The Agentic Identity Standards War Arrives in Finance: Meta+Sierra's Personal Agent Protocol (Poppy)
On October 6, 2026 at Sierra Summit, Meta and Sierra (Bret Taylor, Clay Bavor) announced the Personal Agent Protocol — an open standard for how a consumer's AI agent discovers a business, signs in via OAuth with customer-granted read-only or write access, and completes tasks through the company's website, its APIs (MCP/OpenAPI), or its own agent. On October 9 they published the first draft, nicknamed Poppy, at personalagentprotocol.org — a company publishes one file at /.well-known/poppy.json declaring how agents may interact — and named 35 design partners.
The finance-heavy roster is the story for anyone mapping vertical AI distribution. The October 9 design partners include Bank of America, Wells Fargo, BBVA, Chime, Synchrony, Venmo, Plaid, Visa, Mastercard, PayPal, Adyen, GEICO, Liberty Mutual, Cigna, Insurify, and Rocket (mortgages) — alongside OpenAI, Target, Walmart-adjacent commerce, and others. Per the tracker (CellCog): "On October 9 Sierra named 35 more design partners, OpenAI among them, with Visa, Mastercard, PayPal, Bank of America and Target; Anthropic is still not listed." OpenAI was absent on announcement day (CNBC) and joined three days later; Taylor, who is also OpenAI's chairman, said he expects the holdouts to join.
Why it matters now: Meta's personal agent Muse launched in September and already has "millions of users in the US" (per Meta's David Singleton), and Amazon blocked Meta's agents citing scraping worries — the exact chaos a standard targets. Taylor told CNBC: "It is kind of chaos until such a standard exists." Singleton: "We're defining rails that we hope personal agents and business agents can run over for the future."
For financial institutions this is the front-door identity question the Fed's own agentic-commerce framework flags (see Regulatory Frameworks and Liability for Agentic Finance: AI Agent Governance, the FCA's Mills Review, and Live Testing Cohorts): banks must decide whether agents reach them through an interoperable protocol like Poppy, through card-network agent registries, through platform-specific rails (OpenAI's ChatGPT finance stack, see ChatGPT Finance Dashboard Connects 12,000 Banks via Plaid as OpenAI Enters Consumer Fintech), or through headless-banking connectors like Paywhere's (Headless Banking Arrives: Paywhere's Programmable AI Storefront Puts Banks Inside ChatGPT and Claude). JPMorgan's cautious agentic-commerce posture (JPMorgan Payments Charts Cautious Strategy on Agentic Commerce, Flags Liability Gaps) and the trust/verification funding wave (The Agent Trust-and-Governance Layer Keeps Raising: Baselayer's Agentic Identity Suite, Onyx $113M, Island $400M — AI Security Is RegTech's Dominant Category) both sit directly downstream of who wins this standard. Sierra plans a v0.1 spec, design workshops, and a reference implementation within a month of the draft.