An AI assistant that explains account balances is convenient. An AI assistant that executes orders on a real trading venue belongs in a different category. Bitpanda has introduced an API and MCP access for its Fusion platform, allowing Claude, Cursor, and other compatible assistants to trade on explicit instruction. That sounds like a short path from a chat window to the market. The important part, however, is not whether a model can comment on a price move. It is permissions, approvals, and who pays when something goes wrong.
Key takeaways
- Bitpanda says Fusion offers automated trading through an API and MCP access for compatible AI assistants.
- Through that access, assistants can retrieve account information, check prices, place orders, and manage a portfolio.
- The platform itself warns of high volatility and potential loss of capital in crypto assets.
- For users, narrow permissions matter more than an assistant’s supposedly smart market prediction.
From conversation to order
Bitpanda describes Fusion MCP as a connection between an AI assistant and a Fusion account. Users can ask an assistant to check prices, manage a portfolio, or execute a trade. The provider says the AI executes only what a user explicitly requests. There is also a conventional API for self-written trading programs. Both routes use the same execution infrastructure and aggregated liquidity from several trading venues.
That goes beyond earlier financial chatbots. Many systems explain terms, summarize portfolio changes, or sort documents. Here, a language model receives a tool capability that can trigger a real transaction. Technically, this is not magic. A model proposes or confirms an action, an interface transmits it, and the platform executes it. In practice, it changes how responsibility works. An imprecise response can become an unsuitable buy or sell order.
Regulated does not mean risk-free
Bitpanda points to its MiCAR license and supervision by Austria’s Financial Market Authority. That matters for context, but it is not a seat belt for every decision. The company itself says Fusion can lead to increased losses when market conditions change unexpectedly, and crypto assets are volatile with a possibility of total loss. A regulated platform governs parts of its operations and obligations. It does not remove market risk or replace a user’s own review of an order.
A conversational interface can blur that distinction. When asked, an assistant can fluently explain why a position may look attractive or risky. That does not mean it has complete, current, or personally suitable information. AI text can sound like advice even when it is only a model producing a likely-sounding response. This article is not investment advice. Anyone investing money needs to understand their goals, risk, costs, and potential losses.
Permissions should be smaller than convenience
With a trading agent, the key product question is not which model writes the cleverest sentence. It is what that account is allowed to do. Good defaults would allow a small test amount, specified markets, daily limits, a ban on withdrawals, and a second confirmation before an order. Better still is a separation between read permissions and trading permissions. An assistant can then analyze balances and prices without every conversation immediately being able to move money.
The principle is familiar from cybersecurity. With capable cyber tools, the capability is not the only issue. Permissions and controls determine the boundaries of use. Trading is similar. API keys, access tokens, and automatic approvals deserve at least as much attention as the prompt. A compromised account or manipulated instruction does not become harmless because the interface sounds friendly.
European rules are catching up with agents
The European Commission explains that AI agents are not a separate category under the AI Act, but generally fall under rules for AI systems and general-purpose AI models. Since August 2, 2026, transparency obligations apply to agents intended to interact with people or generate content. Additional requirements may apply later to particularly risky uses. This does not replace financial-market law, but it shows the direction. An agent is not merely a new button. Its autonomy and tool access are part of risk assessment.
Supervisors are not testing this direction in empty space. The UK’s FCA is using its Supercharged Sandbox to let firms work on AI applications for safer agent-led payments, fraud detection, and governance. A controlled test environment makes more sense than the assumption that a disclaimer will make an assistant reliable. Between a demo and a product that moves real money sit permission models, logs, kill switches, and human accountability.
What users should check before the first order
Anyone using this kind of access should begin with a boring setup. Start with read-only access. Then have the system create an order as a draft and personally check every amount, market, order type, and fee. Only then might tightly limited execution make sense. No unrestricted keys, no withdrawal rights, and no permanent automation without limits. It is equally important to keep logs and know how to revoke access immediately. These steps do not suppress returns. They are the condition for ensuring a technical experiment does not become an expensive chat history.
Outlook: An agent is only as good as its guardrails
Bitpanda’s Fusion MCP shows where this development is heading. Language models will not only explain, but operate accounts and tools. That can reduce routine work, such as checking prices, rules, or order drafts. It can also lower the threshold for risky transactions. The progress is therefore not that a bot can trade. It is whether platforms and users precisely define what the bot must never do. Those who build the guardrails first will have the more useful assistant.