Electronic Fund Transfer Act

Legal experts say AI agents conducting autonomous payments lack a reliable identity layer to establish human accountability, creating liability gaps that blockchain and zero-knowledge proofs could address. For institutional crypto investors, this suggests emerging demand for identity solutions built on public blockchains and stablecoins, but regulatory clarity on agent liability remains absent across major jurisdictions.

• BeInCrypto Research tracked 6.4 million x402 agent payments in 35 days, mostly tiny sums for data and API calls.
• The Electronic Fund Transfer Act, written in 1978, still governs unauthorized transfers but assumes human approval of every payment.
• Zero-knowledge proofs could verify human accountability behind agents without exposing the owner’s identity to merchants.

• 6.4M x402 agent payments tracked in 35 days, mostly API and data calls
• Aug 2 EU AI Act Article 50 transparency rules became enforceable across member states
• €15M or 3% of worldwide turnover, whichever is higher, maximum EU AI Act fines

AI agents already move money autonomously to pay for data, computing power, and web searches without explicit human approval for each transaction. The legal system has not caught up. According to research by BeInCrypto, the core problem is that neither U.S. nor EU law has yet assigned liability when an AI agent makes an unauthorized or incorrect payment. Legal experts convened by BeInCrypto’s Legal & Regulatory Council now argue that blockchain infrastructure, coupled with zero-knowledge cryptography, offers a workable path to establish verifiable human accountability while preserving merchant privacy.

JPMorgan blocks outside AI agents as liability rules stay silent

The volume of autonomous agent payments remains small but is growing rapidly. BeInCrypto Research documented 6.4 million x402 payments, a protocol for machine-to-machine payments, between July 23 and August 26, 2026, mostly tiny charges for API calls and data access. Banks, however, are already treating the trend as a threat.

JPMorgan has begun blocking outside AI agents from accessing customer accounts, citing the risk that a malfunctioning or compromised agent could drain a balance without human intervention.

U.S. law offers almost no guidance. The Electronic Fund Transfer Act still governs unauthorized transfers, but Congress enacted it in 1978 for a world in which a human signed off on every payment. The GENIUS Act sets rules for stablecoin issuers but contains no provisions for the agents that spend those coins. The result is legal ambiguity: if an agent books a flight to the wrong city or pays a fraudulent invoice, nobody can say with certainty whether the bank, the stablecoin issuer, the platform hosting the agent, or the user bears the loss.

Zero-knowledge proofs could prove accountability without exposing identity

Blockchain-based identity credentials could close the gap, legal experts argue, if designed carefully to balance liability with privacy. A zero-knowledge (ZK) proof is a cryptographic tool that confirms a fact, in this case, that a human is accountable for an agent’s actions, without revealing the data behind it.

Anja Blaj Zajc, a lawyer advising on AI regulation, rejects the false choice between privacy and accountability that legacy payment systems seem to impose.

You would have the ZK proof that proves that there’s indeed a human behind that agent, that there’s going to be somebody responsible for that agent.

Anja Blaj Zajc, lawyer

Liability law requires a person to hold accountable; an anonymous wallet offers none. A ZK credential can tie an agent to a responsible owner without exposing that owner to every merchant.

Vyara Savova, senior policy expert at the European Crypto Initiative, frames blockchain as solving this by bundling “the payment rails, the identification rails, basically the trust layer, all in one.” Such infrastructure would allow merchants to verify that a payment comes from a human-backed agent without learning the human’s identity.

EU AI Act demands chatbot disclosure but leaves agent payment rules unwritten

Since August 2, 2026, the EU AI Act’s Article 50 obliges providers of chatbots and virtual assistants to inform users they are dealing with an AI system, a requirement that applies regardless of risk classification and is now enforceable by national authorities.

The rule addresses disclosure, not payments. No EU or U.S. regulation yet tells a merchant how to verify that a human stands behind a paying agent or to whom liability flows if the agent errs. Lord Chris Holmes, a Conservative member of the UK House of Lords and sponsor of a private member’s bill on AI regulation, emphasizes that disclosure alone is insufficient.

“It always needs to be clear AI was used, how it was used, for what purpose, and that consent and trust and transparency were in that mix,” Holmes said. The EU AI Omnibus pushed high-risk AI deadlines to 2027 and 2028 but left the August 2 transparency duty in place, signaling that disclosure is now binding even as liability rules remain undefined.

Until lawmakers fill the gap, banks will likely keep their doors closed to outside agents. For now, ZK-based AI agent identity is the preferred technical fix among legal experts: prove that a human is accountable, and reveal nothing else. The challenge remains open, no major jurisdiction has yet drafted or proposed specific rules for agent payment liability or identity verification standards.

The CCS read. We see the gap as opportunity. Institutional stablecoin issuers and custody platforms that embed ZK-based agent identity from the outset will likely attract the first production workloads as banks begin accepting outside agents. Ethereum’s existing ZK infrastructure and emerging standards for key derivation position layer-one networks favorably against permissioned alternatives. The real constraint is regulatory, not technical.

Watch for the Consumer Bankers Association’s proposed liability framework; Kelvin Chen, the head of policy at the CBA and a former architect of the Federal Reserve’s AI governance framework, is working to close the EFTA gap before commercial pressure forces a patchwork of bank-by-bank policies. His recommendations could shape whether stablecoin rails or traditional payment networks capture agentic commerce.