For more than a decade, payments innovation has largely been driven by technology. Fintechs, banks and infrastructure providers have focused on faster execution, improved customer experience, embedded finance and increasingly seamless digital journeys.
Published: 16 October 2026
Authors: Thomas Brown
Regulation, while important, has often been viewed as the framework within which innovation operates.
That dynamic is changing.
Across the UK and internationally, policymakers are reconsidering foundational aspects of the payments ecosystem in response to three converging forces: artificial intelligence, digital money and increasingly complex payment value chains. The result is a fundamental rethink of the legal architecture that underpins modern payments.
The UK's existing framework, centred on the Payment Services Regulations 2017 (PSRs) and the Electronic Money Regulations 2011 (EMRs), was designed for a world of identifiable payment service providers, conventional payment accounts and relatively straightforward customer instructions. It was not built for autonomous AI agents capable of making transactional decisions, nor for tokenised forms of money operating on distributed ledger infrastructure.
HM Treasury's Modernising Payment Services Regulation Consultation, published on 14 July 2026, reflects that reality directly. The consultation expressly considers how the regulatory framework should evolve to accommodate developments such as tokenised payments, open banking and "agentic payments" while maintaining consumer protection, operational resilience and confidence in the payments system.
The implications for the industry are significant. This is no longer a discussion about incremental regulatory refinement. It is about how responsibility, accountability, authorisation and consumer protection should operate in a financial system where payments may be initiated by software, settled using digital assets and delivered through interconnected technology platforms.
From Rules Written for Payment Accounts to Rules Written for Payment Ecosystems
The current regulatory framework has served the market well. The PSRs establish detailed requirements governing authorisation, safeguarding, outsourcing, transparency and liability. For example, payment institutions are subject to safeguarding requirements under Regulation 23 PSRs and outsourcing obligations under Regulation 25 PSRs, creating an important foundation of consumer protection and market confidence.
However, many of the framework's defining concepts originate from an earlier generation of financial services. The legislation assumes that payments are initiated by identifiable users through identifiable intermediaries using recognised payment instruments and payment accounts. Increasingly, those assumptions no longer hold.
As innovation accelerates, regulators are being forced to revisit fundamental questions. Which participants in a payment chain should be regulated? How should liability be allocated between banks, fintechs, merchants, infrastructure providers and technology firms? What protections should apply when value is represented digitally rather than held in traditional accounts? And where should the regulatory perimeter sit when products blur the lines between payment services, electronic money and newly regulated cryptoasset activities under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026?
For firms operating at the leading edge of innovation, these questions can no longer be treated as future policy issues. They are becoming material product, legal and commercial considerations today. The most successful businesses will be those that assess emerging products not only against the current rules but also against the direction of travel of future regulation.
Agentic Payments Challenge Traditional Concepts of Authority and Liability
Perhaps no development better illustrates this shift than the emergence of agentic payments.
The prospect of AI systems identifying products, selecting suppliers, negotiating terms and initiating payments on behalf of consumers or businesses is no longer theoretical. HM Treasury highlighted agentic payments as a specific area of regulatory focus in its July 2026 consultation, recognising the extent to which these models challenge existing assumptions about payment authorisation and customer consent.
At the heart of the issue is a deceptively simple question: what does customer consent look like when a machine makes the decision?
Traditional payment regulation assumes a clear and identifiable payment instruction given by a customer. Agentic commerce introduces greater complexity. Consumers may establish parameters and objectives rather than approve individual transactions. Businesses may authorise AI systems to optimise procurement decisions without direct human involvement in every payment.
That creates difficult legal and operational questions. Firms must consider how authority is granted, evidenced and withdrawn. They must determine where responsibility sits when an AI system acts outside its intended mandate. Existing strong customer authentication requirements may need to evolve for increasingly automated payment journeys, while reimbursement and liability regimes may require reconsideration when an unauthorised transaction results from machine-led decision-making rather than conventional fraud.
The legal challenge extends beyond payments regulation. Depending on the use case, agentic payment models may also engage consumer protection requirements, UK GDPR obligations, outsourcing rules, operational resilience expectations and, in some circumstances, financial promotion regulation.
The central question is not whether AI can make payments. It is whether firms can demonstrate that those payments remain authorised, explainable and accountable within the existing regulatory framework.
Stablecoins Are Moving From Innovation Narrative to Regulatory Reality
At the same time, digital money is moving decisively from policy discussion into regulatory implementation.
The UK's framework for cryptoassets and stablecoins has developed rapidly, with legislators and regulators increasingly focused on integrating digital forms of value into the broader financial services regime. What was once viewed primarily as a cryptoasset issue is now becoming a mainstream payments issue.
A major milestone was the FCA's publication of Policy Statement PS26/10: Stablecoin Issuance in June 2026. The final framework establishes requirements for non-systemic UK-issued qualifying stablecoins covering backing assets, segregation, statutory trust arrangements, reconciliation, record keeping, governance, disclosures and redemption rights.
The significance of these reforms should not be underestimated. Stablecoin issuance is increasingly being regulated as a financial activity rather than a technology activity.
In practice, the success of a stablecoin as a payment instrument will depend at least as much on the strength of its legal framework as on the sophistication of its underlying technology. Investors, consumers, counterparties and regulators alike will focus on ownership of backing assets, operation of statutory trusts, redemption mechanics, insolvency treatment and safeguarding arrangements. These legal foundations ultimately determine whether a stablecoin can function as trusted digital money.
The position becomes even more significant as stablecoins grow in scale. Under powers introduced by the Financial Services and Markets Act 2023 and related amendments to the Banking Act 2009, HM Treasury may designate certain stablecoins as systemic payment systems. Oversight of those arrangements would be shared between the FCA and the Bank of England, creating a dual-regulator framework for stablecoins that become critical to the UK payments ecosystem.
The Convergence of Payments, AI and Digital Assets
The most important development, however, is not AI in isolation or stablecoins in isolation. It is the convergence of technologies that have historically been analysed separately.
A single proposition may now involve a regulated payment service under the PSRs, a qualifying stablecoin within the UK's cryptoasset framework, AI-driven decision making, cloud-based outsourcing arrangements and extensive processing of personal and transactional data. Regulatory frameworks originally designed around discrete activities must increasingly oversee interconnected ecosystems.
This convergence is reshaping legal risk analysis. Firms can no longer examine payments regulation, crypto regulation, data protection and operational resilience in separate silos. Product governance, regulatory strategy and legal design are becoming inseparable.
A similar trend can be seen in Europe through PSD3 and the proposed Payment Services Regulation (PSR), which seek to strengthen fraud prevention, modernise open banking and create a more integrated supervisory framework for payment and electronic money institutions. While the UK and EU remain broadly aligned in policy objectives, divergence in regulatory implementation is likely to create additional complexity for firms operating across borders.
As a result, regulatory strategy is becoming an increasingly important source of commercial advantage. Businesses that understand how these frameworks interact will be better positioned to launch products quickly, scale efficiently and manage regulatory risk. Those that treat compliance as a post-development exercise may find themselves facing redesign costs, delayed launches and difficult supervisory discussions.
The next phase of payments innovation will be defined as much by legal architecture as by technology.
The industry's most pressing challenge is no longer whether AI can initiate transactions, whether stablecoins can settle value or whether digital infrastructure can support new forms of commerce. Increasingly, those capabilities are a given.
The real differentiator will be trust.
Boards should be asking fundamental questions about every new proposition. Who creates the value? Who controls it? Who safeguards it? Who authorises the transaction? Who oversees the AI making decisions? And, ultimately, who is accountable when something goes wrong?
The firms that embed authorisation, safeguarding, operational resilience, consumer protection and governance into product design from the outset will be best positioned to thrive in an increasingly complex regulatory environment. Those that leave them as afterthoughts risk finding that innovation moves faster than governance.
The debate is therefore no longer whether regulation can keep pace with technological change. The more important question is whether the industry can design the next generation of payments services in a way that remains compatible with the next generation of regulation.