BBVA Poppy protocol Entry Establishes First European Bank Link to Meta Sierra AI Agents

BBVA announced on October 13, 2026, that it had joined the Personal Agent Protocol, also known as Poppy or PAP, as the first European bank in the design partner group. The move places the Spanish bank alongside OpenAI, Visa, Mastercard, PayPal, Bank of America, Shopify and Stripe in an effort led by Sierra AI and Meta to create a common technical standard for personal AI agents.

Scope of BBVA Participation in the Poppy Protocol

Under the draft 0.1 specification published October 9, 2026, agents must identify themselves, request explicit user consent through OAuth-style scopes such as poppy:read or poppy:write, and operate only within those limits. Businesses verify the agent identity and can restrict data exposure accordingly. The protocol supports web navigation, OpenAPI endpoints and dedicated company agents, with discovery handled by a /.well-known/poppy.json file.

BBVA will contribute to ongoing design workshops and test use cases in retail banking. These include agents that compare mortgage products, gather account information or start application processes while the customer retains final approval. David Puente, Head of Retail Customer Solutions at BBVA, stated that security must remain central so customers stay in control of their data.

The bank joins 35 design partners that already include Walmart and Stripe. Payments, notifications and additional extensions are scheduled for later versions. Draft 0.1 remains open under the Apache 2.0 license and subject to iterative updates through reference implementations expected later in October 2026.

Context for AI Agent Banking Integration

Current agent interactions often rely on screen scraping or full credential sharing, which creates security and compliance risks. The Personal Agent Protocol replaces these practices with structured permission flows built on existing standards including OAuth, HTTPS and OpenAPI. Sierra AI, co-founded by Bret Taylor and Clay Bavor, unveiled the initiative at the Sierra Summit on October 6, 2026, with Meta providing additional backing through its agent research.

BBVA’s participation follows its prior work on customer-centric AI tools that emphasize privacy controls. The protocol’s granular scopes allow a personal agent to view transaction history without the ability to initiate transfers, for example. Similar boundaries can apply to product comparisons or document uploads.

Other banks in the partner list, such as Bank of America, have already begun internal evaluations of agent-driven workflows. BBVA’s addition supplies a European regulatory perspective to the design discussions, particularly around data protection and cross-border consent management.

Next Steps for BBVA and the Broader Poppy Ecosystem

Design workshops continue through late October 2026, with a reference implementation and further specification drafts planned before version 1.0. BBVA has indicated it will run controlled tests of financial-service scenarios once the reference code stabilizes. No public timeline has been released for customer-facing features.

Partners including Genesys and Rocket have already demonstrated mortgage pre-approval flows using early agent prototypes. The same architecture could allow BBVA customers to authorize agents to retrieve rate information or pre-fill forms without exposing login credentials. Broader adoption will depend on how quickly other institutions publish their own poppy.json discovery files and define scope policies.