By PYMNTS | August 21, 2026
The global financial landscape is approaching a fundamental inflection point. For decades, the payment industry has operated on a human-centric model: a consumer selects a product, initiates a checkout, and authenticates the transaction. However, the rise of generative artificial intelligence is shifting this paradigm. As AI evolves from a research tool into an autonomous purchasing agent, financial institutions are being forced to rebuild their underlying infrastructure to support transactions initiated not by people, but by software.
Caio Reis, vice president of strategy at Thales, notes that this transition—often termed "identity commerce"—is no longer a futuristic concept but an impending reality. Banks that fail to adapt their payment architectures to accommodate software-initiated transactions risk obsolescence as the digital economy shifts toward an era of machine-to-machine financial interactions.
Main Facts: The Shift to Machine-Led Payments
At its core, the transformation involves a transition from manual verification to automated, secure, and authenticated machine transactions. While consumers currently use AI to compare prices or browse inventories, the next phase of development will see these AI agents given the agency to execute payments independently.
This shift presents a massive technical challenge for card issuers and banks. Traditional authentication protocols—such as one-time passcodes or biometric prompts—are designed for human users. When a software agent initiates a purchase, these methods become friction points. Consequently, issuers must move toward a model of continuous, invisible authentication.
Key pillars of this new infrastructure include:
- Payment Passkeys: Replacing traditional passwords with cryptographically secure, device-bound credentials.
- Passwordless Authentication: Utilizing FIDO-compliant protocols to ensure the software agent is authorized to act on behalf of the consumer.
- Dynamic Tokenization: Ensuring that the sensitive payment credentials remain abstracted and secure, even when interacting with third-party AI agents.
According to Reis, the window for banks to prepare for this "identity commerce" environment is narrow—roughly 18 to 24 months. Institutions that do not begin aligning their partnerships and technology stacks now will likely find themselves unable to participate in the burgeoning ecosystem of autonomous commerce.
Chronology: From Static Browsing to Autonomous Buying
The evolution toward autonomous payments has been a gradual process of digitization that is now accelerating into a phase of "intelligent automation."
- Phase 1: Digitization (2010–2018): The move from physical point-of-sale terminals to e-commerce. Authentication was largely static, relying on CVV codes and simple address verification.
- Phase 2: Mobile and Frictionless (2019–2023): The proliferation of digital wallets and biometric authentication (FaceID, fingerprint) transformed mobile payments. Tokenization became the industry standard for securing transactions.
- Phase 3: The Generative AI Catalyst (2024–2025): The widespread adoption of LLMs and generative AI tools allowed consumers to outsource research and comparison shopping. However, the final "buy" button remained under human control.
- Phase 4: Autonomous Purchasing (2026 and beyond): We are currently entering the era where AI agents are granted "wallets" or spending permissions. These agents can now autonomously navigate to a checkout page, populate payment credentials, and complete the transaction without human intervention.
This chronology underscores the urgency expressed by industry experts. As the technology matures, the "human-in-the-loop" requirement becomes a competitive disadvantage, leading banks to search for ways to automate the security and validation layer of the transaction process.
Supporting Data and Modernization Realities
For many financial institutions, the biggest hurdle to adopting this new architecture is "technical debt." A common trap in the industry is the "lift and shift" approach—moving legacy mainframe systems to the cloud without fundamentally changing the application architecture.
The Myth of "Lift and Shift"
Reis warns that simply moving legacy systems to the cloud does not equate to modernization. While this strategy might result in lower hosting costs, it preserves the underlying inefficiencies of the old architecture. The limitations—such as slow software release cycles, rigid database schemas, and inability to integrate with third-party APIs—remain intact.
Data from the financial sector suggests that "true" modernization requires:
- Agile Release Cycles: Moving from bi-annual releases to weekly or even daily deployments.
- API-First Design: Ensuring that the banking core is modular, allowing for seamless connection with AI agents and other fintech service providers.
- Decoupling Front-End and Back-End: Separating the customer-facing experience from the legacy back-end allows banks to iterate on the user interface and payment flows without the high risk of touching the entire core database.
By adopting a decoupled architecture, banks can modernize specific use cases—such as enabling AI-based recurring payments or autonomous subscription management—while maintaining the stability of their foundational legacy systems.
Official Perspectives: Navigating Integration Risks
The path to modernization is fraught with risk, primarily due to integration complexity. When a bank attempts to bolt modern AI-readiness onto a dense, decades-old legacy environment, the risk of failure increases exponentially.
"Banks should also manage migration risk," says Reis. "A complete replacement may be necessary in some circumstances, while other institutions can migrate individual portfolios over several years."
The strategic approach recommended by Thales is to treat modernization as a competitive necessity rather than a cost-reduction exercise. In the past, IT departments were measured by their ability to maintain uptime and minimize costs. Today, the focus must shift toward "time-to-market." If a competitor enables AI-agent payments before an incumbent bank, the incumbent will quickly lose market share among tech-savvy consumers who prioritize convenience.
Furthermore, banks must be wary of "feature bloat." Often, institutions carry legacy product variations and internal decision-making processes that are no longer relevant. Modernization is the perfect time to prune these systems. Simplification of products and internal decision-making processes is just as critical as the hardware and software upgrades.
Implications: The Future of Identity Commerce
The shift toward autonomous, AI-driven purchasing has profound implications for the future of the banking industry.
1. The Death of the Traditional "Cardholder" Identity
In an autonomous world, the "identity" of the purchaser is no longer just the human. It is a composite of the human user, the specific AI agent they have authorized, and the device or environment in which the agent resides. Issuers will need to develop sophisticated "identity commerce" frameworks that can verify the authenticity of an AI agent’s request without requiring a human to manually enter a code.
2. A New Competitive Landscape
Neobanks and agile fintechs are often built with cloud-native, API-first architectures. They are naturally positioned to adapt to AI-driven purchasing faster than legacy Tier-1 banks. This creates a risk where traditional banks could be relegated to "dumb pipes" that hold the capital, while the interface and the transaction intelligence move to fintech partners or AI platform providers.
3. Redefining Trust
Trust will become the primary product. As AI agents handle more financial tasks, the ability for an issuer to prove that a transaction was indeed initiated by an authorized AI agent—and not a malicious actor posing as one—will become a critical service. This will elevate the role of tokenization and digital identity services to the center of the financial universe.
4. The Need for Regulatory Flexibility
As AI purchasing gains traction, regulators will inevitably look to ensure that these autonomous transactions do not lead to consumer harm. Banks will need to be prepared to demonstrate that their AI-driven payment pathways are secure, transparent, and compliant with existing consumer protection laws, even as the mechanics of the purchase evolve.
Conclusion
The transition to autonomous commerce is not a distant possibility; it is a current reality. The integration of AI into the purchasing flow represents the most significant shift in payment processing since the advent of the internet.
For banks, the mandate is clear: the architecture of the past cannot sustain the commerce of the future. By moving away from "lift and shift" migrations and toward modular, cloud-native infrastructures that prioritize identity commerce and seamless authentication, institutions can ensure they remain at the center of the financial experience. The race is on, and the next 18 to 24 months will likely define which banks lead the next era of global finance and which are left struggling to catch up with the speed of software.
