AI Agent Payments Need Adapted Compliance Controls

The same requirements for customer identification, sanctions screening, transaction monitoring, data sharing and recordkeeping apply whether a person or software initiates a payment. The business remains responsible for meeting those requirements.

The main change is operational. An agent can send thousands of payments at any time, while some compliance systems were built around occasional payments approved by employees during business hours. An overnight batch check may not be sufficient for a payment that settles within seconds.

U.S. sanctions rules do not set a minimum payment amount. A transfer worth a fraction of a cent to a sanctioned party can breach the rules, and strict liability may apply even if the business did not know the recipient was listed. Screening therefore needs to reflect the sanctions list in effect when the payment is made.

Businesses can screen payments before settlement or restrict agents to an approved list of counterparties. Those counterparties should be screened before approval and checked again on a regular schedule. Keeping payment destinations outside the agent’s real-time decisions can reduce the number of checks needed for each transaction.

Travel Rule requirements vary by jurisdiction. The Financial Action Task Force’s global baseline is generally $1,000 or €1,000. The long-standing U.S. wire-transfer requirement applies above $3,000, while crypto-specific requirements in the United States remain subject to rulemaking. In the European Union, the Transfer of Funds Regulation requires originator and beneficiary information for crypto transfers at a zero threshold. There is no small-payment exemption.

Required information can include the originator’s and beneficiary’s details, identification or address data, transaction references and the wallet addresses involved. Companies serving customers or counterparties in the EU therefore need a system that can transmit this information for every crypto transfer.

Transaction monitoring must account for software behavior. An agent may make thousands of small payments as part of normal operations, triggering alerts based on patterns associated with human customers. Repeated transfers below a reporting threshold may also resemble structuring, even when they result from legitimate per-call pricing.

Companies should document the payment architecture before the activity begins. The records should explain why the agent makes frequent small payments, identify who approved the design and set out applicable spending limits. Monitoring can compare each agent with its normal transaction count, payment values and destination list instead of relying only on standards designed for human users.

Recordkeeping should allow the business to reconstruct each payment and identify the people responsible for related decisions. Records can include the entity accountable for the agent, the approved counterparty, the person who cleared an alert and the date of each review. Because payments may arrive overnight or on weekends, businesses need assigned review periods and dated records showing who handled each queue or exception.

Additional requirements may apply when a company holds or transmits funds for another party, including possible licensing requirements. Providers differ in whether they conduct sanctions screening or transmit Travel Rule information, so businesses must establish which controls remain their responsibility. Crypto requirements and thresholds vary by jurisdiction and may change as regulators issue new rules.