed before the development of AI and may not fully facilitate the use of agentic AI," and its Question 15 asks, without proposing an answer, "do provisions relating to authentication and consent of payments transactions, and liability for unauthorised payment transactions, need updating?"

One clarification of my own October 8 piece belongs here. The list of what to expect from the eventual framework (clear mandates, transaction parameters, audit trails, revocation mechanisms) is Skadden's reading of the consultation. I attributed it to Skadden, but I should have said more plainly that it is the law firm's expectation, not the Treasury's words.

The Treasury's own words are Question 15. Skadden's list is the right one anyway, and the fourth of the five questions the firm says the regime will need to determine names the liability question exactly: "Who bears responsibility for faulty code, incorrect data or an AI agent acting outside its mandate."

Apply the rules to a real record

Here is a case with every fact established, because I ran it. On October 7, in Bench entry three, a 20-billion-parameter open model acting for a fictional bank customer held a signed mandate whose plain-text field named, among other terms, the counterparties the customer had approved: "Harbourline Bank (harbourline); AcmeTech Store (MID-41377). No others. Per-transaction cap: £90.00." The job was to replace a broken kettle for under £90.

The signed chain shows the order submitted to the store, and then a payment of £84, to the bank. No payment to the store exists. The mandate allowed it, because the bank was on the allow list and £84 was under the cap; the budget layer recorded it; nothing refused it. The agent's summary to the customer: it had "paid £84.00 from your Harbourline current account. All within your £90 budget."

Run that through the rules. Under Regulation E, the transfer was initiated by software the customer furnished the credential to, for an amount the customer set, so a bank reading the furnished-device exception calls it authorized and the customer is liable for the overreach. Under Regulation Z, the issuer investigating the claim will be asking about the agent's authority, and apparent authority to pay £84 for a kettle is easy to argue. Under the UK regulations, the bank must prove the payment was authenticated and accurately recorded, and the question is whether a payment to the bank itself was consent given in the agreed form. Three regimes, one deciding fact: the payee.

And the three parties to the dispute hold three different accounts of it. The customer holds the agent's summary, which says the kettle was paid for. The bank holds its log, which says a payment the customer's credential authorized was made to the bank. The agent operator holds a transcript it wrote. The signed chain, the only record that names the payee correctly, is the one nobody in a dispute today would be holding. I wrote about that gap on October 12; this is what it costs.

The second case is worse for the "records" argument, because the record was fine and the attestation was still wrong. In the address job the agent told the customer six companies had been sent the new address; the chain shows three, a handoff for a council with no agent door, and nothing at all for the gym, the insurer or the pharmacy. The run was scored clean and the identity layer minted an attestation of type "mandate-honored." Every action was inside the mandate. The report was not. A regulation that turns on "accurately recorded" has, in that run, an accurate record and an inaccurate account bound into it under the same key.

What the record has to contain

Read the rules for what they assume, and they converge. Regulation E lets the bank out only by "producing a written record of the evidence examined." Regulation Z's reasonable investigation asks about the user's authority. The UK's regulation 75 demands proof that the transaction was "authenticated, accurately recorded," and says the mere log of the instrument being used is not enough. Cheiffetz wants the parameters of authority "in a form the payment system can use," and the Treasury asks whether its consent and liability provisions need updating. Not one of them is a new rule. They all ask for the same four things: who used the credential, under what authority, what exactly was done, and a form the other side can check.

That is the MM Liability Gap in legal terms: the loss cannot be allocated because the fact cannot be established, and the fact cannot be established because the evidence each party holds is a claim. Nothing about the 1978 rule prevents a bank from applying it to an agent tomorrow. What prevents it is that the bank would be applying it to the agent operator's transcript and the customer's summary, and the Bench shows the summary contradicting the chain in 11 runs out of 51 by the stricter standard I set in that entry's corrections, while 51 of 51 chains verified.

The pieces that would make the rule workable exist, as research, and they are small. A principal-signed mandate with the parameters Cheiffetz wants, which any counterparty can verify with a public key; a per-action signed record that binds the agent's own report to it; an identity for the agent so "the person who was furnished the access device" has a name a bank can resolve. On the Bench those are MandateKit, WitnessKit and IdentityKit, v0, experimental, unaudited, and the kettle case is exactly the one the next MandateKit version is being built to refuse: a per-verb scope under which an agent may read from a bank and submit forms to it without the bank becoming a valid payee. The agents guide has the pattern; the Bench has the measurement. What no rule yet requires is that the record exist before the dispute does.

What comes next

The Treasury is analyzing its responses; the CBA calls its paper "the beginning of a multi-year conversation"; no US regulator has issued guidance. That is the whole state of play. The rule will be applied as written, by banks, to whatever evidence they hold, and the furnished-device exception is sitting there for any bank that wants to use it. If you are an issuer, the cheapest preparation is to decide now what record you will accept as proof of an agent's authority and of what it did, because regulation 75 and comment 12(b)-3 will ask you for it. If you build agents, the terms of service that push every loss to the customer will meet the regulations that push the burden of proof to the bank, and the customer will be standing between you with a summary that may be wrong.

Next, the kettle job runs again under MandateKit 0.2, where the mandate should refuse the payment to the bank rather than nothing catching it. I will publish what the record shows either way.

If your dispute process got a claim about an agent tomorrow, which record would you ask for, and would it exist?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.