The card networks have shipped agent protocols on their rails. Account-to-account rails have not. Interac, SEPA Instant, FedNow, and open banking under PSD3 are where most of the agent risk will land, and the burden of detection sits with the sending and receiving institutions directly. This article explains why and what to do about it.
Why A2A rails are different
A card transaction carries structured context: issuer, acquirer, scheme, MCC, 3DS data, now agent token. The rails were designed by central operators who ship upgrades to the entire ecosystem.
A2A rails are different. Interac, SEPA Instant, FedNow, and open banking do not have a central operator who can require every participant to deploy an agent protocol. The messaging formats are leaner. The authentication is between the bank and the user, not between an agent and a network.
What this means for Canadian banks on Interac
Interac e-Transfer is the dominant A2A rail in Canada. If a customer gives an AI agent access to initiate transfers through the bank's open banking or agent integration, the resulting Interac transaction looks indistinguishable from any other customer-initiated one at the rail level.
The bank's fraud model has to detect agent-specific patterns from its own data. Agent indicators carried in the bank's own API, session fingerprints, counterparty history, and intent context are the only signals available.
What this means for European banks under PSD3 and the PSR
PSD3 and the Payment Services Regulation expand open banking and move more consent handling into regulated channels. AI agents will arrive through those channels. The regulations themselves do not include a trusted-agent protocol.
The bank is still responsible for strong customer authentication and for the fraud consequences of a transaction executed in its name. Agent-aware fraud detection on SEPA Instant and open banking rails is a direct consequence of this responsibility.
What this means for US banks on FedNow
FedNow processes real-time, final payments. When an agent initiates a FedNow payment on behalf of a user, the irrevocability of the rail amplifies the consequence of letting fraudulent agent activity through.
There is no FedNow-level trusted-agent protocol. The sending bank has to decide, in real time, whether an agent-initiated instruction should be executed, with only the data its own systems carry.
The practical consequence
For every A2A rail, the trusted-agent protocol gap means the bank's fraud layer carries the full detection burden. Features banks need now: agent indicators captured from their own channels, mandate state carried from the bank's own consent layer, intent-vs-cart divergence inside the bank's agent integration, agent reputation built from the bank's own history, and cross-rail velocity across the user's full account.
UMCA Agent Risk Intelligence works natively on A2A rails. It does not require a network-level protocol to function. Where the bank captures the agent indicator and mandate state, the platform uses it. Where it does not, the platform operates on behavioural signals that still distinguish agent-driven activity from direct customer activity.
