AI agents already execute payments for data, computing power, and web services independently. However, existing financial law assumes a human authorizes every transaction, creating a gap that sits at the center of the AI agent identity debate.
The market is emerging rapidly. BeInCrypto Intelligence tracked 6.4 million x402 payments over 35 days, mostly small sums for data and API calls. Banks remain cautious: JPMorgan blocks outside AI agents from customer accounts, citing the risk of rogue agents.
Legal Framework Lags Behind Technology
US law offers minimal guidance on autonomous payments. The Electronic Fund Transfer Act, written in 1978, still governs unauthorized transfers but assumes human authorization for each transaction. The GENIUS Act sets rules for stablecoin issuers but does not address the agents that spend those coins.
This creates fundamental uncertainty: if an agent books the wrong flight or makes an erroneous purchase, it remains unclear who bears financial responsibility. The question encompasses both AI agent identity and legal liability.
Blockchain and Zero-Knowledge Proofs as a Solution
Vyara Savova, a senior policy expert at the European Crypto Initiative, expects most people to use agents for routine payment tasks. She argues that blockchain can provide the missing layer: payment infrastructure, identification systems, and trust mechanisms in one integrated system.
Lawyer Anja Blaj Zajc proposes using zero-knowledge proofs to address privacy concerns without sacrificing accountability. A zero-knowledge proof confirms a fact without revealing underlying data. Applied to AI agents, such a proof could establish that a human is responsible for an agent's actions without exposing the owner's identity to every merchant.
This approach carries legal significance. Liability law requires identifying a person to hold accountable, and anonymous wallets provide none. A zero-knowledge credential could link an agent to a responsible owner while preserving privacy.
Regulatory Requirements Growing
Disclosure requirements are already advancing in Europe. Since August 2, 2026, Article 50 of the EU AI Act requires chatbot providers to inform users they are interacting with an AI system. National authorities can enforce this rule, and the AI Omnibus left this requirement in place even while pushing other high-risk deadlines to 2027 and 2028.
However, the AI Act covers disclosure, not payments. No EU or US regulation currently instructs merchants how to verify the human accountable for a paying agent.
Until lawmakers address this gap, banks are likely to maintain restrictions on outside agents accessing customer accounts. For now, zero-knowledge-based AI agent identity remains the preferred approach among legal experts: demonstrate human accountability while revealing nothing else.
