AI can act, but cannot bear responsibility

An AI agent may select a counterparty, negotiate terms, interact with a smart contract and authorise payment. Yet it is not generally recognised as a legal person, therefore its outputs need to be attributed to a human being or organisation. The UNCITRAL Model Law on Automated Contracting, adopted in 2024, supports contracts formed or performed through automated systems, including AI and machine-to-machine transactions. It establishes rules for attributing automated outputs and addressing unexpected outcomes without requiring the system to possess legal personality. And the emerging direction is clear: autonomous execution does not remove human or corporate accountability.

Rome’s architecture of delegated commerce

Roman law distinguished between people who were legally independent (“sui iuris”) and those subject to another’s authority (“alieni iuris”). The “paterfamilias” was the legally independent head of the household and principal holder of its property. He was not a ‘beneficial owner’ in the modern legal sense but can be compared cautiously with a principal asset owner, trustee, company or family office. Nevertheless, commerce required others to manage farms, ships and businesses and so the peculium was a fund placed under another person’s practical administration whilst remaining connected to the principal. The Roman jurist Gaius, Institutes, Book IV, sections 69 to 74, explained that liability depended on the authority granted; where the principal expressly ordered a transaction or appointed someone to operate a business or ship, liability could extend beyond the peculium. In other circumstances, recovery might be limited by reference to that fund. Justinian’s Institutes, Book IV, Title VII later restated this graduated approach and, in today’s climate, the resulting lesson is clear:

The greater the authority given to an AI agent, the greater the potential exposure of the principal behind it.

Four questions for AI transactions

In the case of wallets, a separate wallet does not itself determine authority or liability; asset segregation, attribution and recourse remain distinct questions.

What modern cases tell us

In the case of Quoine Pte Ltd v B2C2 Ltd, algorithms entered cryptocurrency trades after a platform failure activated a fallback price. The Singapore Court of Appeal treated the deterministic programs as mechanisms selected by their human operators, rather than inventing a separate legal mind for the software. The case suggests that using an automated system does not necessarily allow its deployer to disown a resulting contract, with these limits of unchecked automation having been exposed by US global financial services firm, Knight Capital. In 2012, faulty software sent more than four million erroneous orders in forty-five minutes, producing losses exceeding $460 million. Unsurprisingly, the SEC found inadequate safeguards, testing and supervisory controls and imposed a $12 million penalty. The lesson is that an AI peculium needs more than a capped wallet — it requires transaction limits, cumulative exposure controls, approved counterparties, price tolerances and an effective suspension mechanism. Another example can be seen in the case of Moffatt v Air Canada, where a tribunal held the airline responsible after its chatbot gave a customer inaccurate information about bereavement fares. These decisions are not universally binding but illustrates that a business cannot assume its AI interface is legally separate from the organisation deploying it. Meanwhile, the Ooki DAO litigation has provided a related warning — a US court held that a decentralised organisation could be sued as an unincorporated association and treated as a person under the Commodity Exchange Act. Similarly, the SEC’s 2017 DAO Report emphasised that regulatory treatment depends on economic reality, not technological terminology. A wallet, smart contract, DAO or SPV may segregate operations but it cannot automatically override securities law, sanctions obligations, consumer protection or fiduciary duties.

Why England and Wales could lead

The Law Commission has concluded that the law of England and Wales can generally support smart legal contracts without wholesale statutory reform. It also identified areas requiring further attention, including deeds, jurisdiction, interpretation and remedies. The Property (Digital Assets etc) Act 2025 has further confirmed that digital or electronic assets are not prevented from being objects of personal property rights merely because they fall outside the traditional categories of things in possession and things in action. That improves certainty over digital property but it does not determine who is responsible when an AI transfers it. The commercial opportunity is to combine existing contract, property, trust, company and financial-services law with a technically enforceable AI mandate.

Building a modern peculium protocol

A modern AI peculium should be a legal and technical control framework where it would identify the principal and define the AI’s objectives, permitted assets, counterparties, jurisdictions and transaction types in a digitally signed mandate. Capital could be placed in a segregated wallet or account and smart-contract permissions would impose per-transaction and cumulative limits. Borrowing, pledging assets, using an unapproved protocol or exceeding a threshold would require human authorisation and instructions, data sources, decisions and transactions would be logged so the agent’s conduct could be reconstructed. Lawyers, trustees, directors, compliance officers or regulated custodians could validate authority, approve exceptional actions, preserve evidence and activate emergency suspension and insurance could then be priced against a measurable mandate and maximum exposure. Furthermore, ring-fencing would still have limits as it could not automatically exclude claims arising from fraud, negligence, sanctions breaches, regulatory violations, fiduciary misconduct or express authorisation by the principal. This all echoes Rome where liability depended not only on the assets allocated, but also on what was ordered, who benefited and how much authority had been granted.

The EU AI Act requires proportionate human oversight for high-risk systems, including the ability for authorised people to intervene or stop systems that are not operating as intended. The UK’s principles-based framework emphasises safety, transparency, accountability, governance and redress; both approaches point toward controlled autonomy rather than artificial personhood.

Autonomy without unaccountability

Roman law did not solve AI governance two thousand years in advance. It did, however, recognise that commerce could be delegated without leaving authority and liability undefined. AI agents do not need fictional personhood to contract and move value — they need intelligible mandates, restricted access to assets, transparent records, effective human control and credible recourse. Jurisdictions that build this architecture first could provide the trusted infrastructure through which autonomous commerce, machine-to-machine payments and AI-managed wealth operate at scale. Rome’s enduring lesson is that delegation becomes commercially useful only when authority, assets and accountability have clearly defined boundaries.

Rome’s 2000-year-old answer to AI liability: give the agent a budget, not legal personhood was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Written by Dan Feaheny, Fintechie

In the 1960s sitcom, Get Smart, Agent 99 and Maxwell Smart are a spy duo working for CONTROL. Across five seasons, we never learn Agent 99’s name. Sixty years later, agentic AI has the potential to utterly transform how work gets done and society functions. One asks, how can AI scale sustainably without a massive rethink around digital identity? AI agents are already trading tokens, managing treasuries, deploying capital, optimising yield and executing strategies. If AI can autonomously move data and value across the internet, agentic agent identity (KYA or know-your-agent) will quickly become the litmus test. Indeed, at a recent conference Nicolas Kokkalis, founder of Raspberry PI talked about one of the most urgent challenges in the AI era: how to maintain trust and verify real human identity as AI systems become capable of generating convincing bots, profiles and interactions at scale.

Source: X

Real-time systems

Real-time systems of intelligence converge across instant data streams, autonomous AI generated agents and tokenisation. As we transition from batch to real-time and from human to machine, then envision existential risks to the internet as we know it. Automation and orchestration without effective guardrails or strict governance is a recipe for disaster; with many more bots than humans processing data online, then an urgency for decentralised, user-controlled identity wallets increases from all corners. From data munching big techs to big government surveillance, there is an ever growing trust gap. Global angst amongst the next generation rises as AI embeds into workflows, decisioning and results. The opportunity for global banks is now. There are potentially two primary contenders for the custodial benefits of issuing identity wallets online and at scale: they are JPMorgan Chase and Revolut — both have global ambition, top talent and long-term vision. Let us square, therefore, the circle between privacy and security.

Payments (analogue to digital)

From card-based electronic payments of the ‘get smart’ era to today’s smart contracts, identity access and governance has become patchwork at best and reactive at worst. The levels of fraud and scams continue to rise exponentially; networked individuals and state actors penetrate weak defences and poorly designed architectures; financial regulators supervise reactively from antiquated advice and manual guidebooks. Visa Direct and Mastercard Move are swiftly becoming instant data exchange networks and platforms — leveraging global trust and brand, they aim to become default ecosystems for the internet of value. However, these two behemoths have little ambition in becoming identity issuers or wallet custodians.

Financial fraud and scams

Nasdaq Verafin just released its annual Global Financial Crime Report: illicit financial activity is now at a staggering $4.4 trillion; fraud and scams account for over $500 billion causing material losses for the victim and further erosion of institutional trust; and, criminal organisations and state actors move illicit funds across borders, jurisdictions and sectors in just seconds. Meanwhile, regulated institutions remain buried in technical debt and blinkered by siloed culture. Ultimately, which regulated banks are poised to capture both the commercial and societal benefits from issuing identity credentials via digital wallets for cross-border value exchange? Possibly, Revolut and JP Morgan Chase lead the pack — both have global ambition, top technology and financial platform thinking.

Fintech evolution

One must admire the speed of change since 2008. The smart phone has become the operating system for cross-border value exchange. Chinese leaders launched WeChat and AliPay via QR code, bypassing card networks and opening up vast fintech potential. Bitcoin and other derived blockchain protocols enable P2P stablecoins linked to base fiat currencies — hence all these leap-frogging innovations and digital identity becomes ever more patchwork and fragmented.

Digital identity

At sovereign level Europe, Australia and India are leveraging digital identity systems for both accessibility and inclusion to support citizen services online:

· European Digital Identity Framework (eIDAS 2.0) — Europe is building digital identity wallets allowing citizens to prove identity and credentials across borders.

· Australian Trusted Digital Identity Framework (TDIF) — a framework of rules and standards enabling secure, trusted and consistent digital identity verification, so forming the foundation of national Digital ID legislation.

· Indian Unique Identification Authority of India (UIDAI) — India’s digital identity platform now supports over a billion citizens and underpins financial inclusion, payments and digital public services.

Technology vendors, including Okta to Ping, deliver identity access and governance to protect stakeholders, customers and employees from hackers and scammers; operating systems from closed Apple iOS to open Google Android continuously monitor their ecosystems of applications to maintain data safely and securely. Moreover, banks use a patchwork of federated systems, third party support and proprietary databases to reduce fraud and protect their customers; SWIFT moves government fiat, and stablecoin platforms move digital assets. We picture a lack of interoperability between networks, systems and applications — the internet was never designed with an identity layer, but here we are. What would Agent 99 do?

Apps and infrastructure converging

Fintechs have taught legacy banks how to better serve their customers via better front end experiences. From cash to stablecoins and from batch to instant, digital rails collapse monolithic IT architectures replacing static core systems of record; agentic AI enables autonomous workflows horizontally across departments, borders and even jurisdictions; modern and scalable IT systems are continuously executing, highly automating and tightly interconnecting; table stakes are graph matrices and algorithms of BigTechs such as Facebook aka Meta; cloud technologies combine with data-intensive AI for instant decisioning without human inputs. Hence, we need far more data governance and codebase maintenance as data lineage and leakage get worse and the financial services industry needs KYA or know-your-agent tooling immediately to identify these machines and bots transferring money online on behalf of humans and entities. As the dream of Web3 and decentralised finance nears, identity wallets issued by trusted and regulated banks should help us all cross the divide resulting in a safer online world, including:

· systems that are transparent and verifiable

· networks that are global from day one

· economic models that align users, creators, developers and operators.

Infrastructure that does not depend on a small number of intermediaries

This half of this decade will shape the internet’s future for generations to come, so let’s help the banks issue identity and restore institutional trust for all. For decades banks protected money, governments protected identity and technology firms-controlled access to information. Yet agentic AI may collapse these boundaries into a single problem. An autonomous machine trading assets, initiating payments, signing contracts and interacting with governments cannot simply rely on usernames and passwords designed for humans. The internet was built around connectivity, not trust. And that design decision mattered little when people moved information; it becomes far more consequential when machines begin moving money, assets and legal rights. The institutions that issue and verify trusted digital identity may not simply control authentication. They may ultimately determine who can participate in the economy itself. So, the question is no longer whether AI needs an identity layer — the question may be whether future citizens, companies and AI agents require permission from whoever owns it.

The next banking war is not about money: it is about identity was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

How law and regulation are responding to technological change in digital assets and money: what does it mean for businesses?

Written by Brett Hillis, Partner Reed Smith LLP

Technological change is nothing new and legal systems have been responding to it since at least the introduction of the printing press. Changes in technology gives rise to questions that the law has not needed to answer before, or not at the same scale. To take an example, how should law and regulation respond to driverless vehicles? Should such vehicles be allowed on public roads? What safety requirements do such vehicles need to comply with? Who is liable for accidents caused by such vehicles?

Whilst there is an interesting history to how law and regulation respond to technological change, the purpose of this article is to identify different approaches that law and regulation is taking to technological change today, looking specifically at digital assets and digital money. These are important issues for business; the carrying on of transactions between AI agents is going to require some form of programmable money as measure of value and a means of exchange. Tokenisation has the capacity to reduce settlement times and make many transactions more efficient. At the same time, the stakes in decisions on where to invest feel higher than ever before, as such decisions face conflicting trends. Capital feels more mobile than ever and can search out opportunities across jurisdictions. Businesses have greater opportunities to create brand value globally and network effects create “winner take all” markets, where a Taylor Swift is dominant in a way no one else has been for decades. At the same time, countries are taking much more varied approaches to how these markets affect their economies. Some are adopting an “open doors” policy, others are pragmatically adopting regulatory regimes, whereas others have rejected these markets in favour of centralised national paradigms.

CBDCs vs private stablecoins

At present, the most obvious distinction is between those jurisdictions which are embracing private stablecoins, chiefly the US, and those looking to develop their own central bank digital currencies (all be it not using blockchain technology to do so), most notably China. Through the GENIUS Act, the US has developed a comprehensive regulatory framework for USD denominated stablecoins. The same time, the US has taken steps to prevent the establishment, issuance and use of CBDCs within the US. This ban affects not just foreign issuers but the US Federal Reserve itself.

China bans unapproved yuan stablecoins

At the other end of the spectrum, China has maintained a ban on cryptocurrency transactions since 2017, which continues to be extended. For example, earlier in 2026, China was reported to have banned unauthorised offshore issuance of yuan-pegged stablecoins. At the same time China has been promoting the digital yuan, which is seen as part of a strategy to reduce reliance on the US dollar. The two superpowers represent opposites in their approach and, while interesting geopolitically, their different approaches to this most obvious issue are not the most elucidating for businesses since the choice likely amounts to being ‘open for business’ or not. Of more interest are some of the more subtle distinctions regarding how countries are responding to digital assets and programmable money.

Laying the groundwork?

Before one gets to regulation, a fundamental question is the legal nature of digital assets — in particular, are they a form of property and, if so, what form of property? Answering these questions are key to establishing dependable ways in which digital assets can be used. A legal regime that does not reliably address these questions can leave the most basic questions for business uncertain. Whilst this may not stop innovation, it puts a break on investment especially where the underlying issue manifests itself. The way to approach these issues can vary between countries based on the legal system with courts, legislators, academics and trade bodies all potentially playing a role. In England, whilst there are critical voices, a response to these questions has received broad acceptance. Work on the issues proceeded through the UK Jurisdiction Taskforce’s (“UKJT”) Legal Statement on cryptoassets and smart contracts, Law Commission projects and decided cases, and included a short piece of legislation (the Property (Digital Assets etc) Act 2025) to address one specific uncertainty. Whatever the questions about regulation, attention to these essential issues of legal classification is vital.

Early regulation vs “wait and see”

Some jurisdictions moved early to set up regulatory regimes for digital assets. An interesting example was the EU and its MiCAR regulation. In setting out a regime early, MiCAR gave market participants a level of predictability about the scope and content of regulation. Having a clear target as to what businesses need to do and, crucially, certainty that it will not change with the political weather, has encouraged many international digital asset companies set up MiCAR regulated entities in response. That early approach can also act as an anchor, pulling the regimes of other jurisdictions towards it, in terms of the scope and content of regulation. The EU’s approach has generated a lot of institutional interest, and early regulatory adoption can build credibility. But early adoption risks rules becoming out of date. Much of MiCAR was already written by the time of the FTX collapse. It appears that the EU digital assets industry has achieved good growth with no obvious failures, but there is a perception (fair or unfair) of unnecessary friction in the EU regime.

An obvious comparator to the EU is the UK’s approach, which has been to move later and in a more piecemeal fashion seeking to learn lessons from other countries’ approaches. The UK introduced AML requirements for cryptoasset firms at the same time as the EU, then moved to regulate financial promotion and is bring cryptoassets fully within the UK regulatory perimeter, with effect from October 2027. The theory behind this approach is that it will better enable the UK to calibrate its regime to reflect the experiences of other jurisdictions. Certainly, the UK’s consultations on the new regime have been extensive and industry has been given a good opportunity to consider and comment on the potential new rules. Whether that effort is worth it will partly come down to the extent to which this work has produced a better regime, or one that industry and the public better understand.

But that is not the only factor. The “wait and see approach” has allowed some crypto businesses to develop and grow in the UK whilst complying with the more limited current or developing regime and gain traction and size whilst not imposing full regulation on them from the outset. On the one hand, these businesses face a more complex and changeable path to dealing with emerging regulation; on the other hand, some of that greater complexity only arises when they are in a better position to address it. The approach has also given the UK the time and space to work out its views regarding digital assets. There was considerable scepticism at the regulatory level regarding these products and markets but those views have become somewhat more balanced, although there is room for further movement. There is also evidence that UK authorities have been listening to industry (see its response to criticism of holding limits on stablecoins discussed below).

Embrace the substitutes?

One way to distinguish different countries’ approaches to this area is how comfortable they are with products and services that are substitutes (sometimes less than perfect substitutes) for existing products and services. More specifically, to what extent are they comfortable with holdings of stablecoins as a substitute for deposits? The US has established a comprehensive prudential regime for stablecoins through the GENIUS Act and appears unperturbed about any potential for holdings of stablecoins to reduce bank deposits and its effect on US financial stability. Stablecoins appears to be an acceptable substitute for bank deposits — indeed, the point seems hardly to have been raised. The UK approach has been different in that the Bank of England has been exercised about the effect on bank deposits. In part, this has been to avoid customer confusion — setting up guardrails to reduce the risks a stablecoin issued by a bank is, in fact, a deposit with deposit protection sitting behind it. This lies behind the Bank of England preventing banks issuing stablecoins except through a separate company. But the UK approach has gone beyond this and the Bank has proposed strict holding limits on stablecoins, a move which provoked industry backlash — even from the House of Lords. In response, the Bank has said it is examining alternative means of ensuring financial stability (e.g. through issuance limits). It will be interesting (and important) to see where it lands.

Are there lessons for firms from this experience?

I think there are several general points for those firms navigating policy in this field:

· understand how policy can shift — firms need to think through and hedge against how the policy approach can change, as demonstrated by the variety by the shifts in US policy.

· good regulation can build credibility — there is comfort in dealing with firms that are well-regulated.

· respond to consultations — whether through trade associations or on your own. It may well make a difference.

The battle over stablecoins, CBDCs and tokenisation is often presented as a technology story. It is not. It is a competition for economic influence. Just as previous generations fought to host stock exchanges, payment networks and internet platforms, today’s race is about who controls the rails of programmable value. The jurisdictions that get law and regulation right will attract capital, talent and innovation. Those that get it wrong may discover that in the digital age, financial leadership can migrate far faster than anyone imagined.

How law and regulation are responding to technological change in digital assets and money: what… was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.