Loading page…
The bank will help shape Poppy’s draft, not launch a customer service. Its proposed rules separate a customer’s permission from what a business allows an agent to do.
Listen to this story
BBVA’s participation gives a European bank a seat in shaping Poppy, a proposed standard for personal AI agents to interact with businesses, rather than adding an agent feature to its banking app. The design aims to let companies identify agents and enforce their own limits while customers authorize specific account access. For businesses, a shared approach could reduce the need to build separate connections for each agent; whether it works for financial services remains to be tested, and the protocol is still a draft.
Sierra’s October 9 draft named BBVA among 35 design partners, including Bank of America, OpenAI, Visa, and 1Password.
Poppy outlines three routes: company websites, software APIs using standards such as OpenAPI and MCP, and conversations with a company’s own agent.
Account-specific access requires customer sign-in through OAuth, and businesses retain control over which actions and connection methods they allow.
BBVA is helping shape how personal AI agents could access businesses on customers’ behalf, with permissions set by users and limits set by companies. On October 13, 2026, the bank said it had joined the Personal Agent Protocol initiative, known as Poppy, led by Sierra AI and Meta, as its first European bank.
The announcement gives BBVA a role in designing the proposed rules, rather than introducing an agent-powered banking service. The bank says it will contribute to discussions about digital interactions and explore possible uses in financial services. Its stated priorities are customer security, privacy and control over how AI is used.
BBVA’s involvement was already listed in Sierra’s October 9 publication of a draft protocol. Sierra named it among 35 additional design partners, alongside companies including Bank of America, OpenAI, Visa and 1Password. Those partners will provide feedback from their business perspectives; the bank’s announcement now explains the role it intends to play.
Sierra describes a problem with today’s approach: personal agents often have to sign in as customers and navigate pages built for people. Businesses lack a standard way to guide those agents. Poppy proposes a route in which the business can recognize the agent, know whom it represents and apply the customer’s approved permissions.
The draft starts with discovery. A company publishes a file at a standard address on its website, telling an agent how to connect, how customers can sign in and what actions are available. The agent then starts a session and identifies itself. That session can begin as a guest, enough for questions about stock availability or a returns policy.
Account-specific work adds another step. The customer signs in on the company’s page through OAuth, a standard for authorizing access. If the company permits it, the agent can use a session token granting only the access the customer approved. Customer approval does not replace business limits: each company still determines which actions and connection methods it offers.
Security must be at the heart of interactions between AI agents and digital services. This common protocol lays the foundation for an open and interoperable ecosystem that protects our customers’ privacy and allows them to remain in control.
David Puente, Head of Retail Customer Solutions at BBVA
Poppy is designed to carry the same session token across a company’s website, software interfaces and conversations with its own agent. Sierra says this would keep a question asked before sign-in and an account change made afterward within the same visit, rather than forcing the customer to begin again.
Sierra says the design builds on existing standards, including OAuth and HTTPS, so companies can reuse tools and infrastructure. Its stated goal is one connection through Poppy instead of a separate integration for every personal agent. The core is also intended to support extensions tailored to particular industries.
BBVA identifies potential future tasks: comparing financial products, gathering information or initiating certain financial processes. It frames those possibilities as subject to each user’s permissions and conditions, not as services now available. Its participation is an opportunity to explore how the design could apply to financial services.
The protocol itself remains a draft. In its October 9 announcement, Sierra said it would hold design workshops and publish a reference implementation over the following month to help developers get started. BBVA and the other design partners are contributing feedback during that process, while the proposed rules are still being shaped.
Loading discussion...
Join the conversation
Explain where customer choice should end and business control should begin.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.