Not on its own, and not yet. An AI agent can already carry out narrow treasury tasks, such as paying approved invoices in stablecoins or sweeping idle cash, inside limits that people set. With 49% of institutions in one industry survey already using stablecoins for payments, the real question is how much authority software should get once treasury money is programmable.
A note on the legal and regulatory points here: they summarise public sources as of November 2026 and should not be relied on. Rules for AI agents are still being written, and some of what is described here is proposed or coming soon rather than settled. Check the current position, or ask a qualified professional, before acting on it.
What would an agent actually do in a company treasury?
An agent would do the repetitive, rule-bound work of treasury, while people keep the decisions that set policy and carry accountability. A treasury team makes sure the company can pay its bills, holds enough cash and avoids needless risk. Much of that work is checking balances, moving money and reporting, and software can already do those parts.
Here is how the work splits today, in our judgement:
| Treasury task | What an agent can do now | What stays with people |
|---|---|---|
| Cash positioning | Pull balances across wallets and accounts, flag shortfalls | Decide the minimum cash buffer |
| Payments | Pay pre-approved invoices in stablecoins, up to a cap | Approve new payees and anything above the cap |
| Idle cash | Sweep balances into an approved holding, within set bands | Decide which holdings are approved at all |
| Rebalancing | Trade back to a target mix when it drifts | Set the target mix and the risk limits |
| Reporting | Log every action, with the data and reason behind it | Read the log and sign off |
The pattern is simple: the agent executes, and humans authorise. An August 2026 academic chapter on agent finance calls the central design problem bounded autonomy. The question is not whether the agent acts, but how tightly its authority is drawn.
Why is this suddenly a real question?
It is a real question because the money itself has become programmable. In a 2025 industry survey of nearly 300 executives at banks, fintech firms and crypto companies, 49% said they already use stablecoins for payments. Another 41% said they were piloting or planning to, with cross-border business payments the leading use.
The rules are firmer than they were. In the US, the GENIUS Act, a federal framework for payment stablecoins, was signed into law on July 18, 2025. Wallet standards are moving too. A draft Ethereum standard, ERC-7715, describes how a wallet can grant an app permission to act for its owner, with an expiry date and a spending allowance, and how that permission can be revoked.
The agent payments themselves are still small. A crypto investment firm’s report counted about $73 million settled by AI agents across about 176 million transactions between May 2025 and April 2026, well under a dollar each. That is micropayments, not corporate treasury. Our reading: the plumbing exists, but very few companies are letting an agent move treasury-scale sums.
Who holds the keys if an agent is doing the work?
The agent should hold a narrow, revocable permission, never the keys that control the treasury itself. This is the most important design choice in the whole setup. If the agent holds the master keys, every safeguard becomes a suggestion it could ignore, or be tricked into ignoring.
In practice that means three separate layers:
- Keys. They sit with a custodian or a multi-approval arrangement that the agent cannot override.
- Delegated authority. The agent gets a spending cap, a list of approved destinations and an expiry date. Nothing more.
- Policy. A named person or committee owns the rules that define those limits, and can change or cancel them at any time.
This page is not a guide to custody itself; the point here is narrower. Whatever custody model a company picks, the agent should sit outside it. It asks for actions. It never holds the means to take them alone.
What do regulators expect from firms that use agents?
Supervisors are asking for four things: limits, an audit trail, humans in key decisions and a way to switch the agent off. In October 2026, US bank supervisors at the Federal Reserve, the OCC and the FDIC were reported to be asking banks what limits apply to their AI agents. They also asked whether agent decisions can be tracked and audited, what stops an agent exceeding its authority, whether humans stay involved in key decisions, and how a bank would shut autonomous systems down.
The same reporting said the agencies were still gathering information rather than setting rules. Even so, those questions make a sound template for any company, regulated or not. AI is already common in finance: a 2024 survey by the Bank of England and the FCA, cited in the academic chapter above, found 75% of UK financial firms already used AI. In 55% of reported use cases there was some automated decision-making, though few were fully autonomous.
What could go wrong?
The biggest risk is an agent that does exactly what its inputs tell it, when the inputs are wrong. A treasury agent reads invoices, prices, emails and data feeds. A fake invoice, a manipulated price or prompt injection, where an attacker hides instructions the agent then obeys, can turn a correct process into a wrong payment. On a blockchain, most payments cannot be reversed.
Three other risks are specific to agents:
- Permission creep. Limits rise one exception at a time until the cap no longer means anything.
- Correlated behaviour. In October 2026 remarks, listed in the CFTC’s index of public statements and remarks, the CFTC chair warned that systems built on similar models may trade in similar ways. Many companies running similar agents could all sell the same asset at once.
- Liability. The same remarks asked openly who is liable if an agent goes rogue. There is no settled answer yet, so plan as if the company and its officers carry the loss.
Then there is the 99% problem, which is our judgement rather than a measured finding. An agent that is right almost every day earns trust, and trust leads to lighter review. The day it is wrong may be the day nobody is checking.
The trust takeaway
An AI agent can run parts of a treasury. It should not run the treasury. The model that holds up is a narrow permission, kept outside custody, with a log that a person actually reads.
Before a company lets an agent touch treasury funds, ask:
- Does the agent hold keys, or only a capped permission that can be revoked?
- Is every destination on an approved list, with new payees needing human sign-off?
- Is there a full log of each action, with the data and reason behind it?
- Who can switch the agent off, and has anyone tested the switch?
- Who signs the policy, and who is accountable when the agent is wrong?
Custody is where TrustSwap has a view. Panthea is TrustSwap's institutional custody platform, and custody is the layer this guide says an agent should sit outside. Where this is going, in our view, is agents that request actions against custody-level policy controls, with limits and approval rules enforced by the custodian rather than trusted to the agent. That is a direction, not a shipped feature.