Waleed Qureshi

Co-founder and CTO @halvorai. Built a fincrime product that was acquired. Writing about AML, evidence and AI agent payments.

[Waleed Qureshi @waleedq_dev]

Six ways AI agent payments go wrong. Most of them look like small, normal, in-limit payments to the bank.

A short thread.

[Waleed Qureshi @waleedq_dev]

Lithic says a mandate on the agent token gives disputes a clear record. The fallback is a single-use card.

If that record lives only on the token, it breaks on retry. @halvorai is building a case file not tied to one credential type. Developer preview.
https://t.co/h2kByL3Lhb

[Waleed Qureshi @waleedq_dev]

In the Arcus incident, its books showed a balance that wasn't there, and $2,234,391 in USDG left on-chain.

A bank needs a record it can check against the rail. That's the case file we're building at @halvorai. We never approve or block a payment.
https://t.co/T3dOAj6Nlo

[Waleed Qureshi @waleedq_dev]

Bottomline says it completed its first live USDC payments, an intra-company transfer on its Global Payments Hub, under the same approvals, controls and audit processes used for other rails.

The useful part is that the audit trail sits with the payment.
https://t.co/VUzN1DR4qZ

[Waleed Qureshi @waleedq_dev]

Disputes were built around "I didn't make this purchase."

With agents the honest claim is "I set up the agent, but I never asked for this." That's neither fraud nor buyer's remorse. Who should carry that loss: the cardholder, the merchant or the agent's developer?

[Waleed Qureshi @waleedq_dev]

Anchorage Digital Bank is partnering with Lydian so merchants can take stablecoins at checkout and settle in local currency. A customer can pay from any digital wallet.

If the merchant didn't onboard that payer, who screens them, Lydian or the bank?
https://t.co/FojaGwct6T

[Waleed Qureshi @waleedq_dev]

Most double charges I've debugged weren't fraud. They were a retry after a timeout, with no idempotency key.

Agents retry far more than people do. If your payment API can't tell a retry from a new intent, an agent will find that bug for you.

[Waleed Qureshi @waleedq_dev]

@padrinoIG @samboboev That's the loss case I'd plan for first. The mandate was followed, so the policy layer will say the payment was allowed.

What decides the review after that is whether you kept what the agent was shown: the payee, the amount, and the invoice it treated as real.

[Waleed Qureshi @waleedq_dev]

Bloomberg Law, citing people familiar, reports about $270 million for a joint dollar stablecoin issuer, with Goldman, Citi, Santander and Deutsche Bank among the firms. Unconfirmed.

KYC at mint and redeem covers the first and last holder, not the middle.
https://t.co/5Fi2LgPHOI

[Waleed Qureshi @waleedq_dev]

The line I'd underline: most enterprises still block agent traffic over fraud and chargebacks.

If agents become customers, every disputed charge comes down to one question: did the person buy this, or did their agent act on its own? A card authorization alone can't show that.

[Olivia Moore @omooretweets]

Move over, B2B and B2C - the B2A economy is here

Agents are the primary users of the Internet, and soon will be the primary customers for every product

Our thesis @a16z on the massive opportunity here 👇 (cc @venturetwins) https://t.co/KkGxqDIHsb

[Waleed Qureshi @waleedq_dev]

@Mintscope1 From an AML view the currency matters less than the route. An agent that converts USDC to a won stablecoin to pay a merchant adds a conversion and a counterparty at each hop.

Each hop is somewhere screening applies. Who keeps the record of why the agent picked that route?

[Waleed Qureshi @waleedq_dev]

@oracles One thing I'd add from the compliance side: when issuing, custody and conversion sit with different partners, each one monitors its own slice. The issuer sees card authorizations, the wallet sees onchain funding.

Who sees both when a bank asks about one customer?

[Waleed Qureshi @waleedq_dev]

Arcus's incident report says a subaccount-transfer bug let a new account record a balance it didn't hold, then withdraw $2,234,391 in USDG against it.

The ledger said the funds were there. The assets weren't. Records have to be checked against the chain.
https://t.co/T3dOAj6Nlo

[Waleed Qureshi @waleedq_dev]

A 10 Nov Business Wire release says KERNEL lets browser agents pay at existing checkouts without the card number reaching the agent's model or the developer's app.

That shrinks PCI scope. It doesn't keep the instruction a bank will want in a dispute.
https://t.co/clKarm1ZNj

[Waleed Qureshi @waleedq_dev]

@richardturrin For compliance teams the premium is a signal too. A persistent gap usually means demand that can't get dollars through the bank route, so it moves through P2P desks where no one has done KYC on both ends.

Geography changes the risk, not just the price.

[Waleed Qureshi @waleedq_dev]

zerohash says KYA screening and attestation will sit on every agent-initiated transaction.

An attestation from the settling party isn't independent evidence. That's the pack we're building at @halvorai, in developer preview.
https://t.co/9XnRZCeV9B

[Waleed Qureshi @waleedq_dev]

@samboboev "Govern Your Agent" is a good frame. One thing I'd add from the bank's side: the record of why each payment was allowed is written by the same layer that allowed it.

When a payment is reviewed later, the bank will want to check it against something it didn't write.

[Waleed Qureshi @waleedq_dev]

@alexrkonrad @daraghjmurphy Co-brand is an interesting place to watch this. The brand's app knows what the customer asked the agent for. The issuing bank sees an authorization from the cardholder.

When an agent purchase gets disputed, that instruction is the evidence. Which side of the co-brand keeps it?

[Waleed Qureshi @waleedq_dev]

In regulated software this isn't a style debate. An examiner can ask why a rule fired, or didn't, on a payment two years ago.

"The model wrote it and I approved the diff" isn't an answer. Someone has to understand the logic well enough to defend it.

[aditya @adxtyahq]

I worked with someone sometime back who would run 5–10 Claude sessions simultaneously, keep multiple Claude Code instances running overnight, and have thousands of lines of AI-generated code merged into main almost every day

There was barely any proper testing, code review or verification - everything was about shipping faster, and the expectation was that the rest of the team should operate the same way, 6–7 days a week

Honestly, this is bullshit

If you're building a product, you need engineers who understand the system, question decisions, think about edge cases and take responsibility for what ships

You don't need AI making every decision while engineers blindly approve whatever it generates

AI should help engineers move faster, not replace the thinking that goes into building a reliable product

Shipping code is easy - making sure it actually works is the engineering part

[Waleed Qureshi @waleedq_dev]

"It is not the agent monitoring the agent." The same rule applies to evidence. If the record of what an agent did is written by the agent, or only by the rail that settled it, a bank can't treat it as independent.

That's what we're building at @halvorai, in developer preview.

[Dr Efi Pylarinou @efipm]

💎 This week's video: In conversation with Aser Blanco, Global Banking Lead at NVIDIA.
Click to enjoy the full video interview : 👉 https://t.co/ERxH0iZBqy

❝ The first thing
OpenShell brings to the industry
is that the controls over what
that agent can do reside outside
of the sandbox. It is not the
agent monitoring the agent.❞ — Aser Blanco, Global Banking Lead at NVIDIA

One day after Jensen Huang’s GTC Berlin keynote, where NVIDIA launched the OpenShell Reference Architecture, I sat down with Aser Blanco, Global Banking Lead at NVIDIA, to talk about what it means for banks.

We cover:
🔺 Why the controls have to sit outside the agent’s sandbox, and the extra layers Vera CPUs and BlueField DPUs add at the hardware and network level
🔺 What financial services still needs on traceability and audit trails
🔺 Bank foundation models: why Aser says it takes two data scientists and a few days, not billions
🔺 Why fraud is the first use case, with payback in four to eight months
🔺 From data silos to one intelligence layer, and why banks may finally become customer-centric
🔺 5,000 agents for a data transformation, 20,000 lines of legacy code in an afternoon, and why the excuses have run out
🔺 Why this is a business revolution that the CEO has to lead

📍 @nvidia | GTCBerlin

[Waleed Qureshi @waleedq_dev]

If agents succeed by not identifying themselves, the merchant and the issuer both see the cardholder buying.

That works for checkout rates. It gets hard at the first dispute, when nobody can show which purchases the person made and which the agent made on its own.

[Philip Qiu @PhilipQiu5]

Narrative violation: agent purchasing success rates and merchant coverage are only getting get worse.

The simple fact is, merchants don’t like agentic commerce. They’ve historically been slow to adopt new trends (it took Shopify 4-7 years to gain initial traction).

If your agentic commerce strategy requires merchant permission, NGMI.