Genoa: where our product thinking stands

Two deliverables, one core

This is a direction, not a decided positioning. Nobody on the team has demand data; as I put it on the call, there is no business in agentic banking yet.

• First users. Unite's existing business clients for the first 6 to 12 months, most of whom have no agent. Later: businesses that bring Claude, ChatGPT or Grok agents through a vetted gate.
• Why it may matter. A bank's problem is not whether an agent can call an API, but who is acting, on whose authority, within what limits, with what record. Lead's paper (Sept 2026) frames it the same way.
• What it could become. A neutral layer that routes money across many banks, rails and liquidity providers, and the identity and mandate layer partners trust. No single bank will build that for its competitors.
• Not yet claimed. That customers want this, that a hosted product beats bank-direct agents, that we need no licence, or how we make money.

What it takes for an agent to move real money

An agent that does real tasks is an ordinary model with tools and a harness: instructions, connectors, a loop. The model can be swapped. What makes it a financial agent is the authority around it, and that authority has to be issued and checked outside the model (A: "like a two-factor key the agent never generates").

What Lead proposes, in short

• A new "Authorized Financial Agent" category, with a KYA programme for Tier 1 to 4 agents run by five bank functions (financial crimes, legal, enterprise risk, compliance, information security), and oversight levels TRACE-1 to 3. Treasury agents sit at the highest level.
• For partner-deployed agents, which is what ours would be, the bank approves the agent's tier and mandate scope before launch, tags agent transactions in monitoring and keeps a kill switch. Platforms are third-party risk "wrapped in a new UX".
• Agent platforms, orchestration tools and payment networks can carry liability for failures inside their own control.

How much identity, and for whom

The mandate as a token

A mandate is a signed token the agent presents but cannot create or alter. Limits such as "amount used today" are computed by the platform and checked on the bank side, never by the agent. Google's AP2 already publishes a shape (verifiable credentials in SD-JWT, signed by the user or a trusted platform), and Skyfire's KYA tokens are signed JWTs. Both were built for commerce and cards; their fit for bank transfers is unproven.

Where we sit, in four lines

1. 1We sit in the middle. Businesses (and later their own agents) on one side; banks, PSPs and rails on the other. Our product is the trusted path between them.
2. 2The cut-out risk is real. Meow runs a live MCP server; Ramp and Zeni sell invoice agents. Each covers only its own rails, so our defence is neutrality across many.
3. 3Dedicated agent-money players exist at both ends. Natural and Catena build accounts for agents (Catena has applied for a bank charter); Payman sells a policy layer to banks.
4. 4Standards are unsettled. AP2, Visa, Mastercard and Skyfire each define agent credentials. We map to them rather than invent our own.

Two customers and one partner

No interviews yet; these are working personas from the call and earlier research.

I's guess: 98 to 99.9% of businesses have no agent today, 5 to 10% will within two years. J's counter: those that do will use Grok, Claude or ChatGPT and expect to reach banks directly. Both are opinions.

Four candidate jobs, scored from the customer's side

Scores are our judgement, not measured. No job is validated with users.

Eight rules we design by

Thesis: a financial agent is an ordinary agent plus authority the platform issues and enforces around it.

• Outcome first, agent hiddenCustomers ask for an action; "agent" is the partner-facing word.Team call; Gumloop's guided setup
• Authority belongs to the platformIdentity, mandate, limits and keys are issued and checked outside the model. The agent never sees secrets and cannot change its own rights.A on the call; Lead; Gumloop secrets; Conduit machine signers
• Rules decide, the model proposesThe model reads invoices and suggests. Deterministic checks approve or refuse, using limits and history from our ledger.Earlier research; A; Lead's call for independent validation
• Approve first, then graduateEvery payment asks at first. After repeated approvals the system proposes a rule and the owner accepts it. Changed bank details are never automatic.Gumloop approval modes; our flow design, untested
• Stopping is as easy as startingPause, narrow, suspend, revoke. Time to full shut-off is measured and reported.Lead; Meow revokes in seconds
• Everything leaves evidenceIntent, mandate, approval, action, outcome, in tamper-evident storage usable for disputes and reporting.Lead; Meow's signed audit trail
• Neutral across providersNo single bank or rail is the product, and the mandate stays mappable to AP2, Visa, Mastercard or Skyfire formats. This is our defence against bank-direct agents.Team call; Lead
• Start narrow, claim littleSmall use cases, explicit permissions, human override, conservative partner governance. No "agentic bank" claims yet.Lead's own stance

What has to be true, most fatal first

1. A1A partner bank accepts clients from us because they arrive with identity, mandate, limits and audit. If each agent needs Lead-style five-function review, or banks will not onboard platform-run agents, there is no live product.
2. A2Businesses delegate real money, first with approval, then partly alone. If owners never loosen rules, the value is preparation and evidence, not autonomy.
3. A3The pain is worth paying for, and someone pays us. Who pays, for what (a fee per payment, a spread on routing, a subscription), and whether it covers liability.
4. A4We can carry liability at an acceptable cost. I said it would be ours; one wrong or sanctioned payment could outweigh the revenue.
5. A5We can operate without our own licence, inside a partner's programme. Unverified claim from the call.
6. A6Routing across providers gives real savings or access one bank cannot offer, and we are not tied to one rail. Today the plan runs on Conduit alone, which could also move up the stack.

Known, likely, unknown

Contradictions we are holding

• "Create agent" vs no agent for the customer. Working choice: hide it from customers, keep it for partners. V to confirm.
• Invoices first vs routing, treasury and account opening first. Reconciled for now: routing is the value of J1, J3 covers own-account moves, account opening goes into onboarding.
• Real money now (V) vs a conservative regulatory start (Lead, Conduit KYB). Sandbox now, live gated. J3 may be the safest first live test.
• "No licence needed" (I) vs Lead's view that the bank keeps AML responsibility and treats platforms as third-party risk. Needs a lawyer.
• Banks as distributors (I) vs banks as competitors (J). Meow shows the second pattern exists.
• Hosted agent vs the KYA package. If we host the agent, banks may not need the agent vocabulary at all.
• Neutral routing vs one rail today. The defence rests on many providers; the demo has one.

Who to learn from and watch

Catena, Payman and Skyfire details come from secondary profiles and press, checked 6 Oct 2026; not from using the products.

A sandbox demo of paying an invoice under a signed mandate

Shown first to partner banks and the team, then to a few Unite clients once live access is clear. It should prove three things: to a bank, that a client from us carries identity, mandate, limits, audit and a working stop; to us, that an owner approves, then accepts a proposed rule, and an automatic payment follows; and that routing gives a visible reason to use us.

The flows

If time allows: J3 (convert between own accounts) or J2 (contractor batch) reuse flows 2 to 5. The second routing provider is simulated and labelled as such until we have access.

Open questions, with proposed owners

Ordered by how much the answer could change direction. Owners are a proposal.