BBVA becomes the first European bank to join Poppy, the Sierra AI and Meta initiative to design a protocol connecting AI agents with companies
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
BBVA joins as a design partner in Poppy, the draft protocol with which Sierra AI and Meta want AI agents to deal with companies securely. The user chooses what the agent may do, and the company knows who it is facing and how far to let it go, on top of established standards: OAuth, HTTPS, OpenAPI and MCP. In banking it would serve to compare products or start procedures, though the bank gives no dates.
The Spanish bank joins the group of companies shaping the rules under which an AI agent will be able to handle errands on a person's behalf.
BBVA has signed up to Personal Agent Protocol, known as Poppy, the Sierra AI and Meta project to set a common, secure way for artificial intelligence agents to deal with companies. The bank describes itself as the first European lender to enter the initiative, where it will take part as a design partner.
Poppy is still a draft. Sierra AI unveiled it alongside Meta and seven other companies (Walmart, Shopify, Stripe, Rocket, Genesys, NiCE and Instinct) and, when it published the text, named 35 more design partners. Besides BBVA, that list includes Visa, Mastercard, PayPal, Bank of America, Wells Fargo, OpenAI, Cloudflare and Okta. Their job is to give feedback on the draft from the standpoint of each business.
As its backers explain it, many agents today have to use the customer's credentials or find their way around pages made for people. Poppy proposes something else: the agent identifies itself as an agent, the user decides what it may access, and the company knows on whose behalf it is acting and how far it is allowed to go. The draft foresees three ways of working: the company's website, its application programming interfaces (APIs) or a conversation with the company's own agent.
It does not start from scratch. It rests on open, widely adopted standards such as OAuth, HTTPS, OpenAPI and MCP, to which Sierra's text adds JSON Web Tokens. The aim is for a company to adopt it with part of the infrastructure already in place and to connect once, instead of setting up a separate integration for every agent.
In banking, BBVA gives a future example: a customer asking an agent to compare products, collect information or set certain procedures in motion, always under the permissions and conditions that customer has laid down. The bank announces no service and gives no dates. It says its involvement will let it add to the thinking on these new forms of digital relationship and explore how they might apply to financial services.
David Puente, who heads retail client solutions at BBVA, says security has to be at the centre of the interactions between AI agents and digital services.
Sierra AI says that over the coming month it will hold design workshops and release a reference implementation for developers.
Why it matters · analysis and opinion
An agent that wants to operate on someone else's website today has to pass itself off as its owner, with that person's passwords, on screens made for people. That is exactly what a bank cannot accept: it does not know who is typing or with what permission. With BBVA, Bank of America, Wells Fargo, Visa and Mastercard taking part in designing the standard, the financial sector appears to assume agents will reach its channels and would rather define the conditions than have them imposed. Almost everything is missing for real use: the text is a draft, no reference implementation has been published, and nobody has said when a customer will be able to authorise an agent at a specific bank. For any company with a customer area, the useful question is which tasks it would let an identified agent carry out and which not.
Official source: BBVA · Written with the help of AI: how we make the news
