Software is starting to buy things on its own. An AI agent books the cloud capacity it needs, renews an API subscription, pays for a dataset, or settles a small invoice — without a human tapping a card at each step. This is the idea behind agentic payments: giving autonomous software the ability to transact within boundaries you define. For European builders the question is not just how to enable it, but how to do it on rails that fit EU regulation. This primer covers what agentic payments are, why they are emerging now, and the control model that keeps them safe.
What "agentic payments" actually means
An agentic payment is a transaction initiated by an autonomous agent rather than directly by a person. The human sets the policy — what the agent may buy, from whom, and up to how much — and the agent executes within that envelope. The distinction matters: the person authorises a mandate once, and the software acts repeatedly inside it, instead of approving every individual purchase.
In practice this means giving an agent a payment instrument it can use programmatically, fenced by hard rules. The instrument of choice is usually a virtual Visa card, because cards are accepted almost everywhere online and can be issued, limited and revoked instantly through an API. We go deeper on the mechanics in our guide to AI agent payments.
Why agentic payments are emerging now
Three things have converged. First, agents have become genuinely capable of multi-step tasks that include a purchase as one step. Second, most of what agents buy is digital and card-payable — compute, APIs, data, SaaS — so there is something concrete to pay for. Third, card platforms now expose API issuing fast enough to create a card in the moment an agent needs one and tear it down afterwards.
The result is a shift from "a human runs the workflow and pays" to "the agent runs the workflow, including settlement." That unlocks real efficiency — but only if the payment side is as controllable as the rest of the system.
Why Europe needs EU-native rails
A lot of agent tooling assumes a US payments backdrop. For European teams that is a poor fit. Money moving inside the EU should move over SEPA in euro, settle against an EU IBAN, and sit with a provider supervised under EU rules. Building agent spending on non-EU rails introduces currency conversion on every transaction, cross-border friction, and a regulatory mismatch that European finance and compliance teams will rightly question.
EU-native rails mean the euro account behind your agents, the card issuing, and the safeguarding of funds all live within the European regulatory perimeter. That is the backdrop 2card is built for: it is a marketing partner of myTU, an EU-licensed Electronic Money Institution supervised by the Bank of Lithuania. 2card is not a bank; myTU provides the EU IBAN, the Visa issuing, and the safeguarding and segregation of funds. Cards for AI agents draw from one SEPA-funded euro IBAN, so agent spend stays in-currency and in-jurisdiction.
The control model: limits, merchant locks, kill-switch
An agent without spending controls is a liability. The whole proposition rests on fencing what autonomous software can do with money. Four controls form the core model.
Hard limits
Every agent card carries a hard spending limit the agent cannot exceed. This is the primary cap: even if the agent misbehaves, loops, or is manipulated, its financial exposure is bounded by the number you set per card.
Merchant whitelists (merchant locks)
A merchant whitelist restricts a card to a defined set of merchants — your cloud provider, your data vendor, your API suppliers. The agent can transact where you expect and nowhere else, which neutralises a large class of errors and abuse where an agent is tricked into paying the wrong party.
Kill-switch (instant freeze)
If something looks wrong, you must be able to stop it immediately. Instant freeze is the kill-switch: freeze a card and the agent's ability to spend halts at once, with no other card affected. Replacement is equally fast when you are ready to resume.
API issuing and webhooks
Controls are only useful if your system can apply them programmatically and see what happens. API issuing creates a fenced card in roughly sub-200ms, and webhooks stream authorisation events — with authorisation decisions in roughly sub-100ms — so your software approves, logs and reacts in real time. We cover designing these guardrails in our guide to spend controls for AI agents.
The principle is least privilege applied to money: each agent gets the smallest spending envelope — a capped card, locked to specific merchants, that you can freeze in one move — that still lets it do its job.
SCA, PSD2 and the European context
European payments operate under PSD2, including Strong Customer Authentication (SCA), which is designed around a human confirming a payment. Autonomous agents sit awkwardly against a rule built for human presence, and this is one of the genuinely unsettled areas of agentic payments in Europe.
The practical implication for builders today is that the design space is still forming, and exemptions, mandates and merchant-initiated flows all interact with how an agent transaction is authenticated. The right posture is to keep agent spend inside a tightly controlled, EU-regulated envelope — hard limits, merchant locks, an instant kill-switch, and an EU IBAN with a supervised EMI behind it — so that whatever the authentication model, the exposure is contained. We are not offering legal or compliance advice here; confirm specifics with your own advisers as the regulatory picture matures.
Where this leaves European builders
Agentic payments are early, but the building blocks are real: capable agents, card-payable spend, and API-issued cards with hard limits, merchant whitelists and an instant freeze. The European-specific move is to put all of it on EU-native rails — euro, SEPA, an EU IBAN, and an EU-licensed EMI — rather than retrofitting US-centric tooling. If you are prototyping an agent that needs to spend, the sensible starting point is a single capped, merchant-locked card from your cards for AI agents setup, issued via API, that you can freeze the instant anything looks off.