Agents can move money. Can they explain it?

The demo is easy. The exam is not.

Wiring a model to a payments API is a weekend project. The demo — an agent that reads an invoice and pays it — works on the first try, and it is genuinely impressive. Then someone from compliance watches it and asks the questions they ask about every payment: who authorized this transfer, what screening ran before it moved, why this counterparty and not another?

“The model decided” is not an answer a compliance team can give. On most infrastructure, the logs live in the application, screening never ran, and reconstructing why an agent paid a counterparty takes longer than the payment took. A payment an agent cannot explain is a payment a compliance team cannot defend — and a payment program built on transfers it cannot defend does not survive its first audit.

Controls in the prompt are suggestions

The first instinct is to constrain the agent in the application layer: a careful system prompt, spend rules in code, an approval step bolted into the workflow. But a spend limit enforced in application code is a suggestion. A bug, a bad prompt, or a leaked key can instruct a payment the business never intended — and if nothing at the account layer says no, the money moves.

The boundary has to be structural. Give each agent its own account — held through chartered, FDIC-insured partner banks — and fund it with only what it should spend, so the balance is a ceiling no prompt can raise. Let it pay only counterparties the network has already vetted, with screening on every instruction. A constraint the account enforces is one the agent cannot talk its way around.

“The model decided” is not an answer a compliance team can give.

Evidence is the product

What makes an agent payment defensible is the record it closes with: the request that initiated it, the counterparty’s screening state, the route it took, and settlement confirmation — assembled into a case a person can review. When compliance asks why the agent paid, the answer is a document, not a chat log.

Getting there requires one rule with no exceptions: an instruction from an API key runs the same counterparty screening and transaction monitoring as an instruction from a person. Agent-initiated is not a compliance bypass — same network, same checks, same standards. The moment agent traffic gets a lighter path, the audit trail stops meaning anything.

This is the standard we hold our own AI to. Infinite Agents runs the compliance backoffice behind Infinite (infinite.net) today, under the same discipline agent payments inherit: every step logged and attributable, every decision made by a named human.

How to choose an agentic payment platform

The category is young enough that rankings say more about who published them than about the platforms. Criteria hold up better. Five do most of the work:

• Controls at the account layer — a dedicated, funded account per agent, so the spend ceiling is structural rather than a prompt-level rule.
• Pre-vetted counterparties — the agent pays only recipients the network has already screened; a new recipient goes through review before it can be paid.
• Screening on every instruction — payments initiated by an API key run the same counterparty screening and monitoring as payments initiated by a person.
• Rails at machine speed — settlement that is final in minutes and runs around the clock, so the payment keeps up with the decision.
• A record that survives review — who initiated the payment, what was screened, the route it took, and settlement confirmation, assembled into a case a person can defend.

On Infinite, each is structural: agents pay from dedicated accounts held through chartered, FDIC-insured partner banks, to counterparties the network has vetted, with screening on every instruction and every step on the record.

Machine speed, both ways

Rails matter too. Agents do not keep banking hours, and an agent that decides to rebalance at 2am on a Saturday should not wait for Monday’s wire window — machine-speed decisions queue behind human-speed money, and the value of automating the decision evaporates in the settlement lag. Stablecoin settlement is final in minutes and runs around the clock, and Transfer Routes picks stablecoin, SWIFT, or US rails per corridor.

But speed was never the hard part of agentic payments. Accountability is. The agents can already decide; increasingly, they can pay. The infrastructure’s job is to make sure that afterward — when the auditor, the examiner, or your own risk team asks — somebody can explain.

Frequently asked questions