Subscribe
Share
Share
Embed
Welcome to The Payment Expert weekly podcast, brought to you by SBC Media. Each week we analyse the news driving the global payments industry forward; the innovation, the infrastructure, and everything that has to happen to make it all possible.
:
When an AI agent makes a purchase that maybe they haven't been told to do or it's fraudulent, how do you spot it? Because AI agents don't have the same habits as humans. They're not getting up at nine in the morning, buying a coffee at this time, doing this at midday, doing this at night time. They can work 24-7 and there's just no pattern to what they're doing. Hello and welcome back to the Payment Expert podcast, your source for the latest news, insights and analysis on the payments industry. I'm Lewis Thompson, news editor here at Payment Expert and back with me today are our senior business journalists, Kieran O'Connor and Callum Williams. Kieran, Callum, thanks for joining me once again. It's been a while. It's been a while, yeah. It's good to be back though. Hopefully you're feeling all right, Lewis, and you get through this. about any hiccups or the toothache coming back? Yes, for all our listeners and viewers, I've had a toothache, but we're pushing through. We're pushing through anyway. Well, let's talk a bit about some of the news that we've had from the past week. Notably, know, Callum, you covered this, which was the FSB publishing its final agentic AI guidance, I believe last Thursday. So 12 practices for banks and financial institutions to abide by and adhere to. Run us through it, Forrest and Callum. What's it asking firms to do? And is any of it new stuff or is it kind of just sort of solidifying things that firms perhaps already do? Yeah, Lewis. So it's part of a wider consultation and plan that the Financial Sustainability Board have been. have been undertaking over the past year or so and this obviously is now culminated in its final report. The 12 practices they do cover governance, data, human oversight, particularly human oversight because they did say there was worrying risks regarding some of the sophistication of some of these AI agents at the moment being used for. agentic commerce and agentic payments and that's obviously been getting a real shift from the big tech and from the payment institutions in terms of enabling AI agents to perform payments on behalf of the consumer. In terms of its overall standing at the moment, it's not like international law, it's not international standard. The report does go to the G20, but there are already several big tech firms at the moment that have already adopted and deployed their own agentic commerce standards. And there is the EU AI Act, I know that's been in effect now for a couple of years, but the EU AI Act doesn't have a separate or dedicated agentic AI regulatory framework. It more or less just assesses the high risk or the low risk measurement of some of these agentic AI models. What the FSB were probably trying to achieve with this is creating more of a unified standard code when it pertains to the surge in agentic commerce and payments. mean, good stuff, Calum. I mean, yeah, from what I gathered from having a read through is it obviously restates those kind of existing principles, but obviously it's putting more weight, isn't it, on autonomy and on human So I guess it's kind of addressing the argument of how you treat an AI agent internally within your organisation as I guess synthetic employees rather than treating them as another human. there's also been the conversations happening around some of the events I've attended to this year regarding KYA Know Your Agent. That's obviously been... something that many payment firms, even merchants have had at the forefront of their mind in being able to secure responsible AI treatment when it comes to some of the payment features and some of the commerce features that they're looking to deploy just to automate the experience for the consumer. terms of what AI agents are at the moment is just simply for that, is to give suggestions and suggest in the consumer's favourites. or preferred payment method. But obviously we're always in the news, there's always stuff coming out about former OpenAI employees saying that this is like doomsday, it's happening in the next couple of years. So the sophistication of this technology is just rapidly, rapidly increasing over the next number of years. And I think this is a means for the payments industry and the financial industry to kind of get ahead and say, well, we can control what we control at the moment. And that's the AI agents performing on behalf of the consumer. I think... a standardized code is probably needed before it gets a bit out of hand. you agree with that, Kieran, I guess, putting, putting it back onto the people who deploy the agents rather than treating the agent as a, as a human itself. I think the text actually says, um, AI agents do not reason like humans and may interpret predefined goals in unexpected ways. guess going back to that, you know, how we perceive AI agents may not be or how they act unexpectedly, should say, is obviously a consideration within the text. Yeah, I think there's big problems with treating them as synthetic employees. mean, treating AI as an employee, it implies that they can be blamed when something goes wrong, which would be a big issue, I in finance and in other industries. It sort of overestimates as well AI, so it sort of suggests that AI has, I guess, like you said, a human understanding of sort of what it's doing and like a prejudgment when it doesn't at all. So I definitely think that this text is a lot more accurate in the sense that if there is any unexpected interpretations or any issues, then the person to blame will be the person who's overseeing the agent. Rather... than the agent itself. So from my point of view, I think that the text definitely sort of is a lot more accurate and we shouldn't really be going down the sympathetic employee framing. Yeah. I suppose if you take that argument as well, then like where the risk sits is not really on the agent so much, but on the human oversight of the agent, isn't it? So there's a point where an agent would have to stop and ask the human. And I suppose it's getting to point should these, I guess, 12 practices be sort of implemented widely? I don't think they have to, but I think they get presented at the G20. So you can imagine that they're going to have some kind of influence. I suppose that's the argument then, isn't it? you know, where the line where an agent has to ask a human at some point. There's also, there's also the thing that as well, it's about some of the some of the rogue AI bots and the malware that some of these fraudsters and scammers and bad actors are using in relation to some of the fraud that has been kind of increasing over time when it relates to AI and financial services, I think. How understanding is these AI agents being able to perform on behalf of the consumer? How knowingly do they know that there's an AI bot involved and can they detect malware on their own without? need for human oversight as well. I think that's, that's definitely something we need to keep an eye on over the next couple of months and years. Yeah. I mean, I suppose lastly on it, obviously there are, there are big companies out there, um, in the payment space that, know, they've developed already their own agentic commerce standards. You look at Google, maybe Stripe, Worldpay. Um, do you think that will have a, maybe an impact on what they build? I mean, they don't, I don't think they have a, a re, you know, they're not mandated to to implement any changes the FSB introduces. But obviously if they're working with PSPs, et cetera, it might have an impact. Obviously they might want to adhere to those kind of standards. I mean, like you said, the FSB practices just apply to financial institutions. Well, these big tech companies, the ones who are creating and sort of developing these agents and this technology, sit outside of them. I don't think that these rules will have a huge influence on these tech companies. These tech companies are going to have to be pushing the boundary every time in order to sort of make these agents improve or just develop them to do more things. However, I guess from a PSP point of view, knowing that these are the sort of rules that you may have to follow. when you are adopting this technology, you may be more inclined to go with a tech company that has built around these rules already. It probably is a good message to send. Sure. well, I mean, I guess this kind of maybe like London buses, two things come at once because was it yesterday, I believe, that the FCA have essentially come out Jessica Russo from the FCA has come out and essentially said the FCA wants to become an agentic regulator. I think, is that something you've been covering Kieran? What does that mean from what you've been looking at? Yeah, so Jessica Russo from the FCA, she did about an eight minute speech yesterday at an event and they pretty much taught all things AI. She... mentioned how the FCA plan to use AI and agentic AI. She mentioned that they're going to start building AI tools to supervise something like 60,000 AML firms, which is coming under its remit in 2028. And to me, it sounds like they're going to be using a lot more AI, maybe because they've got all this remit that they're going to have, and they maybe don't have the headcount. to sort of oversee it without the help of technology. She also mentioned the good practice and bad practices of what firms should be doing when it comes to using the technology. So she did cover a lot. think one of my favourite quotes was one of her first ones at the start of the speech when she sort of addressed everyone in the audience as humans, sort of suggesting that maybe in a few years' time... no one would actually be at these speeches. It would be her AI agent giving a speech to other people's AI agents who would then feedback what that AI agent said to the person. So yeah, it sounds like exciting times to come. Yeah, it is a thing. mean, if you've got these sort of 60,000 AML firms coming under, I guess, the remit of the FCA, is it by 2028, I think? 2028, yeah. That obviously is, yeah, that's obviously something that... obviously, legislate for and these kind of firms are, I guess, growing as well that that more seem to be appearing as, as it becomes more of a hot topic as fraud expands, etc. So yeah, an interesting move. So I guess from that explain why the FCA is kind of saying isn't writing any AI specific rules, do you think that's the right call and kind of letting the letting other areas of regulation deal with that? Or do you think they may be ducking the problem if they're obviously becoming an agentic regulator at the same time? I'm gonna take a standpoint on this. I don't think they're ducking a problem. I think an issue is if they start writing AI rules, no. In two weeks time, them rules might mean nothing. I think she mentioned in her speech repeatedly. that AI is sort of developing at a breakneck speed. So if you can draft it, I mean we all see it anyway, even if a regulator wants to bring out rules, they draft it, they debate it, then they implement it months later. By the time they've done it, it'd probably be obsolete. It'd be a waste of time. As we're seeing though, they are sort of pushing. rather than writing their own rules to sort of rely on the of consumer duty and existing frameworks that they already have. And I believe it was Nikhil Ratti who told, who said that he wasn't yet persuaded that they sort of needed lots more powers. But yeah, the FCA needed more powers. Yeah. Of course there is obviously, there's a gap. in the perimeter whereas consumer duty covers authorized firms and it doesn't cover the general purpose of an AI agent but saying that like I said if you bring out rules now in two weeks time they'll probably be obsolete. Just to piggyback on what Kieran said the other way, there's no real set standard for agentic regulations in compliance at the moment. I mean, the European Union do have their own EU AI Act. Now that's very different and it's still kind of developing as we speak today, much of what Kieran just mentioned there in terms of these rules needing to change in... parallel with the sophistication of some of these AI models. The EU basically have a high risk scoring system on what a financial institution AI model that they adopt or even their own in-house AI model is ranked and sort of a risk assessment barrier, or sort of a barrier, like a level barometer. Obviously high risks get flagged to the EU and some of the relevant. authorities and then they have to examine good data governance quality some of what the FSB have already kind of outlined in their standards as well so the EU AI is still kind of new it's kind of the first of its kind really in a way in the US we're not really seeing that much with Trump being very pro competitive and just kind of just incentivizing all these AI companies to spend whatever the hell they want so Um, yeah, it's, it's going to be interesting to see what the state of play looks like, maybe even post Trump's second term, um, how this develops and what other frameworks are built in conjunction with, um, just kind of like the rapid rise of this. sure. I mean, obviously, you know, they, I suppose the FCA, as they've said, you know, they, I can't write any AI specific rules, but they have published. some examples of, I guess, good and poor AI practice. Obviously, I you've covered all this, Kieran, what stood out for you in terms of what they had defined as good or bad practice? To me, they were all pretty straightforward and common sense. I understand that they have to write these. But on sort of poor practice, was using AI without a defined purpose. sort of excluding vulnerable consumers by default and sort of overstating capabilities. So what they were sort of saying was don't use AI just for the sake of using AI because it's a trend or maybe it can automate a task that you find finicky or something you don't really want to do. Everything that you do has to have the end user in mind and it has to benefit them. And then sort of in the good practice, it was sort of the opposite of that. Um, it was making sure that, um, that there's clear choices, um, and always access to a human, um, and just ensuring that maybe you use AI to then benefit some of them vulnerable consumers rather than excluding them. So they were, they were quite straightforward. Um, but yeah, I guess they have to be written down just to ensure that they're followed. Okay, then well, guess looking at both what the FSB has said and what the FCA has said, they both land, I guess, on a similar point, which is that the risk element obviously changes when AI acts, you know, as an agent instead of advising, which is what, you know, we all might use generative AI for. So for you, You guys were, guess, looking ahead a bit. What do you think that means for payment? What does it mean for maybe fraud, anti-money laundering, and things like that and how it relates to the consumer? It's a bit of a loaded question, Lewis. It is a bit. It's, mean, you can't really go anywhere right now without hearing about AI and what it's doing and the chips. and to fight over the chips, the data centers being built. It's all kind of all encompassing and it's all kind of leading us all down this like autonomous road of how we receive information now extending to payments and the shopping journey and whatnot. I think there is real, real scrutiny now though happening, not just within the financial services industry, just entirely, just global standards when it pertains to how are we using these models? What are the standards that are just like... mandatory and that need to be in place. And then, I think the FSB kind of pointed it right. think human oversight is needed, but it also needs to be enforced to a point where anything that happens with whether a model goes rogue or an AI agent goes rogue, is not even just maybe one, but like a team of people around to to stop a rogue or a rogue agent from performing a transaction that just shouldn't be happening or. Um, anything else in regards to that? think that's, that's paramount to making sure that we're using this, this technology or responsibly. Sure. And Kieran. just that we're going to have to rework everything it seems. Everything that you thought you had it down, you're have to look at it again and sort of make it all up again. We saw it. I had a conversation earlier this year with an AML expert and they were sort of telling me already they're big of a headache it's going to be. You know, when a bad actor makes a purchase, makes a fraudulent purchase on someone's card, it's quite easy to spot and they've got quite good at spotting it. When an AI agent makes a purchase that maybe they haven't been told to do or it's fraudulent, how do you spot it? Because AI agents don't have the same habits as humans. They're not getting up at nine in the morning, buying a coffee at this time, doing this at midday, doing this at night time. They can work 24-7 and there's just no pattern to what they're doing. It's gonna be an absolute nightmare. I also saw, might be slightly off topic, but I saw a post the other day. about people now asking AI agents to buy football shirts for them. So you know, in e-commerce and I've seen football clubs are now questioning how, questioning sort of the whole relationship between the fan and the club. If the clubs are now asking AI agents to buy the kits, it changes completely how them teams market them. how they interact with fans and just change the whole relationship completely. So I think my sort of take on this is just that everything's going to have to be reworked for a world of agents. Yeah, good stuff guys. And I suppose that the last point to maybe end on is obviously the agents can be used across the board. And you mentioned obviously even, you know, consumers buying football shirts, but even, guess on the regular, on the regulatory side, perhaps And you know, the FCA could be supervising with, with agents as well, as we've heard too. the whole, I guess, agentic pathway stretches to the regulators as well as the consumers on that end. I guess it's about getting those frameworks right, particularly around AML and fraud. Unfortunately, that is all we have time for today. But thank you very much to Kieran and Kellum. for joining me again. If you've been listening or watching and you're not subscribed to the Payment Expert podcast, make sure to subscribe wherever you do get your podcasts with plenty more insight and analysis coming over the weeks and months ahead. And of course, for the latest news as it happens, head over to paymentexpert.com. We'll see you all next time.