Why JPMorgan Payments Chose Silence on Agentic Commerce: A Cautious Strategy Built Around the Liability Question

Why the largest payments player chose silence

Inside JPMorgan Payments agentic commerce strategy

Prashant Sharma, JPMorgan Payments' executive director of biometrics and identity solutions, spoke with American Banker about agentic commerce and how liability is shifting as a result of large language models such as OpenAI and Claude.

www.americanbanker.com

In a year when Stripe shipped the Agentic Commerce Protocol, Mastercard launched Agent Pay, and Visa pushed its Trusted Agent Protocol, one player has been conspicuously quiet: JPMorgan Chase, the largest credit card issuer by purchase volume and the largest merchant acquirer in the US.

The reason has now been spelled out by Prashant Sharma, JPMorgan Payments' executive director of biometrics and identity solutions, in an interview with American Banker. 'There was a reason why we were actually pretty quiet,' Sharma said, 'because we wanted to make sure that we have a very clear idea in terms of what's real, what's not real, and how any of these announcements — whether it's protocols or anything else — are going to have an impact on the merchants and consumers.'

Richard Crone, CEO of Crone Consulting, called JPMorgan's position 'top of their class' and said the bank 'really represents the biggest opportunities in agentic commerce for all the banking industry,' according to American Banker's reporting. When the largest payments player in the country deliberately stays silent, the silence itself becomes a signal.

That doesn't mean JPMorgan has been inactive. On March 10, 2026 the bank announced a strategic partnership with Mirakl, pairing the French commerce software company's Nexus catalog-optimization layer with JPMorgan's payment infrastructure and risk controls. What the silence reflects, instead, is a set of unresolved structural problems sitting just beneath the marketing layer of every protocol announcement.

'AI-embedded commerce' versus the real thing

The most revealing detail in Sharma's interview is a terminology choice. 'What everybody calls agentic commerce today is not really agentic commerce,' he told American Banker. 'At this particular point, it's another channel where the consumer is making a purchase. We actually call it AI-embedded commerce.'

The distinction matters. Take OpenAI's ChatGPT Instant Checkout, which lets users buy from Etsy and Shopify merchants directly inside a conversation. OpenAI itself emphasises that 'users stay in control — they explicitly confirm each step before any action is taken.' That is AI assisting a purchase, not an AI transacting on the user's behalf.

Sharma's reference scenario for 'true' agentic commerce is far more ambitious: 'If I tell my agent, "Go find me a plane ticket from New York to London for five days. I want to stay at a five-star hotel near Tower Bridge, and get me a rental car," and three days later, the agent goes and just does that transaction.'

The gap between that vision and today's reality is exactly why JPMorgan is cautious. Is the infrastructure at the airlines, rental car companies, and hotels ready to receive agent requests? Can merchant catalogues describe their inventory at the fidelity conversational commerce demands ('a blue t-shirt in size medium under $100 that can be shipped to my house in the next two days, made of sustainable material')? The early protocols even forced agents to buy one product at a time, which Sharma flagged as obviously impractical for either side.

The honest framing here is that the industry is performing 'agentic' while shipping 'AI-embedded'. JPMorgan's vocabulary makes that gap explicit.

The liability shift model breaks when a fourth party joins

The point Sharma keeps returning to is liability, and it's worth dwelling on because nobody else in the industry has explained it this plainly.

Card payments today rest on a liability shift model that took decades to settle, anchored by 3D Secure. The principle is simple: the issuer is expected to authenticate every transaction. If the issuer authenticates and something goes wrong, the issuer is liable. If the merchant fails to invoke 3D Secure, the merchant is liable. That's how the model works today.

Insert an AI agent as a fourth party and the logic starts to crack. Sharma's worked examples are instructive:

'If I as a consumer say, "Go find me the cheapest iPhone in silver," and for whatever reason the agent buys me a blue color phone, who's going to be liable? In this case, based on intent, the merchant would take liability.' That one is manageable.

Things get harder as intent data gets richer. 'I want you to find me a blue t-shirt in size medium under $100 that can be shipped to my house in the next two days. It needs to be made of sustainable material — and let's say the t-shirt the agent bought met every criterion other than it's not made of sustainable materials. Where does it stop? Who's the entity that determines which entity made the mistake?'

Hallucinations are worse still. 'What happens if the agent hallucinates and instead of buying that one phone, it went and bought me five phones? The merchant still presented the right product. Ideally the agent should take liability. But if you think about the current payment ecosystem, having another entity be part of that liability model — it's just not going to work.'

That last point exposes the deepest structural issue: an AI agent cannot legally be a liable party. The industry has been trying to engineer around this with scoped tokens. Stripe's Shared Payment Tokens can be scoped to a specific seller, bounded by time and amount, and observed throughout their lifecycle via webhooks. Mastercard's Agent Pay issues a unique token per agent, creating cryptographic accountability at the agent level.

Identification is one thing; assigning liability is another. Because an agent cannot be a legal counterparty, someone in the user-merchant-issuer triangle still has to absorb the cost. One school of thought, which Sharma cites, places it on the user: 'You are my friend and I gave you my card and said, "Go to Apple Store and buy me this phone." But you made a mistake and bought a different item. It's not the merchant's fault, it's not the issuer's fault, it's the user's fault.' Sharma is candid that there isn't a settled answer: 'These are the discussions we are having between the payments side and the consumer banking side.'

Where JPMorgan expects autonomous agent transactions to land first

Despite the caution, Sharma is specific about where this lands first. American Banker's forward look notes that JPMorgan expects 'autonomous agentic transactions to first appear on merchant's own websites, using their own agents.'

That's the cleanest scenario from a liability perspective. A merchant fully controls its own agent's behaviour, contains any hallucination fallout inside its own walls, and runs payments through unchanged flows. There is no fourth-party puzzle to solve because the merchant is the agent operator.

Stripe's experience reinforces the same direction of travel. OpenAI initially planned to build its own checkout inside ChatGPT, but in March 2026 shifted that plan to let merchants keep their own checkout experiences, with OpenAI focusing on product discovery. The locus of agentic commerce is moving from agent-side checkout UI to merchant-side data and merchant-side agents.

Sharma adds another reason the merchant-owned scenario will arrive first: loyalty. 'Most of the large merchants have some kind of loyalty platform. We all love our points. If I'm doing a transaction with the merchant, I want to make sure my points are getting accumulated. I want to make sure I'm identified as a premier shopper.' Preserving loyalty mechanics through a third-party agent is not a minor implementation detail; it shapes whether consumers will use these flows at all.

What this means for ecommerce operators

JPMorgan's restraint is itself a message: ecommerce teams do not need to overreact to every protocol announcement. The harder question is what to actually prepare.

First, catalogue depth that can survive conversational queries. Sharma's framing — 'conversational commerce is very different from keyword-based search. There is just so much data that users are providing. If the merchant catalog does not have that level of detail, these products are not going to be shown' — is the agent-era version of SEO. Catalog optimisation layers like Mirakl Nexus become structurally important.

Second, internal alignment on liability handling. Before third-party agent transactions go mainstream, an own-site own-agent rollout is the most realistic first step. Wrong orders, hallucinated quantities, and ambiguous intent need pre-agreed playbooks across payment operations and customer service.

Third, loyalty integration design. Stripe's SPTs and Mastercard's Agent Pay tokens both carry user identifiers, but binding them to a merchant's own CRM and points system is bespoke work that each operator has to handle.

Closing thoughts

JPMorgan Payments' silence isn't conservatism for its own sake. It reflects an honest reading of unresolved problems: the liability shift model that anchors decades of card economics cannot accommodate a fourth party that is also a non-liable entity. No single firm solves that.

What JPMorgan is also signalling, though, is a direction of travel: merchant-owned agents first; third-party autonomous transactions later. Ecommerce operators should treat this as a sequence, not a choice. The work to do now isn't to integrate every protocol that ships; it's to deepen the catalogue, design own-site agent experiences, and align internal teams on who absorbs what when things go wrong. Whoever builds those muscles during the 'AI-embedded commerce' phase will be in the strongest position when the genuinely agentic phase finally arrives.