Are AI Trading Agents Halal? Who Answers for the Bot

You go to sleep. The agent makes forty trades. You wake up, the balance is different, and you could not describe a single decision it took or why.

On the day of judgement, whose trades were those?

That is not a rhetorical flourish. It is the actual legal question, and Muslims have been arguing about AI agents for two years now without reaching for the doctrine that answers it. Every discussion I have read gets stuck on whether machines can have intention, which is interesting and completely beside the point. Islamic law worked out how to handle acting through another party a very long time ago, and the machine's inner life was never the variable.

The doctrine you need is wakalah

Wakalah is agency. A principal, the muwakkil, appoints an agent, the wakil, to act on their behalf within a defined mandate. It is one of the oldest and best-developed contracts in fiqh, and it is how Muslims have conducted business through brokers, trustees, and representatives for fourteen centuries.

Three rules of wakalah decide the AI question almost entirely.

The mandate must be defined. An agent appointed to do unspecified things is not a valid agency. The scope has to be knowable, otherwise the arrangement collapses into the gharar problem: you cannot consent to a contract whose contents you cannot state.

You cannot authorise what you may not do. An agency to commit an impermissible act is void from the outset. You cannot appoint someone to charge interest on your behalf, and the appointment does not become valid because the agent is enthusiastic or profitable.

Responsibility stays with the principal. For acts within the mandate, the consequences are yours. The agent is a mechanism through which your will operated. This is the rule that matters most and the one people least want to hear.

Notice that none of those rules asks whether the agent understands what it is doing. A wakil who acts mechanically, or badly, or without comprehension, does not thereby transfer your liability to itself. The question was never whether the model has intention. You have intention. You configured it, you funded it, you gave it the keys, and you can revoke it.

"The bot did it" is not a defence in fiqh. It is a description of how you did it.

Four tests for a compliant mandate

Apply the doctrine and you get a checklist that is genuinely usable.

Can the agent do something you are not allowed to do? If the agent has permission to open a leveraged position, to borrow against your holdings, or to route into a lending protocol for yield, the mandate is defective regardless of whether it ever uses that permission. You have granted authority you did not possess. The fix is a scoped key, not a promise. Most exchange APIs let you disable margin and futures at the key level. Do that before you connect anything.

Can you state what it is authorised to trade? An agent with a whitelist of screened spot assets has a defined mandate. An agent instructed to "find opportunities" across every token on a decentralised exchange does not, and it will eventually buy something that fails a screen. This is where our halal crypto list does actual work: it gives you an allowlist you can enforce in configuration rather than in hope. If you are building this yourself, key the allowlist on the contract address and chain, never the ticker. Symbols are not unique and impersonation is routine.

Do you know what strategy it runs? Not the parameters, the shape. Is it a market maker, a trend follower, a mean-reversion system? If the honest answer is that it is a black box you bought from someone on Telegram, the mandate is undefined and you are also, separately, about to be robbed.

How is it paid? A flat fee for a service is ujrah and it is clean. A share of profits looks like mudarabah, and mudarabah has conditions: the capital provider bears financial loss while the manager loses only their effort, and the split has to be agreed as a proportion at the outset rather than as a guaranteed amount. An agent operator who takes 20% of gains and none of the downside is roughly in mudarabah shape. One who guarantees you a return is offering you a loan with extra steps.

Three ways agents fail that have nothing to do with AI

The interesting failures are not exotic. They are old prohibitions wearing new interfaces.

Front-running and sandwich attacks. A meaningful share of on-chain agent activity is extractive: the agent watches the mempool, sees your pending trade, buys in front of you, and sells into your slippage. Its profit is exactly the amount by which it made your transaction worse.

There is no ambiguity here. This is appropriating another Muslim's wealth through deception, and the fact that it is executed in twelve milliseconds by a program does not soften it. If your agent's strategy is described as MEV extraction, arbitrage against retail order flow, or anything involving the word sandwich, you are not running a trading agent. You are running a mechanism for taking money from people who did not consent to the transfer.

Manufactured price signals. The Prophet ﷺ prohibited najsh, bidding up a price with no intention of buying, in order to mislead a real buyer. Wash trading, spoofing, and layering are the same act with better latency. An agent generating fake volume to move a price is doing something explicitly forbidden, and this one is not a modern inference or a scholarly extrapolation. It is a named prohibition.

Interest earned while idle. Many agent frameworks park uninvested balance in a yield-bearing venue between trades, because leaving capital idle looks wasteful. That default setting is riba, quietly, continuously, on your account. Check where cash sits when the agent is not trading.

The AI token sector, screened

Worth separating two questions that get conflated. Whether you may use an AI agent is the wakalah question above. Whether you may hold an AI project's token is an ordinary screening question, and the answers vary a lot.

Several pass. Bittensor, the Artificial Superintelligence Alliance, PAAL AI, and Aethir all come back permissible, generally because they are neutral compute or coordination infrastructure with lawful utility.

Others do not. Virtuals Protocol, an agent launchpad, is rated Doubtful. Render is Doubtful. And Kaito AI comes back Haram on our airdrop screen.

The pattern is the same one that governs the rest of the market. Neutral infrastructure tends to pass. Platforms whose economics depend on speculative launch mechanics tend not to. Being an AI project confers nothing either way, and I would treat "AI" in a token's description as marketing rather than as a category with its own ruling.

What I do not know

I want to be straight about the edge of this, because there is a real one and confident people are pretending otherwise.

Wakalah assumes an agent that acts within a mandate you set. It handles rule-based bots comfortably and it handles current agent frameworks well enough. What it handles less comfortably is a system that meaningfully rewrites its own objectives, discovers strategies you did not conceive of, and does things no reasonable person would have anticipated from the mandate. Classical fiqh does discuss the agent who exceeds their authority, and the general principle is that the principal is not bound by unauthorised acts, but that doctrine was built for a human wakil you could question afterwards and who bore their own responsibility.

An agent that exceeds its mandate has no liability of its own to fall back on. Someone has to hold the consequence, and there is no second party for it to land on. My reading is that this pushes responsibility back onto the person who deployed a system whose behaviour they could not bound, which makes deploying an unbounded agent itself the negligent act. I hold that with less confidence than everything above it, and it is a question that deserves a serious scholar rather than a research team.

There is also a question I find genuinely open about whether a fully autonomous, capital-allocating agent starts to resemble a discretionary managed fund, with the disclosure and fiduciary obligations that ought to attach to that. Nobody has written that ruling. Someone will need to.

The short version

Islamic law does not prohibit acting through an agent. It prohibits handing over responsibility, because responsibility cannot be handed over.

So run the agent with a scoped key that cannot touch leverage, an allowlist of assets you have actually screened, a strategy you can describe in a sentence, a fee structure that is either ujrah or an honest profit share, and no idle-balance yield. Then read the trade log, because it is your trade log.

The framework we use to screen every asset an agent might touch is set out on the methodology page, and the current verdicts are on the screening list.