How UK retailers are preparing for autonomous purchasing, and where the gaps remain
Developed in collaboration with The Payments Association’s Merchant Payments Working Group
UK merchants believe AI agents are already buying on their sites. Most are preparing. One barrier rises above the rest, and the FCA’s Mills Review will need to address it.
Are UK retail merchants ready for AI agents to start showing up as customers?
That is the question this report sets out to answer. The short version, drawn from a survey of 100 senior finance and risk decision-makers at UK online retailers, is that more merchants are paying attention than I expected. Far fewer feel they have the standards or guidance they need to act on it.
There is one finding I want merchants to sit with. The single biggest barrier holding firms back from preparing for agentic commerce is not budget, and it is not the absence of a business case. It is uncertainty about which technical standards or protocols to adopt, cited by 39% of respondents. Merchants are not refusing to move. They are waiting to be told what to move towards. That is a market structure problem, and one TPA’s Merchant Working Group is well placed to help address.
The report opens with where the language sits today, then turns to whether merchants believe they have already seen agent-initiated transactions and how far they have got in preparing to accept them. It works through the concerns finance and risk teams hold, how merchants see liability falling when a £2,000 agent transaction is disputed and the practical barriers slowing them down. From there it covers the global card scheme and protocol activity that offers UK merchants their best preview of what is coming, and the Financial Conduct Authority’s (FCA) Mills Review, which reports to the FCA Board this summer. It closes on the first steps that make sense now.
Agentic commerce will not arrive as a single moment. It will arrive as transactions that look unfamiliar, then routine. Better to start preparing while the rules are still being written.
– Matt Simester, Managing Director at Piran Consulting and lead of The Payments Association Merchant Working Group
58% of UK online merchants believe they have already observed AI agent transactions, yet only 41% say they are very confident in the liability frameworks surrounding them.
Believe AI agents have already transacted
Are actively preparing or planning
Feel very confident in liability frameworks
Cite authentication as a top concern
Rule out agent activity entirely
The findings suggest UK merchants have moved beyond awareness and into operational preparation for agentic commerce. Most respondents believe AI agents are already interacting with their platforms, yet confidence in the governance frameworks surrounding those transactions remains uneven.
The tension running through the market is not whether agentic commerce is arriving, but whether liability, authentication and interoperability standards can mature quickly enough to support it safely at scale.
Most UK merchants believe agentic transactions are already occurring on their platforms, despite limited detection standards.
Implication:
The market is moving operationally before monitoring frameworks are mature.
Preparation has shifted from experimentation into planning and early implementation.
Implication:
Agentic commerce is becoming a payments infrastructure issue rather than an innovation topic.
Merchants lack consensus on who pays when AI agents complete disputed transactions.
Implication:
Governance maturity may become a competitive differentiator before regulation settles.
Card schemes and web-native protocols are building competing approaches to agent authentication and intent verification.
Implication:
Merchants face interoperability decisions before standards consolidation.
FCA launches Mills Review
Review into the long-term impact of AI on retail financial services begins under Sheldon Mills.
Treasury Committee report published
Calls for comprehensive FCA guidance on AI and consumer protection.
HM Treasury Payments Forward Plan
Names:
SCA updates
agentic AI payments
regulatory development
as active workstreams.
CMA publishes “Agentic AI and Consumers”
Confirms existing consumer law applies to AI-agent transactions.
Visa launches Agentic Ready
UK and Europe included in first rollout phase.
Stripe launches Machine Payments Protocol
Web-native payment infrastructure for autonomous transactions.
World & Coinbase launch AgentKit
Identity layer for “human-backed agents”.
American Express launches ACE
Includes first scheme-level agent purchase protection.
UnionPay launches APOP
Open protocol pilot completed in Hong Kong.
FCA Mills Review reports to FCA Board
FCA engagement paper process
Industry consultation period on AI and retail financial services.
HM Treasury consultation response due
Expected direction on:
FCA policy statements expected
Potential operational standards and rule changes emerge.
Agentic commerce is online shopping in which an AI agent acts on a consumer’s behalf rather than alongside them. The agent does not just suggest, it transacts. For merchants, this changes who is on the other side of a checkout.
The Competition and Markets Authority (CMA) defines agentic AI as systems that can sense, decide and act autonomously. In commerce, that means software agents capable of retrieving information, evaluating options and completing transactions on a consumer’s behalf.
The distinction between an agent and a conventional AI tool is operational. Recommendation engines, conversational interfaces and personalisation systems support decisions that consumers still make themselves. Agentic commerce begins when the software executes the transaction under delegated authority.
Several overlapping terms are now used across the market. Agentic AI, AI agent shopping and autonomous purchasing generally describe the same category of activity. Conversational commerce and AI-powered purchasing do not. In both cases, the consumer remains the active decision-maker throughout the transaction journey.
Forecasts for the sector are large enough to explain the urgency around standards and governance. McKinsey estimates agentic commerce could influence $3 trillion to $5 trillion in global B2C retail revenue by 2030, while Bain projects AI agents could account for 15% to 25% of US e-commerce sales by the same year. Comparable UK forecasts do not yet exist, and current estimates should be treated as directional rather than predictive.
The CMA also stresses that most current deployments remain relatively constrained, particularly in consumer-facing environments. Fully autonomous purchasing is still limited in practice. However, the market is beginning to move from recommendation towards execution, creating pressure on existing payment, authentication and liability frameworks.
UK regulation on agentic commerce remains formative rather than settled. No binding framework yet exists for AI-agent payments, liability or authentication. However, three parallel workstreams across competition policy, financial regulation and Treasury payments reform are beginning to establish the direction of travel.
The Competition and Markets Authority (CMA) moved first. In its March 2026 paper, Agentic AI and consumers, the regulator made clear that existing consumer protection law applies whether decisions are made by people or by AI systems.
The CMA expects businesses deploying agentic systems to maintain human oversight, monitor systems for errors and bias, and refine models where consumer harm emerges. It also identifies the wider infrastructure required for agentic commerce to scale safely in the UK, including smart data schemes, secure digital identity and interoperability standards.
For merchants, the practical signal is immediate: the CMA already considers current law applicable to AI-agent transactions.
The FCA’s review into the long-term impact of AI on retail financial services, led by Sheldon Mills and launched in January 2026, is the most significant UK regulatory process currently underway for merchant payment leaders. The review reports to the FCA Board in summer 2026 and is expected to shape future thinking around liability, oversight and operational accountability for AI-driven payments activity.
The review focuses on four interrelated areas:
A third regulatory thread runs through HM Treasury, the Bank of England and Parliament. Together, these initiatives increasingly frame agentic payments as a system-level infrastructure issue rather than simply a consumer technology trend.
The Treasury Committee’s January 2026 report on AI in financial services called for comprehensive FCA guidance on the application of consumer protection rules to AI systems. HM Treasury’s February 2026 Payments Forward Plan subsequently identified Strong Customer Authentication reform and agentic AI payments as active policy workstreams.
For merchants, the implication is clear: operational preparation is likely to begin well before regulatory standards fully settle.
The next phase of UK regulatory development now extends across 2026 and beyond, including:
Worldpay’s research, fielded with research agency The Lantern across seven countries in August and September 2025, finds that 31% of UK shoppers would let an AI agent shop for them, rising to 45% among 18 to 34 year olds. UK consumers expect AI agents to handle 7% of their online purchases by 2030, equivalent to £29 billion in annual spend. The appetite is real but conditional. A further 68% want full control over what an agent buys on their behalf, near the top of the seven-country range alongside Brazil at 69%.
The top requests among UK consumers are AI that balances cost and quality (61%), finds the lowest price (60%) and tailors recommendations to personal tastes (43%). Trust is built through specific reversibility features: 58% rate the ability to cancel a purchase within 24 hours as essential, 54% rate fraud protection as essential and 46% want clear spending limits.
Category readiness follows the same logic. Across all markets, openness is highest for routine purchases under $100 (or local-currency equivalents), with cinema tickets at 63% and meal delivery at 56%. It narrows sharply in the $100 to $500 band and collapses above $1,000, where few consumers will delegate luxury goods, holidays or financial decisions.
Other markets in Worldpay’s survey show where UK sentiment may sit in 12 to 24 months. In Singapore, 44% of consumers are ready to use an AI agent now or within 12 months, with only 15% saying they never will. In China, 65% are ready within 12 months. If UK trust thresholds are met by reversibility features and clear control settings, the addressable share rises with them. UK merchants should plan for the conditional consumer, not the resistant one.
Nearly six in 10 UK retail merchants in our survey say they have already observed AI agent activity on their platforms, signalling that agentic commerce is moving from future concept to operational reality.
Merchant familiarity with agentic commerce language is now widespread across the UK retail sector, even if operational understanding remains uneven. More than half of respondents say their organisations already use each of the six terms tested in the survey internally: agentic commerce, agentic AI, AI agent shopping, autonomous purchasing, AI-powered purchasing and conversational commerce. Conversational commerce leads at 61%, followed by agentic AI at 56%, while the remaining four cluster between 50% and 52%. Only 11% to 13% of respondents say they are unfamiliar with the terms altogether.
Awareness is strongest among medium and large merchants, while smaller firms lag on more specialised language. Internal use of the term AI agent shopping stands at 28% among small merchants, compared with 68% among medium-sized firms. Three-quarters of respondents correctly identify agentic AI as the broader concept and agentic commerce as one application of it, while the remaining 24% either invert the relationship or treat the two as identical.
The clearest signal in the survey is that merchants increasingly believe AI agent transactions are already occurring on their platforms. A combined 58% of respondents say they believe agent-driven transactions have already taken place within their environments, including 27% who say definitely yes and 31% who suspect activity but cannot confirm it with certainty. A further 32% expect to encounter agent-driven transactions imminently, while only 10% rule them out entirely.
Confidence rises with merchant scale. Among large merchants, 40% say they can confirm AI agent activity on their platforms, compared with 16% among small merchants. UK merchants still lack standardised methods for identifying AI-initiated transactions, and many of the agent identification frameworks being developed by payment schemes and protocol providers are not yet widely deployed. Merchant visibility therefore remains partly inferential rather than fully confirmed.
Nearly three-quarters of UK online merchants are actively preparing, and not one says agentic commerce is irrelevant. Some 72% are either actively developing capabilities for accepting AI agent transactions or in a formal planning and strategy phase. The remaining 28% are still discussing it internally without concrete plans. Critically, no respondent in the sample says this is not relevant to their business.
The breakdown matters. Active development sits at 26%, with another 46% in planning. A further 21% are discussing without firm plans, and 7% recognise it will become relevant within the next 12 months. That distribution puts the centre of gravity in planning rather than in delivery.
Cross-tab by size shows the picture is broadly consistent across bands. Active development and planning together account for between 68% and 80% of merchants across all size bands. The clearest split is in planning, where small merchants cluster at 56%, medium at 42%, and large at 43%. Treat as directional given the small subgroup.
Active preparation tracks observed activity. Among UK merchants who report having already seen AI agent transactions on their platforms (58%), 81% are in active or planning territory. Among merchants who only expect to see them soon, that figure drops to 60%. Treat as directional given subgroup sizes.
When asked to name their top three concerns about AI agents acting on behalf of customers, merchants concentrate around three themes.
1) Trust signals lead. Authentication and data privacy tie for first at 32% each. Fraud follows at 27% and customer experience and trust at 23%. The unifying thread is how a merchant verifies the entity on the other end of the transaction, what data flows between them, and how that gets surfaced to the consumer. Authentication concern peaks among medium merchants (48% against 16% small and 26% large), the band currently doing the integration work. Data privacy peaks among large merchants (46%), where the data volumes and breach exposure are largest.
2) Regulation and liability is the second cluster. Regulatory compliance and clarity on Strong Customer Authentication and PSD2 attracts 27%, with liability and chargebacks for unauthorised AI agent purchases at 25%.
3) Merchant operations is the third. Loss of customer journey ownership (24%), technical integration with agent protocols (22%) and discoverability by AI agents (22%) cluster tightly. Large merchants drive discoverability concern at 40% against 12% of both small and medium, consistent with merchants that already invest in branded search now asking what happens when an agent, not a consumer, decides where the basket goes. Technical integration peaks among medium merchants at 30%, the band scoping protocol work without the in-house standards capacity of the largest players.
Barriers preventing UK online merchants from preparing for agentic commerce sit within an eight-percentage-point band. Uncertainty about which technical standards or protocols to adopt leads at 39%. Lack of regulatory guidance follows at 34%. Insufficient resources or budget and uncertainty about how AI agents will discover and select the merchant tie at 33%. Lack of internal awareness sits at 32% and an unclear business case at 31%.
The flatness is the finding. Merchants are not held back by one structural blocker but by overlapping ones at roughly equal weight, consistent with a market where most respondents are scoping rather than building.
The protocols landscape explains the top barrier. Merchants navigate four card-scheme frameworks adapting legacy rails for delegated spend, two web-native payment protocols in Stripe’s Machine Payments Protocol (MPP) and Coinbase’s x402, and agent commerce protocols including Google’s Agent Payments Protocol (AP2) and OpenAI’s Agentic Commerce Protocol (ACP) UK merchants face a request to back interoperability they cannot yet observe. The 34% on regulatory guidance is the uncertainty premium they are paying for clarity the Mills Review has yet to deliver.
UK merchants also have nowhere to test what they choose. None of the card-scheme frameworks or web-native protocols have produced agentic transactions at meaningful volume on UK acceptance. Live deployment sits in LATAM, ASEAN, and parts of Europe. Preparation in the UK is a planning exercise, not an integration one, and that gap is wider on payment protocols than on discoverability because protocol validation requires a counterparty.
The flat ranking masks divergence by size. 42% of medium merchants select discoverability uncertainty, against 20% of small and 31% of large. Medium merchants, the band most actively integrating, are hitting the question of how agents will surface their inventory before they have built the answer. Technical standards uncertainty runs in a U-shape at 44% small, 30% medium and 46% large.
Active preparers are 21 percentage points more likely than non-actors to name discoverability as a barrier and 19 percentage points more likely to name technical standards. That gap reflects exposure. Non-actors cite regulatory guidance and resources more often, the barriers that surface before that wall.
Global card schemes and emerging payment protocols are racing to build the infrastructure required for agentic commerce. Their frameworks focus on a common challenge: how AI agents authenticate identity, evidence consumer intent, and execute transactions within existing payment and dispute systems.
Merchants were asked a simple question: if an AI agent autonomously completes a £2,000 purchase after being asked only to research options, who pays?
No single answer commands consensus. 24% of respondents say liability depends on the specific circumstances and contractual arrangements involved. A further 21% favour shared liability between multiple parties, while 18% place primary responsibility on the AI vendor or model provider. Smaller shares point to the payment service provider (15%), the consumer (13%) or the merchant itself (9%).
The fragmentation reflects a market operating ahead of settled regulatory and legal frameworks. Merchants are assigning liability based on differing assumptions about control, authorisation and accountability within the transaction chain.
Large merchants are more likely to place responsibility on the AI vendor, at 29%, compared with 12% among small and medium merchants. Merchants already preparing for agentic commerce also focus more heavily on the provider layer, suggesting operational exposure increasingly shifts attention towards the model itself.
The major card schemes are beginning to converge around a shared principle: authentication in agentic commerce must extend beyond the initial login. Verifying that an AI agent has authority to transact requires evidence that persists from delegated intent through to settlement.
American Express, Mastercard, UnionPay and Visa are all moving towards similar framework components: verified agents, tokenised credentials, captured purchase intent and richer transaction signals that can later support dispute resolution.
Existing Strong Customer Authentication rules under PSD2 and the FCA’s PS21/19 framework were designed around a human cardholder responding to a real-time challenge. An AI agent acting on delegated instructions does not fit that model cleanly.
American Express has provided the first concrete card-scheme liability response to agentic commerce. In April 2026, the company launched Amex Agent Purchase Protection alongside its Agentic Commerce Experiences (ACE) developer framework.
Under the model, eligible US cardholders using registered AI agents can receive protection for purchases resulting from agent error alongside existing dispute processes. The approach depends on verified agents, captured purchase intent and clearly defined boundaries around what qualifies as an eligible dispute.
The programme currently applies only within the United States and only to approved agents operating on the Amex network. Even so, the structure is instructive for UK merchants. It signals where scheme thinking is moving: towards persistent authentication, agent registration and evidential transaction trails that extend beyond traditional cardholder verification.
41% of UK retail merchants describe themselves as very confident in understanding liability frameworks when AI agents make purchases. A further 37% are somewhat confident, leaving 22% either in low-confidence territory or yet to consider the issue. At headline level, that suggests moderate preparedness.
Confidence falls sharply once the focus shifts from awareness to operational readiness. Among merchants with formal policies in place, 55% are very confident in liability frameworks. Among those without policies, only 14% are very confident, while 40% fall into low or no-confidence territory. The headline 41% is therefore driven largely by merchants that have already formalised governance.
The £2,000 scenario used in this survey does not yet have a settled legal answer in the UK. The merchants expressing the highest confidence are generally those that have already updated terms, mapped dispute evidence and assigned internal accountability.
The Senior Managers and Certification Regime (SMCR) is likely to become increasingly relevant to agentic payments governance. The FCA’s Mills Review is expected to examine how senior managers can continue to discharge accountability obligations where AI systems influence or execute consumer transactions.
The practical implication for merchants is operational rather than theoretical. If AI-related accountability expectations begin flowing through PSP contracts, scheme rules or insurance frameworks, firms may need named owners responsible for oversight of agent-driven fraud, disputes and transaction controls.
Global card schemes and web-native protocols are racing to build a unified commerce infrastructure that combines traditional consumer protections with stablecoin-powered microtransactions to enable AI agents to authenticate identity, verify intent, and execute autonomous payments.
Focused on registered-agent authentication and purchase protection.
Positioned around interoperable agent payments and verifiable intent.
Built around open interoperability standards for agent identity and consent management.
Focused on production-scale agent transaction infrastructure.
Alongside the card schemes, a second layer of agentic commerce infrastructure is emerging from the web stack itself. These systems are internet-native rather than card-rail-native, treating AI agents as direct economic actors on the web.
Two projects focus primarily on programmable payments infrastructure. A third focuses on identity and human verification.
Built around internet-native micropayments between agents, APIs and services.
Focused on programmable commercial payments for AI agents and services.
Designed as a delegated identity and human-verification layer for AI agents.
Agentic commerce has reached UK retail merchants but the ground beneath it is unsettled. The next 12 months set the direction. Merchants that move now on terms, systems and partners will be best placed.
The survey points to a clear ordering for operationalising agentic payments, but UK merchants should sequence that work against the staged reality of how agentic traffic will arrive. The first wave is unlikely to be fully agent-mediated. It is more likely to be agent discovery feeding a human-completed checkout, with the agent surfacing options and the consumer still completing payment through standard flows. Full agent-initiated payment follows later. The practical steps below are ordered for that staged path.
Start with discoverability. This is the layer that goes live first and the one merchants own directly. The actionable work is making inventory, pricing, availability and policy terms readable by agents through structured feeds and endpoints. Merchants that wait for protocol settlement before addressing discoverability will be invisible to agents during the interim phase, when agent-driven referral traffic is the form agentic commerce takes in practice.
Audit the operational stack next. Fraud, authentication and chargeback systems for agent readiness is the single most-selected first step at 43%. In the interim phase, the immediate requirement is recognising agent-driven referral traffic without blocking it. As payment authority transfers from consumer to agent, the same systems need to read authentication and intent evidence rather than just device and behavioural signals. Visa’s Agentic Ready programme, launched in Europe including the UK in March 2026, is one signal of where issuer-side systems are heading.
Build internal awareness alongside the technical work. Payments, fraud and legal teams have historically operated in parallel. Agentic commerce sits across all three. When an agent triggers a dispute, the legal team needs to read the authentication and intent evidence the fraud team has captured, and the fraud team needs rules that recognise registered agent traffic. Shared vocabulary and joint working between these functions now reduces the cost of integration later.
Agentic commerce is no longer a future-state question for UK retail merchants. A combined 58% believe AI agent have already visited their platforms. 72% are actively preparing or planning. None say it is agentic commerce is irrelevant.
What the survey also shows is how thin the underlying ground is. Only 41% of finance and risk leaders in merchant organisations are very confident in liability frameworks, and almost all of those are the merchants who have already done the contractual work. Standards uncertainty leads a flat set of barriers. The regulatory direction is set but not yet final.
The next 12 months will determine whether UK readiness moves with the wider market or behind it. The Mills Review reports in summer 2026. The HM Treasury Q2 2026 consultation will set the direction on Strong Customer Authentication and agentic AI. Card schemes are converging on tokenised credentials and registered agents. Web-native protocols are launching in parallel. None has yet been adopted as a UK standard.
The merchants best placed for that period are the ones already doing the work covered above: reviewed terms, audited fraud and authentication systems, built shared vocabulary across teams, mapped their PSP and acquirer roadmaps. The direction is set. The pace is the question.
UK merchants expect agentic commerce to grow rapidly, but uncertainty around liability, fraud, and standards is slowing readiness.
Stablecoins are moving into mainstream finance, reshaping payments, trade, and regulation as institutions explore faster, programmable settlement.
A forward-looking overview of key regulatory developments across payments, crypto and financial services, with timelines and practical implications.
You need to be logged in to do this!
