Visa, BILL and Billtrust Pilot AI Invoice Payments, Raising Liability Questions
Oct. 22, 2026 • Deep Dive • AI in Fintech
Visa, BILL and Billtrust announced a live commercial pilot on October 20, 2026, that lets AI agents initiate and execute approved business invoice payments through supplier portals. The BILL Payment Agent uses tokenized payment credentials restricted to buyer-authorized invoices and predefined rules. Billtrust authenticates the agent through Visa’s Agentic Directory and Trusted Agent Protocol without requiring shared login credentials.
The pilot tests how an agent can establish its identity and payment authority, but it does not give the agent authority to approve invoices independently. Visa’s protocol uses cryptographic signatures to bind requests to a particular merchant domain and page. The distinction matters for liability: commercial payment protections may be altered by contract, while AI software agreements may limit vendor exposure. Visa separately announced expanded commercial capabilities on October 21, with supplier validation and authentication controls scheduled for general availability in 2027. The EU’s draft Payment Services Regulation does not directly address autonomous agent payments.
Visa, BILL and Billtrust announced a live commercial pilot on October 20, 2026, enabling AI agents to initiate and execute approved business-to-business invoice payments through supplier portals. The companies described it as the first live commercial pilot of its kind. Its immediate significance is narrower, but important: it tests whether a supplier can verify an agent’s identity and payment authority without receiving a buyer’s login credentials.
The agents are not deciding which invoices a business should pay. In the pilot, the BILL Payment Agent operates within invoices already approved by human finance personnel and predefined payment rules. That distinction limits what the software can do, while leaving a consequential question for businesses deploying it: who bears the loss if an authorized automated payment is nevertheless wrong?
How the agent is authenticated
The BILL Payment Agent uses tokenized payment credentials restricted to buyer-authorized invoices. Tokenization allows a payment credential to be used within defined constraints rather than giving the agent unrestricted access to a buyer’s payment account. Those constraints govern payment execution; they do not independently establish that an invoice amount or a prior human approval was correct.
On the supplier side, Billtrust authenticates the agent using Visa’s Agentic Directory and Trusted Agent Protocol. The arrangement does not require a separate agent login or the sharing of account credentials. It instead gives the supplier portal a way to recognize the agent and assess the authority presented with its request.
Visa’s protocol uses cryptographic HTTP Message Signatures based on RFC 9421 to prove agent identity and user authorization to merchant endpoints without relying on CAPTCHAs. Its requests are cryptographically bound to a specific merchant domain and web page. That binding is designed to prevent a request being replayed or a token being redirected to another domain.
These measures address a practical weakness in older online-payment checks. Legacy 3-D Secure authentication often depends on browser telemetry, behavioral signals and human biometrics. An autonomous software agent may not produce those signals, making a checkout process built around a human user a poor fit for agent-initiated payments. The pilot’s approach substitutes a verifiable agent identity and constrained payment authority for those human-facing signals.
Authorization does not settle liability
The pilot is described as an example of autonomous AI agents executing payments, but its current operation is more tightly bounded. The agents act as deterministic executors for invoices that finance staff have already approved. An agent can carry out an authorized instruction; the pilot does not demonstrate that it can independently judge whether an invoice should be approved.
That boundary matters when tracing responsibility for an error. Authentication can help establish which agent made a request and whether it had authorization to use a payment credential. It does not, by itself, determine whether the buyer approved the correct invoice, set appropriate rules or would be entitled to recover a mistaken payment.
Commercial B2B accounts can opt out of standard electronic funds transfer liability protections, leaving the allocation of some risks to negotiated contracts. That differs from the non-waivable statutory protections that apply to unauthorized transfers from consumer retail accounts. Businesses assessing agent-initiated payments therefore need to look beyond the technical controls to the agreements governing their payment accounts and software.
There is a further distinction between an agent’s role in a business process and how its software provider describes it. Common-law agency doctrine may treat a deployed agent as a delegate whose actions bind the enterprise, while enterprise AI agreements may classify the agent as a computational tool and disclaim liability for operational misinterpretations. Standard enterprise AI vendor agreements generally cap indemnification and liability at 12 months of software fees paid. Those terms can leave a buyer exposed to losses from an invoice miscalculation or automated mispayment that exceed the vendor’s contractual liability.
Controls and rules still to come
Visa announced expanded commercial capabilities on October 21, including Supplier Enablement Spend Analytics, or SESA 2.0, and Visa Commercial Fraud Solutions. It scheduled general availability of supplier validation and authentication controls for 2027. Those plans point to further controls around commercial payments, but they do not change the limits of the current invoice pilot.
Regulation also leaves a gap. The European Union’s draft Payment Services Regulation does not set direct statutory rules for autonomous agent payments and is scheduled for a European Parliament plenary vote on December 14, 2026. For now, the pilot shows a way to authenticate an agent and confine its payment authority. It does not provide a universal answer to who is liable when an agent pays the wrong invoice.
The Linux Foundation appointed payments veteran Michael Hursta executive director of the x402 Foundation on October 1, 2026, as payment systems designed for autonomous AI agents gained attention. Foundation members reported more than 75 million agentic payment transactions in a 30-day period in September, and Coinbase and Amazon Web Services showcased production payment rails at Sibos 2026. Reported transaction counts, however, do not establish the value or commercial character of that activity. The emerging protocols address different obstacles. Coinbase’s x402 enables per-request USDC payments through HTTP, while Google’s Agent Payments Protocol uses signed mandates to connect an agent’s purchases to a user’s authorization. Stripe and Tempo have also proposed session-based billing through the Machine Payments Protocol. These approaches respond to card fees and interactive checkout checks that can impede small, automated transactions. Card networks are developing delegated-identity tools, leaving multiple potential paths for agent payments rather than a single replacement for existing rails.
Mastercard opened developer early access for Agent Pay for Machines (AP4M) on October 20, 2026, releasing buyer- and seller-side APIs, a sandbox and developer toolkits. In a Cloudflare Connect demonstration, marketing agency Hype tested an autonomous agent making nine payments to two merchants within a single budget, without manual billing or account setup. AP4M uses HTTP 402 payment challenges, but differs from crypto-native implementations of the x402 protocol. Its agents issue digitally signed vouchers off-chain; merchants can batch and redeem them later instead of settling every request on-chain. The pilot combined agent wallet infrastructure from Coinbase Developer Platform and BVNK, settlement on Base, and Mastercard’s multi-currency fiat and stablecoin settlement platform. Circle separately expanded its managed payments service to target AI-agent traffic using USDC. Together, the developments show competing approaches to machine-to-machine payments, with different choices about settlement, funding and who manages digital assets.
Visa launched a live pilot with BILL and Billtrust at Money20/20 USA in late October 2026 to test end-to-end B2B invoice payments executed by software agents. The agents act on invoices enterprise buyers have already approved; they do not decide which supplier payments to authorize. Visa’s Trusted Agent Protocol and Agentic Directory are designed to authenticate those agents when they access supplier and merchant portals without shared credentials or manual human login. Separately, Visa has put Commercial Payment Controls into production for eligible issuers in supported regions, allowing businesses to set limits and restrictions on corporate spending. The company plans general availability of Commercial Virtual Authentication and Commercial Supplier Validation in 2027 after pilot completion. Its SESA 2.0 analytics platform has identified more than $600 billion in potentially cardable supplier spend. The pilot tests whether approved invoice payments can be executed through automated workflows while preserving buyer-defined controls.
Mastercard and Visa are advancing different approaches to AI-initiated business payments. At Cloudflare Connect, Mastercard demonstrated an agent making nine payments across multiple service providers under one authorized budget. It also opened early developer access to Agent Pay APIs, a sandbox and toolkits. Visa expanded its commercial agentic suite around a BILL and Billtrust pilot, alongside spend analytics and fraud tools. The distinction is how each approach constrains the agent. Visa’s pilot lets an agent pay invoices that buyers have already approved, using its Trusted Agent Protocol to navigate supplier-portal security without sharing underlying login credentials. Mastercard is testing controls for machine-to-machine transactions, including signed vouchers, agent verification and a score intended to estimate whether an incoming transaction was AI-initiated. Both efforts leave a consequential question for business payments: how responsibility should be assigned when an authorized agent follows its technical instructions but breaches a procurement condition.
Mastercard opened developer APIs, SDKs and a sandbox for Agent Pay for Machines (AP4M) on October 21, 2026. The tools enable autonomous AI agents on Amazon Bedrock to make multi-merchant micropayments over x402 using off-chain signed vouchers. The launch follows Coinbase Developer Platform’s report that cumulative x402 payments across Base and Solana had exceeded 100 million by October. The x402 protocol uses an HTTP 402 response to tell an agent what a service costs and how to pay. Its growing infrastructure includes a Linux Foundation-governed foundation, while alternative approaches use Lightning payments or existing processor rails. Transaction counts, however, do not establish how much genuine agent-led commerce is taking place. TRM Labs found a much smaller pool of plausible commercial trade after screening out other activity. Security questions also remain, including whether a service can receive payment without delivering its output. Developers therefore face choices about settlement, spending controls and proof of service.
CapitalOS completed a $21.9 million Series A financing round on October 21, 2026, led by LGVP. The company plans to expand its engineering team and scale the infrastructure behind its AI-driven money orchestration platform. WEX Venture Capital, Group 11, Great North Ventures, Night Capital and existing early investors also participated. Founded in 2022, CapitalOS helps vertical SaaS and AI platforms offer embedded charge cards, digital wallets and automated bill payments without maintaining in-house licensing or risk operations. Its architecture uses five specialized AI agents across underwriting, capital, compliance, risk and fraud, and support. Property management platform Guesty is an active customer, and CapitalOS reports managing transactions for more than 25,000 active cardholders across dozens of integrated platforms. CapitalOS relies on infrastructure provider Increase and its chartered partner banks rather than replacing depository institutions. The announcement did not disclose a valuation, credit warehouse partner or the identities of its current primary sponsor banks.