Agentic commerce: AI systems that discover, select and complete purchases on a consumer's behalf without real-time human input, moved from pilot to production in 2025. The frameworks being built by Visa, Mastercard, Google and Stripe now define how AI-initiated transactions will be authenticated, authorised and settled. For payment processors, issuers and acquirers, the implications are immediate and material.
The infrastructure layer: what's live in June 2026
Mastercard Agent Pay for Machines launched on 10 June 2026 as a platform enabling AI agents and software systems to make secure, automated payments across cards, bank accounts and stablecoins. More than 30 companies have joined the initiative: including Coinbase, Stripe and Adyen. Agent credentials are initially recorded on the Polygon, Solana and Base blockchains, with broader access planned later in 2026. The service authenticates AI agents, enforces spending limits and guarantees settlement through Mastercard's network. Mastercard envisions agents transacting continuously at machine speed, including microtransactions of fractions of a cent.
Visa Intelligent Commerce has expanded to over 100 partners globally, with more than 30 actively building in the VIC sandbox. Visa's Trusted Agent Protocol: announced in October 2025, uses cryptographic signatures to enable a shopping agent to identify itself as trustworthy to merchants. Visa is working in the Middle East with Aldar to allow UAE customers to use AI agents to pay repetitive fees such as real estate service charges, making the GCC an early adoption market.
Google Agent Payments Protocol (AP2), released September 2025 with 60+ launch partners including Mastercard, American Express, PayPal, Coinbase and Salesforce, is an open protocol rather than a network-level solution. AP2 defines an Intent Mandate (what the user wants) and a Cart Mandate (what the agent proposes to buy), both signed as verifiable credentials. This open approach differs from the network-layer credentials that Visa and Mastercard issue.
Stripe's Agentic Commerce Protocol: launched in October 2025 in partnership with OpenAI, enables ChatGPT users to find items and complete checkout within the chat interface. PayPal followed with Store Sync, making merchant product catalogues accessible to shopping agents, and an "agent-ready" checkout integration rolled out in early 2026 across its 35 million merchants.
What changes in the authorisation flow
Current authorisation logic assumes a human principal who can respond to friction: a 3DS challenge, a one-time password, a biometric prompt. An AI agent operating at machine speed cannot respond to these friction points. The emerging frameworks address this through pre-registered agent credentials, scoped spending authorities (merchant category, maximum transaction value, frequency limits), and cryptographic attestation that the agent is operating within consumer-established boundaries.
For issuers, this means evaluating authorisation requests where the behavioural signal profile is systematically different from human-initiated transactions. Visa observed a 4,700% surge in AI-driven traffic to online merchants before its Trusted Agent Protocol launch: an indicator of the volume pressure now building on issuer fraud models. An agent making multiple simultaneous purchases across different merchants is following its mandate; it is not, by definition, a fraud pattern. Existing fraud models trained on human behavioural baselines require recalibration.
Fraud liability in agent-initiated transactions
The liability framework for agent-initiated fraud is not yet settled. Under current scheme rules, liability for card-not-present fraud absent 3DS authentication generally sits with the merchant or acquirer. Where an agent is operating under consumer-granted authority that was itself fraudulently established: through account takeover or social engineering of the consumer, the liability chain becomes complex. Both Visa and Mastercard have signalled that scheme rule updates specific to agentic payments are expected in H2 2026.
Implications for acquirers and processors
Acquirers and processors need to assess readiness across four dimensions. First, technical infrastructure must support the credential formats and authorisation message fields used by the emerging agent payment protocols: these differ from standard card-not-present flows. Second, fraud detection systems need recalibration for transaction patterns that are systematically different from human behaviour in velocity, timing and merchant category spread. Third, merchant contracts and scheme registrations may need updating to reflect agent payment acceptance. Fourth, risk teams need frameworks for the new category of exposure that agent authority establishment creates.
The GCC is emerging as an early adoption geography. Visa's partnership with Aldar in the UAE is the first live agentic payment deployment in the region. For payment institutions licensed in the UAE, Saudi Arabia and Qatar, the regulatory implications are currently being evaluated by CBUAE, SAMA and QCB. Early engagement with regulators on agentic authentication frameworks is advisable before commercial deployment.