The IMF published How Agentic AI Will Reshape Payments. The diagnosis is solid — agent identity gaps, liability mismatches, AML models trained on human behaviour breaking when software initiates transactions. If you read The Payment Lasagna, you’ve seen this map before. (Fewer food metaphors in the IMF version.)

The paper proposes a three-layer framework:

Layer 1 — Intent and Orchestration — covers the probabilistic agentic systems that translate high-level user objectives into structured instructions. Layer 2 — Control and Authorization — is a strictly rules-based boundary. Layer 3 — Settlement — preserves accountability and finality.

Three layers instead of the six I mapped. This is what most “innovation” in payments does — collapse two or three functional layers into one and call it progress. But the functions those layers perform don’t disappear. Identification still needs to happen. Authentication still needs to happen. Disputes still need resolution. You can redraw the diagram with fewer boxes. The real-world plumbing doesn’t care about your diagram.

Every protocol in the agentic space is doing the same thing. Stripe’s ACP collapses acceptance and authentication into a single checkout flow. The schemes collapse agent identity into existing token infrastructure. The IMF collapses six layers into three. The boxes get cleaner. The interdependencies stay exactly as messy as they were.

The paper recommends Know Your Agent registries coordinated by an international body, new authentication frameworks, real-time compliance monitoring. Each reasonable in isolation. But regulation doesn’t work by targeting the future. Regulation works by understanding what happened, then fixing what’s broken in the present. That’s how PSD2 worked — it responded to a market reality where TPPs already existed and needed a framework. That’s how AML regulation evolved — from observed patterns of abuse, not speculative ones.

The IMF is trying to regulate a future that doesn’t exist yet, built on assumptions about how agents will behave at scale. That’s a framework built on unknowns. And regulation built on unknowns doesn’t constrain the future — it gets outrun by it. PSD3 is expected by end of Q2 2026 and doesn’t mention agents. By the time a KYA regulation is drafted, consulted, transposed, and enforced, the agents will have been transacting for years under whatever rules the infrastructure providers built in the meantime.

The IMF asks what should be built. It doesn’t ask who should build it.

The answer is issuers. As I argued in Know Your Agent, they already own the ACS, the cardholder relationship, the risk data, the enrolment infrastructure. Agent enrolment is an issuer service, not a regulatory framework. The infrastructure is there. Issuers don’t need to wait for the IMF to coordinate an international registry. They need to build the service and let regulation catch up to what’s working, not what’s imagined.

New cheese topping. Same lasagna.