AFSP v0.1 · Public comment open through November 16, 2026
The Agentic Financial Services Protocol (AFSP) is an open industry protocol for one moment: when an AI agent arrives at a regulated financial institution on behalf of a person. Before the agent reaches the institution's systems, AFSP lets the institution verify who the agent is, who it is acting for, and that the person is present and in control. Version 0.1 covers the first use case, agent-assisted opening of a new deposit account, and is open for public comment until November 16, 2026.
The web
Agents already search, compare and buy on people's behalf, and they will arrive at banks ready to act. Today there is no agreed standard for deciding whether to let one in, so the only safe answer is no. OAuth, FAPI, FDX and FIDO assume a relationship already exists. AFSP governs the moment an agent asks to start one.
The protocol
Before any open banking API is called, the AFSP platform delivers a signed PCAA (Pre-Credential Agent Attestation) package to the receiving institution. S1, S2 and S4 are mandatory: if any fails, the package is rejected. S3 is optional and S5 is conditional. Their absence is disclosed to the institution, and an S5 anomaly is routed to human reauthorization, never automatically declined.
Ready to validate a package.
{ "afsp_version": "0.1", "package_id": "pkg_1a3c…0c2e",
"S1": { "agent_id": "agt_aip_assistant_20260801_prod", "build_hash": matched },
"S2": { "type": "FIDO2_BIOMETRIC", "tee_attestation": verified },
"S3": { "federated_referral": present },
"S4": { "account_longevity": "MATURE", "provider_signature": valid },
"S5": { "normalized_score": 0.91 },
"platform_signature": { "algorithm": "ECDSA-P256", "signature": "MEUCIHx7a3…" } }Regulatory grounding
Signal 4 derives from consumer-permissioned data under Section 1033. Pre-access attestation supports the FFIEC's 2021 authentication guidance. Every session produces a tamper-evident audit record, retained for seven years.
Institutional control
AFSP decides nothing about the person. It is not a model, not a fraud score and not a replacement for KYC. Every KYC, underwriting and account-opening decision stays with the receiving institution.
Consumer sovereignty
They approve every consequential step on their own device, outside the AI model. Existing banking relationships come first; other institutions are considered only if the consumer chooses, with their identity kept private until then.
Who it's for
The principle throughout is simple: the agent presents, the human decides, the bank executes.
Banks and credit unions get a verified, pre-screened session before their own processes begin, with no change to how they perform KYC or make decisions, and first consideration for existing customers.
You make every decision
AI platforms, bank-embedded assistants, widgets and core-banking platforms present the session, run the consumer's biometric authorization and route discovery to the AFSP marketplace.
CLO certification
Certify your agent build in the AFSP agent registry and reach participating institutions through one certification and one integration pattern, instead of a separate arrangement with each.
One certification · one integration
Certified providers contribute the financial identity attestation (S4), derived from Section 1033-permissioned data, and the session integrity score (S5), in standard signed formats.
Standard, signed attestations
A tamper-evident record of who authorized what, when, on whose behalf, and with what signals present. AFSP creates no new data rights and no new decision-making authority.
Examination-ready by design
Your agent acts only within what you explicitly authorized, confirmed with a biometric check on your own device. No institution learns who you are until you choose it.
The sovereign authority
In banking · the v0.1 use case
Version 0.1 covers one use case: agent-assisted opening of a new deposit account. This is the worked example from Appendix A of the specification. It is non-normative, and its values are illustrative.
The agent asks
Imagine a customer, we'll call her Alice, asking her AI assistant for the best high-yield savings account: APY above 4.5%, no monthly fees, minimum balance under $500.
AFSP verifies
The assistant checks its registered AFSP tool and the Discovery Declaration published by Alice's bank. Alice authorizes the session with Face ID, and her device's TEE signs the authorization token.
Authorization token signed on Alice's enrolled device.
The institution decides
The session defaults to institutions Alice already banks with. She chooses to look further and confirms with a second Face ID, which signs a scope expansion token.
From authorization to account open2 minutes, 50 seconds.
Identity disclosed to one institution. AFSP absent from KYC and the account-opening decision. The bank remains the regulated trust anchor.
Certify and authorize
Under AFSP, an agent never arrives at a bank unannounced. Its operator certifies the build in the AFSP agent registry, the consumer authorizes each session on their own device, and the institution verifies both before anything proceeds.
Agent operator
Certify the agent buildThe build is registered in the AFSP agent registry. Institutions verify its provenance attestation and build hash (S1).Consumer Layer Operator
Present the sessionThe CLO discloses who operates the agent and which data will be used, then runs the biometric authorization ceremony.Consumer
Authorize the sessionFace ID on the enrolled device. The TEE signs a token that fixes the action classes, product categories and time limit.AFSP platform
AttestFive signals are bound into one ECDSA-P256-signed PCAA package, which is bound to a single institution.Receiving institution
Verify and decideThe institution validates the package and returns PROCEED_TO_KYC, REQUEST_ADDITIONAL_VERIFICATION or DECLINE_SESSION.Regulator
ExamineA signed, tamper-evident audit record, retained for seven years, is available to authorized regulators on request.
Session record
Appendix A · Illustrative
Under the hood
AFSP governs one question only: should this AI agent session proceed to the open banking API layer? Its job ends at the clearance decision.
The agent presents. The human decides. The bank executes.
The principle behind every component of AFSP.
Governance
The AFSP Foundation, an independent non-profit targeted for formation in early 2027, will ratify and maintain the specification, run the working groups, and administer certification and the participation registry. Until then, Primitive acts as interim protocol administrator. After that, it is one voice in the Foundation's governance.
Trust layerGet involved
AFSP v0.1 is a public review draft, open for comment through November 16, 2026. It is a draft for scrutiny, not a finished standard.