Sandbox tests for AI agents that make payments

House of Lords Financial Services Regulation Committee · Written evidence ·

Proposes how sandbox tests should treat AI agents that make payments under a consumer’s prior authority: follow one purchase across the agent’s provider, the seller and the payment providers, and run a first set of five failure tests, from a repeated purchase to a dispute. Asks for a common test specification, published findings and a record of what the FCA or HM Treasury changed in response.

Read the evidence on parliament.uk

The document

Title
Written evidence submitted by King Yew Choo (RSB0009)
Committee
House of Lords Financial Services Regulation Committee
Inquiry
Regulatory sandboxes in financial services
Questions addressed
Questions 10 and 8, and question 11 as it applies to agentic payments
Capacity
Personal capacity
Declared interest
Founder of True Primary, which has a commercial interest in how agentic payments are regulated (paragraph 3)
Submitted
Published
, by the Committee
Length
6 pages, numbered paragraphs 1 to 29

Main recommendations

  1. Publish the extent of the testing. The Committee should ask the FCA to publish how many sandbox tests involve agents initiating payments, what authority those agents hold and which payment participants take part. It could also ask the FCA to separate agents that only advise, agents that propose payments for a person to approve, and agents that pay under authority given in advance. The programme descriptions the evidence cites give no such count.
  2. Follow one purchase across the participants. A failure can sit at the interface between the agent’s provider, the seller and the payment providers, and a test that simulates the relevant counterparty establishes only what the simulation represents. Each result should identify the systems tested, any simulated participants and the evidence needed to reproduce it, and each material change should be assessed, with repeat tests of the controls it affects.
  3. A common test specification. Each case should set out the payment method, the purchase reference, the participating roles, the initial authority, the failure deliberately introduced, the expected outcome and the records required, among other elements. The same case should run across several implementations, with tests using simulated participants kept distinct from tests with connected providers and live money.
  4. Publish what the tests find, and what changes. The evidence recommends a public version of the specification, anonymised failure categories, aggregate results and a record of the fixes required, excluding consumer data, firm secrets and exploitable security details. For each finding, the FCA should say whether it changes guidance, supervisory expectations or the case for legislation, with an owner and a response date.
  5. Keep existing consumer protections enforceable during live tests. Before live testing, participants should identify the provider responsible for each consumer claim, the complaint and redress routes, and how compensation will be funded. The live stage should have exposure limits, stop conditions and a named person authorised to stop the test.

A first set of five failure tests

  1. Repeated purchase. The same purchase instruction arrives again after a lost reply, including after a restart. A purchase that permits one payment should produce at most one completed payment.
  2. Concurrent spending. Several purchases, each permitted on its own, together exceed the remaining allowance. The provider enforcing the limit must reserve the amounts consistently and refuse the excess.
  3. Withdrawal and expiry. Authority is withdrawn or expires while requests are queued. Attempts for which authority has ended should be refused, and the time from effective withdrawal to enforcement measured at each participant.
  4. Unknown outcome. The exchange is interrupted after a payment attempt, so one participant cannot tell whether it succeeded. The purchase stays unresolved until authoritative records establish the result, and a second attempt for the same purchase is refused while the first remains uncertain.
  5. Dispute and recovery. For each of the other four, a reviewer receives the records a consumer and a dispute decision-maker would have, and reconstructs the authority, actions, financial outcome and responsible participants. Missing records, unresolved contradictions and the time to a usable answer are measured.

These are proposed acceptance conditions, for the participating firms to implement and measure. This first set covers payment-control failures. Deception and mistaken choices within a delegation need a separate set.

Two international reference points

Singapore’s Safeguards for Agentic Finance at Runtime, published on 3 July 2026 by the Monetary Authority of Singapore and industry, checks and records proposed agent actions before they execute, with industry pilots and sandbox experimentation planned to support adoption. The European Banking Authority’s Work Programme for 2027 schedules targeted analysis of agentic AI in payments.

Its international comparison concerns methods and published plans only. Ranking sandboxes by effectiveness would need comparable results, costs and consumer outcomes.

Sources