Law in the era of digital payments: the conditions for a competitive market

Contracts and competition are two essential elements for a functioning market. Contracts govern the relationships between parties; competition shapes the environment in which those relationships are formed, defining the alternatives available and the terms of exchange. Technological innovation is affecting both, including in the financial sector, by altering market structures, the relationships between market participants, and the conditions under which businesses and consumers exercise their contractual freedom. This raises significant questions for both the law and regulation.

I would like to address this topic through the lens of payments, where some of the most significant transformations driven by technological innovation are particularly visible. A digital payment can no longer be understood simply as the execution of a funds transfer order given by a customer to their intermediary. It is often the outcome of a complex value chain: when purchasing a music streaming subscription via smartphone, for example, alongside the customer and their bank, the transaction may involve the device manufacturer, the payment scheme operator, the operator of the platform underlying the app store and operating system, and several technology providers.² With the development of agentic artificial intelligence, even the search for goods and services and the execution of the payment can be delegated to systems capable of acting on the user's behalf.

Payment thus remains a key element of the contractual relationship, yet its functioning increasingly depends on the interaction of multiple players.

This changing structure also affects competition conditions. An operator's ability to provide a service increasingly depends on access to the infrastructures, data, interfaces and algorithms that form the backbone of the market.

Over the past decade, the European regulatory framework for banking, finance and competition has therefore supplemented traditional ex post remedies with a more prominent ex ante regulatory dimension, aimed at preserving market access and contestability and addressing the risks posed by technological bottlenecks.

Against this backdrop, I would like to highlight three fundamental questions for the law.

Who is liable? How should liability be allocated when the parties to the contractual relationship are not the same as those that actually hold the information and tools needed to prevent risks?

How can market access be ensured? When and how should the law intervene if the key inputs for competition, such as data, interfaces and technological standards, are controlled by private actors?

What sustains trust in the payment services market? Aside from reliable data and resilient infrastructure, what features must the legal framework have for the market to function safely and effectively?

These three questions form the lens through which I would like to examine the evolution of the European payments market and, more broadly, the role of the law in shaping the conditions for a competitive and innovative digital ecosystem that protects its user. They are complex issues with no immediate or definitive answers, but I believe they are worth raising here to contribute to the discussion at this conference.

1. Who is liable? From the contract to the value chain

The growing complexity of the payment chain makes the attribution of liability more difficult: this is a legal issue that must be addressed to avoid adverse consequences, especially for users.

A further challenge is the speed of execution. In instant payments in particular, there is very little time to intervene in the event of error or fraud, while remedial action after the event often proves complex and costly, not least because losses may have to be allocated between operators and users. Protection must therefore increasingly shift upstream: data quality and security, information verification, user authentication and fraud prevention safeguards all become essential.

The need for prevention is heightened by the constant evolution of fraud techniques. By introducing mandatory strong customer authentication, the second Payment Services Directive of 2015 (PSD2)³ effectively countered the forms of fraud that were most widespread at the time; since then, however, more sophisticated methods have emerged, including forms of social engineering that manipulate the payer.⁴ Changes in fraud techniques also affect the allocation of liability, which should reflect the actual capacity of the various parties to prevent errors, unlawful conduct and harm.

More recently, this approach has been extended. Verification of Payee has been mandatory since 9 October 2025 and brings protection forward to the stage preceding the execution of a credit transfer.⁵ This safeguard is particularly important because of the spread of instant credit transfers and is consistent with Recommendation 16 of the Financial Action Task Force (FATF) on payment transparency.⁶

The third Payment Services Directive and the Payment Services Regulation (PSD3 and PSR) - whose texts are now consolidated and will shortly be formally adopted⁷ - will further strengthen user protection. They will clarify responsibilities along the value chain and, for the first time in payments legislation, directly involve online platforms and electronic communications service providers in fraud prevention.

Overall, customer protection requires a clear distribution of responsibility along the value chain. Customers remain responsible for using payment services diligently and service providers must actively protect their customers, including when some functions are outsourced to third parties. In addition, with the new regulation online platforms could be held liable if they fail to remove fraudulent content that has been reported to them and this has led to a customer being reimbursed by a provider.

Finally, authorities must safeguard the functioning of the value chain as a whole, monitoring risks at each stage and promoting comparable safeguards for comparable risks. The aim is to ensure that the growing number of actors involved does not increase uncertainty in establishing responsibilities and does not make it more difficult for users to exercise their rights.

2. How can market access be ensured? Bottlenecks

The second theme concerns the conditions for effective access to the data, infrastructures, and technological functionalities needed to compete.

a. From open banking to the market power of platforms

Open banking clearly illustrates how technological conditions and the economic incentives resulting from the legal framework can shape effective competition in the market.⁸ With PSD2, the European Union sought to open up a traditionally bank-centric market, based on a clear competition rationale: allowing third parties, with the customer's consent, to access financial information held by banks and other operators with established positions can lower the entry barriers in the payments market and foster the development of innovative and more efficient services.⁹

Experience has shown, however, that formal openness does not necessarily translate into effective contestability.¹⁰ An operator may be entitled to enter the market and yet face technological obstacles that limit its ability to compete effectively. These difficulties may include poorly functioning or frequently unavailable application programming interfaces (APIs), authentication procedures that are more cumbersome than those used in proprietary channels, or data access that is technically possible but not equivalent to that enjoyed by incumbents.¹¹

The same dynamics can be observed in proximity payments using Near Field Communication (NFC) technology.¹² Where access to this technology is controlled by the smartphone manufacturer, the terms of access can directly affect competitors' ability to provide payment services. The European Commission intervened over restrictions on access to NFC technology on iPhones, which at the time was reserved for Apple Pay. The proceedings, launched in 2020, concluded in 2024 with Apple committing to opening access to competing wallets.¹³ In parallel, with the Digital Markets Act (DMA) of 2022, the European legislature imposed interoperability obligations on gatekeepers for this and other technological functionalities.¹⁴

A similar issue arises, on a broader scale, in the app economy - that is, the purchase of digital goods and services through mobile applications and the associated ecosystems.¹⁵ The operators of the main operating systems and app stores control the distribution channels for mobile applications and can influence which payment systems developers and customers may use, as well as the fees to be paid. Numerous antitrust and regulatory interventions show how control over a distribution channel can translate into power over the terms on which other operators reach customers.

A similar logic underpins the design of the digital euro.¹⁶ Recognizing the right to use it requires access to the technological channels needed to exercise that right. For this reason, the proposed regulation¹⁷ requires device manufacturers and communications service providers to grant access on fair, reasonable, and non-discriminatory (FRAND) terms to the hardware and software components needed to make digital euro payments, both online and offline.

Taken together, these examples highlight the growing importance of control over the technological nodes on which service provision depends.¹⁸ When such control is concentrated among a few players, these nodes can become bottlenecks that restrict competition. For market access to be effective, rules and their implementation must therefore ensure economic and technological conditions that make such access possible in practice.

b. The challenges of agentic AI

Agentic artificial intelligence marks a further step, bringing together two issues already discussed: responsibilities along the value chain and access to key interfaces through which users reach services.

Personal AI agents are becoming widespread in the United States¹⁹ and are beginning to emerge in Europe as well. In digital commerce and finance, these agents can perform different functions.²⁰ They may simply assist users in searching for and comparing products and services, leaving the final decision and payment execution to the user; or they may be given a broader mandate, selecting and completing transactions autonomously on the user's behalf, within predefined limits.

It is this second mode of operation that raises the most difficult questions. Once an agent can act on a user's behalf, the consistency between the objective assigned, the scope of the mandate and the agent's actual behaviour becomes critical.

Greater discretion granted to agents makes the problem of alignment more acute.²¹ As early as 1949, Norbert Wiener, the father of cybernetics, observed that granting autonomy to machines capable of learning creates the possibility that their behaviour may diverge from their creator's intentions.²² An agent tasked with minimizing the price of a purchase, for instance, might favour goods of illicit origin unless such a constraint were explicitly stated in its instructions.²³

An even more speculative frontier is that of model welfare, which illustrates how rapidly the categories through which we reason can change. The debate explores whether AI systems might develop mathematical structures similar to moods and preferences, drawing inspiration from the functioning of the human brain.²⁴ If such factors entered an agent's decision-making process, it would become even less clear to what extent it should adhere to the user's mandate.²⁵

When the agent moves from assisting the user to acting on their behalf, two questions return to the fore: who is liable for its actions, and on what terms it can access services.

On the first question, establishing that the agent was authorized by the user does not necessarily resolve the issue of liability. If an agent deviates from the instructions, or is compromised through vulnerabilities in its code or in payment protocols (a threat that AI may make more pervasive), liability can be difficult to allocate: multiple providers, as well as sophisticated and opaque technologies, may be involved in an agent's development and operation.²⁶

In payments and account access, PSD2 already provides a regulated framework for third-party providers, setting out conditions for access, consent and authentication.²⁷ It remains to be seen, however, to what extent this regulatory framework, designed for supervised third-party intermediaries, can also apply to AI agents. A further issue is how payments legislation will interact with the obligations imposed - including under the European Artificial Intelligence Act - on providers and professional deployers of such systems. Their application to agentic commerce remains largely unexplored.

On the market-access side, tensions have already emerged. In September 2026, Amazon blocked Meta's personal agent Muse from accessing its website.²⁸ Apart from the reasons given, which reportedly related to the identification of the agent, the case illustrates how a platform may determine whether, and on what terms, an agent chosen by the user can operate within its ecosystem, particularly when the platform offers an agent of its own.²⁹ More broadly, whether agentic commerce develops through open systems or through more closed ecosystems could affect the user's freedom of choice - including among payment service providers - and the opportunities available to competing operators.

3. What sustains trust? Legal certainty, consistency and adaptability

This brings us to the third question from which we began: what sustains trust in the payment services market?

Trust rests on several elements: access to safe public money; secure and resilient technological infrastructures, reliable data and the way in which they circulate; sound service providers subject to robust prudential requirements; and effective supervision to protect customers and oversight of the payment system. Trust also depends on the quality of the legal framework, which must remain effective as technology and markets evolve.

In this regard, three principles, none of which are new, take on particular importance.

The first is legal certainty. Market participants must be able to identify the rules that apply and the consequences of their choices. Yet certainty also requires those rules to be intelligible to their addressees. Rules built around concepts and language familiar to specialists but remote from users may reduce their effectiveness and undermine trust. Technology can also complement legal certainty by providing forms of operational certainty.³⁰ Cryptography can help identify parties and protect information to a high level; distributed ledger technologies can support the automatic validation of complex transactions. The relationship between law and technology therefore becomes increasingly close: the law defines the objectives and allocates liability, while technology can provide tools to make those rules effective.

The second principle is the consistency across applicable rules. When different regulatory instruments intervene on the same technological nodes (such as competition law, payments regulation and the digital euro framework), their objectives and mechanisms must be part of a coherent overall design. Otherwise, regulatory layering risks producing overlaps and misalignments that hinder innovation and investment. Simplification, which has recently become a priority objective on the European agenda,³¹ should also be seen in this light: greater consistency across rules, clearer responsibilities and proportionate requirements can reduce fragmentation and make it easier for operators to enter and grow in the European market.

The third principle is the adaptability of the legal framework. Rules must remain effective even as technologies and business models evolve. This requires principles that are sufficiently general and stable, anchored to fundamental values, and complemented by technical regulation capable of adapting their implementation more rapidly to technological change.³²

Legal certainty, consistency and adaptability respond to three complementary needs: making the rules predictable from the outset, ensuring coherence across the legal framework, and preserving effectiveness over time. In digital ecosystems, the ability of the law to meet these three needs directly affects the quality of the market and, ultimately, its competitiveness.

4. The conditions for a competitive European market

For Europe, strengthening competitiveness also means creating the conditions for innovation and investment to flourish, for firms to achieve sufficient scale, and for services to be provided more easily across national borders. In payments, this requires an open, integrated and competitive market at European level.

The three questions with which we began help to point out some of these conditions.

Who is liable? A clear allocation of responsibility along the value chain, including for innovations such as agentic payments, strengthens risk control and supports innovation and investment.

How can market access be ensured? The legal framework must establish access conditions and incentives that allow new entrants to enter the market, existing firms to grow, and all participants to compete on a European scale.

What sustains trust? Reliable data, effective consumer protection, resilient infrastructures, access to safe public and reasonably predictable rules are all essential.

These issues concern all the actors in the legal system, including market authorities. As value chains become more complex and extend beyond the traditional financial perimeter, closer cooperation is needed among the authorities responsible for financial supervision, competition, data protection and cybersecurity, with due regard to their respective remits. The international dimension of services also makes cross-border coordination essential.³³

In an increasingly digital economy, the law helps shape the conditions under which the market operates. The quality of these conditions can contribute to the European market's capacity to innovate, grow, and compete.